From owner-freebsd-net@FreeBSD.ORG Mon Jan 16 12:45:40 2006 Return-Path: X-Original-To: freebsd-net@freebsd.org Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5241616A41F for ; Mon, 16 Jan 2006 12:45:40 +0000 (GMT) (envelope-from b.candler@pobox.com) Received: from thorn.pobox.com (thorn.pobox.com [208.210.124.75]) by mx1.FreeBSD.org (Postfix) with ESMTP id ADBB843D48 for ; Mon, 16 Jan 2006 12:45:39 +0000 (GMT) (envelope-from b.candler@pobox.com) Received: from thorn (localhost [127.0.0.1]) by thorn.pobox.com (Postfix) with ESMTP id DEBE0D6; Mon, 16 Jan 2006 07:46:00 -0500 (EST) Received: from mappit.local.linnet.org (212-74-113-67.static.dsl.as9105.com [212.74.113.67]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by thorn.sasl.smtp.pobox.com (Postfix) with ESMTP id 955ED4D09; Mon, 16 Jan 2006 07:45:59 -0500 (EST) Received: from lists by mappit.local.linnet.org with local (Exim 4.60 (FreeBSD)) (envelope-from ) id 1EyTjr-0007Io-PR; Mon, 16 Jan 2006 12:45:36 +0000 Date: Mon, 16 Jan 2006 12:45:35 +0000 From: Brian Candler To: Przemyslaw Szczygielski Message-ID: <20060116124535.GA28026@uk.tiscali.com> References: <20060116101332.8258821401E@rekin14.go2.pl> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20060116101332.8258821401E@rekin14.go2.pl> User-Agent: Mutt/1.4.2.1i Cc: freebsd-net@freebsd.org Subject: Re: NAT over IPSECed WLAN X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Jan 2006 12:45:40 -0000 On Mon, Jan 16, 2006 at 11:13:32AM +0100, Przemyslaw Szczygielski wrote: > Well, for me the config is so complex, that I doubt anyone will > waste time on going into my config files, but, well... There's > always hope... A diagram helps lots. Tell me if this is correct: \|/ - - - - - - - \|/ | | 10.2.0.2 10.2.0.1 ndis0 WinXP FreeBSD 6.0 client x.x.x.x fxp0 | +---------------> Internet <==================> IPSEC tunnel mode? > I have a working setup that has working NAT ("Client" sees Internet > throuogh NAT on "Gateway", configured as default gateway on > Windows), when IPSEC is turned off. > > I also have working IPSEC between these two machines (they can ping > each other) but then NAT stops working (but "Gateway" still connects > to the Internet, so i.e. I can putty from "Client" to "Gateway", it > goes through IPESECed WLAN, and from putty use Lynx to browse. But > can't browse internet on "Client". > > So to make it short: IPSEC working = no NAT. IPSEC off = NAT working. It's possible that IPSEC isn't configured properly, since you have IPSEC only ever working between the two endpoints. How have you configured IPSEC: (a) on the Windows XP box? and (b) on the FreeBSD box? I think you should be running IPSEC tunnel mode, so I'm guessing at the Windows XP side you have something like: ipseccmd -f 0=* -t 10.2.0.1 -a PRESHARE:"foo" ipseccmd -f *=0 -t 10.2.0.2 -a PRESHARE:"foo" And at the FreeBSD side you have in /etc/ipsec.conf spdflush; spdadd 10.2.0.2/32 0.0.0.0/0 any -P in ipsec esp/tunnel/10.2.0.2-10.2.0.1/require; spdadd 0.0.0.0/0 10.2.0.2/32 any -P out ipsec esp/tunnel/10.2.0.1-10.2.0.2/require; Also, the output of 'tcpdump' on both ndis0 and fxp0, while you try to browse a website from the XP box, could be very enlightening. Regards, Brian.