(racoon 711) Re: Download problem

> Hi,
>

Thanks for your help,


> On what interface did you set MTU to 1300? You should do that on
> _external interface of Zeus_. Otherwise you just complicated situation.

I set the MTU on the interface ppp0, it changed nothing. The command "ping -s
1400 www.clubic.com" works so I think it's not a problem of MTU.

>On the other hand, do you limit icmp traffic to Zeus? Because, if you do
>not change MTU, you should allow icmp destination-unreachable
>fragmentaion-needed packets to go out.

I have disabled the netfilter firewall (all policies on ACCEPT) except NAT and
the problem remained the same. I don't really understand the problem!!!

> > I have another problem, when I exchanged data between Memphis and internet,
> the
> > ip header is not protected by AH , I can see the destination adress with
> > tcpdump!
>
> AH just adds a signature for bytes sent. Nothing more. Therefore you
> should expect addresses visible while using it. If you want to hide
> these addresses -- use ESP.
>
> ESP has means to protect against spoofed packets. Therefore IMHO AH
> should be used only in cases where contents MUST be NOT ENCRYPTED.

Even if I only encrypt the packets with ESP, the addresses are always visible.
Is there any solution to hide them?