Re: Re: [Users] Making FreeS/WAN harder to use, INTENTIONALLY.

-----BEGIN PGP SIGNED MESSAGE-----


>>>>> "Paul" == Paul Wouters <[email protected]> writes:
    Paul> On Mon, 3 Mar 2003, Michael Richardson wrote:

    >> Btw, there is another issue for SG users - one can not enable OE if
    >> the gateway is doing NAT for the clients.

    Paul> I assume this is NAT on the SG's external interface? I don't see
    Paul> why it wold break on the internal interface. I'll do some tests for
    Paul> that.

  The situation, so that we all understand.

NAT occurs as a "POSTROUTING" act as the packet leaves eth1.

WinTOASTER----------GATEWAY-------Internet------WWW
        eth0      eth0   eth1
         .................
			  *--------------------->
                          *<---------------------
         .................
 

Where * is the modify operation.

With FS OE, one actually gets:

WinTOASTER----------GATEWAY---------------Internet------WWW
        eth0      eth0   ipsec0
                          eth1
         .................
			  *-%pass
                            eth1------------------------>
                          %<eth1-------------------------

I.e. the packet has POSTROUTING nat rules applied as it "leaves" via
"ipsec0". Once we discover that the OE is not possible, the packet
goes out in the clear via eth1.

The returning packet, arrives on eth1. Someone it does not get transformed
back.  The initial hypothesis was that the connection tracking was
per-interface. I've been assured that it is is not.

I'm left without an answer at this time. I spent a day in GDB with
a UML, and didn't figure it out. Too many twisty mazes.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email protected] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
Comment: Finger me for keys

iQCVAwUBPmPCgIqHRg3pndX9AQEmEQP+IEBcevZ5eMPediDb2guP74rE+Nf3j0dP
KltKGLR4t9GceUDNNW5VbDRID0yObF4lZR/VqGYm33EDY+k0qXNgcCt4JWb3keym
NUQFv1ZYBVbj3m59R64ZHvYdorqkXe+iwr29F8evPxGOMFgJgtQtn6bm+SjQ/2+5
N3V6omJpqjE=
=0pt6
-----END PGP SIGNATURE-----