Re: 2.6.2 issues (IPSec+NAT, RFC2684 bridge)
From: Michal Ludvig
Date: Tue Feb 24 2004 - 05:25:55 EST
Samofatov, Nickolay told me that:
Here is a list of minor issues I encountered when migrated my AMD64
machine to 2.6.2 kernel (64-bit).
1) Attempts to combine IPSec and NAT result in various kinds of
failures. The easiest to reproduce is reliable hard system lock-up when
IKE session needs to be initiated because of request from masqueraded
machine.
(workaround is to run cron job keeping IPSec connection active)
You probably hit the same bug as I did. When a SPD policy expires the
notification to userspace fails. Please try the patch from here and let
me know if it helps:
http://marc.theaimsgroup.com/?l=linux-netdev&m=107761652405761&w=2
2) I had to add following line to my routing rules to get IPSec working
locally:
--
route add -m 172.20.0.0 netmask 255.255.0.0 gw 172.21.113.1
--
172.20.0.0 here is VPN subnet I'm interested in. 172.21.113.1 is the
address assigned to eth0 interface which is also IP address of this
machine in VPN.
Before I added this rule TCP connections from localhost failed with no
route to host. The result works for most applications, but not all. For
example, SSH fails.
(my workaround is to use SOCKS5 proxy running locally for local SSH
connections over IPSec tunnels)
Try to specify source address as well:
ip route add 172.20.0.0/16 via 172.21.113.1 src 172.21.x.x
If there is interest, I may provide as much information as required to
resolve the problems.
If the IPsec issues still remain, send me more information so that I
could reproduce it here.
Michal Ludvig
--
SUSE Labs mludvig@xxxxxxx | Cray is the only computer
(+420) 296.545.373 http://www.suse.cz | that runs an endless loop
Personal homepage http://www.logix.cz/michal | in just four hours.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/