(racoon 729) Ipsec header encrypted?

Hi again!

I've resolved the first problem... It's a problem of mss and I fixed it with
this command :
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1400

But I don't understand why certains ip headers are not encrypted.
Here you can see packets captured by tcpdump between Zeus and Memphis :


14:52:05.997207 IP 192.168.1.2 > zeus: ESP(spi=0x026b1dc2,seq=0x224)
14:52:06.048469 IP zeus > 192.168.1.2: ESP(spi=0x0c58e1d2,seq=0x201)
14:52:06.048469 IP dns-abo-static-a.wanadoo.fr.domain > 192.168.1.2.32818:
40589 NXDomain 0/1/0 (119)
14:52:06.050011 IP 192.168.1.2 > zeus: ESP(spi=0x026b1dc2,seq=0x225)
14:52:06.117427 IP zeus > 192.168.1.2: ESP(spi=0x0c58e1d2,seq=0x202)
14:52:06.117427 IP dns-abo-static-a.wanadoo.fr.domain > 192.168.1.2.32818:
40590 1/2/2 PTR[|domain]
14:52:06.119071 IP zeus > 192.168.1.2: ESP(spi=0x0c58e1d2,seq=0x203)
14:52:06.119071 IP 64.12.26.57.5190 > 192.168.1.2.34641: . ack 187402029 win
16384
14:52:06.129232 IP 192.168.1.2 > zeus: ESP(spi=0x026b1dc2,seq=0x226)

I can see several ip adress as if those packets were not encrypted! Where is the
problem?

--------------------------------------------------------------
Old Message
--------------------------------------------------------------

Hi all :-)

I have a problem with my current configuration of ipsec. I'm using ipsec with
kernel 2.6 and racoon. I have two computers linked by wireless cards. The first
(192.168.1.1 Zeus) is connected to internet through a DSL modem and the second
(192.168.1.2 Memphis) is accessing internet through the first. I want with
ipsec to encrypt all datas between the two computers.
I can exchange data between the two computers and Memphis can access the
internet but when I tried to download a big file, it didn't work although it
worked fine on Zeus. I've tried to change the MTU to 1300 but it changed
nothing.
I have another problem, when I exchanged data between Memphis and internet, the
ip header is not protected by ESP , I can see the source adress with
tcpdump!

Can somebody help me? Thanks in advance!
Here is my configuration file for Zeus (it's nearly the same for Memphis)

Setkey :

#!/user/sbin/setkey -f
flush;
spdflush;

spdadd 192.168.1.2/32 0.0.0.0/0 any -P out ipsec
esp/tunnel/192.168.1.2-192.168.1.1/require;
spdadd 0.0.0.0/0 192.168.1.2/32 any -P in ipsec
esp/tunnel/192.168.1.1-192.168.1.2/require;

Racoon.conf

remote 192.168.1.1
{
exchange_mode main;
my_identifier asn1dn;
peers_identifier asn1dn;

certificate_type x509 "Memphis.public" "Memphis.private";
peers_certfile "Zeus.public";
proposal{
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method rsasig;
dh_group modp1024;

}

}

sainfo anonymous
{
pfs_group modp1024;
lifetime time 2 min;
encryption_algorithm 3des;
authentication_algorithm hmac_md5;
compression_algorithm deflate;
}