Date: Thu, 22 Jan 2004 12:09:29 +0100 From: Guido van Rooij <guido@gvr.org> To: Andrew Thomson <andrewjt@applecomm.net> Cc: current@freebsd.org Subject: Re: ipsec changes in 5.2R Message-ID: <20040122110929.GA767@gvr.gvr.org> In-Reply-To: <1074650025.701.82.camel@itouch-1011.prv.au.itouchnet.net> References: <1074650025.701.82.camel@itouch-1011.prv.au.itouchnet.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Jan 21, 2004 at 12:53:46PM +1100, Andrew Thomson wrote: > I'm a little guilty as I upgraded my laptop from 5.0 to 5.2. So I'm > guessing things have changed a bit. > > However I used to encrypt my wireless connection using IPSEC. Since the > upgrade, things no longer work. > > My firewall is a 4.9p1 host which is at the other end of the IPSEC VPN > and wireless link. > > I previously used the following ipsec.conf to get things going (these > are from the firewall, obviously the reverse [out/in] is applied to my > laptop). > > 192.168.14.2[any] 0.0.0.0/0[any] any > in ipsec > esp/tunnel/192.168.14.2-192.168.14.1/require > spid=5 seq=1 pid=1409 > refcnt=1 > 0.0.0.0/0[any] 192.168.14.2[any] any > out ipsec > esp/tunnel/192.168.14.1-192.168.14.2/require > spid=6 seq=0 pid=1409 > refcnt=1 > > Now when I have those setkey entries enabled on my laptop, I can't even > ping my own host (192.168.14.2). > > Both tcpdump and ipfw add 100 log ip from any to any shows nothing on my > wireless link.. > > Not sure why this has now stopped working.. Any clues? I have seen the same. Somehow it looks like ISAKMP traffic, which used to go around the ipsec policy, is now included. The only workaround I know of is to replace "require" with "use". -Guido
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040122110929.GA767>