Re: Virtual systems using NFMARK in place of eroutes

Oddly enough, while not the end goal of my changes, we will be doing the
exact setup you mentioned.  We have a few networks that are indeed
behind off the shelf nat/router boxes with dsl connections.  We will be
treating the networks differently when they get to the freeswan machine
but I imagine that natting could be done based on that as well -- at
least I cannot see why not.  Sounds like a handy side affect of having
remote gateway in the nfmark.

My main drawbacks on the solution I presented is that it only works for
ipv4 due to the 32bit nfmark and you can't do different virtual systems
to the same remote gateway since that is your routing key.  In the end
it would be really nice to see a per conn option for nfmark -- My using
of the remote gateway ip was simply the easiest 'thing to uniquely
identify the tunnels' that I could come up.

Wayne


-----Original Message-----
From: Jim Carter [mailto:[email protected]]=20
Sent: Tuesday, January 06, 2004 11:34 AM
To: Wayne Schroeder
Cc: [email protected]; [email protected]
Subject: Re: [Users] Virtual systems using NFMARK in place of eroutes

On Tue, 6 Jan 2004, Wayne Schroeder wrote:
> an spi identifier in the nfmark field.  I went ahead and changed this
to
> mark the packet with the 32bit ipv4 address of the remote gateway from
> where the packet came in.  Now I can do specific routing on this
packet
> based on the nfmark (which is static, not dynamic like spi).

On cursory reading, I suspect this technique might help in the
longstanding
problem with IPSec-NAT: two different NAT routers (with different public
IP
addresses) assign the same private address to their respective clients.
This is very likely to happen, because any one brand of off-the-shelf
router will have the same default DHCP address range for all instances,
and
most users take the default for this.

There's the detail that the SA is between the client and the
concentrator,
not between the gateway (NAT box) and the concentrator, so the situation
is
not quite what's envisioned in the proposal.  Thus, it's possible for
two
clients to run through the same NAT box, and different SPIs have to be
used
for each.

But I wanted to keep the developers' brains circulating on my problem
topic.

James F. Carter          Voice 310 825 2897    FAX 310 206 6673
UCLA-Mathnet;  6115 MSA; 405 Hilgard Ave.; Los Angeles, CA, USA
90095-1555
Email: [email protected]  http://www.math.ucla.edu/~jimc (q.v. for PGP
key)