Date: Thu, 8 Dec 2016 16:49:32 -0600 From: Karl Denninger <karl@denninger.net> To: freebsd-ipfw@freebsd.org Subject: IPFW problem with passing IPSEC through in-kernel NAT Message-ID: <099203a1-f601-bb79-548d-27c62fcbf556@denninger.net>
next in thread | raw e-mail | index | archive | help
This is a cryptographically signed message in MIME format. --------------ms020402030305090906000203 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi folks; I have a fairly complex configuration here with IPSEC on a gateway machine, which is working fine. However, I also wish to pass through *client* IPSEC setup requests (which happen to be coming from cellphones that want to use WiFi calling) as well, and have run into a problem. T-Mobile's WiFi calling appears to set up an IPSEC tunnel back to the company when turned on. The issue I'm running into is that while this is *supposed* to work with a device behind a NAT router (and does in other locations around the area) my FreeBSD gateway (which also happens to run the IPSEC gateway) always appears to pass the *internal* address (!) for the phone outbound, and refuses to put the setup packets through NAT. If I shut down IPSEC on the gateway machine and remove all of its ipfw rules it still doesn't work; I get authentication errors returned (when looking at the data stream with tcpdump to and from the phone device) which implies that the packets sent to the host are being tampered with -- along with some untranslated transmissions as well. Does anyone have a sample configuration that works with T-Mobile's WiFi calling and FreeBSD's internal kernel NAT solution? That might be enough for me to figure out what's going on... FreeBSD 11.0-STABLE #13 r307318M: if the rev matters.... Thanks in advance! --=20 Karl Denninger karl@denninger.net <mailto:karl@denninger.net> /The Market Ticker/ /[S/MIME encrypted email preferred]/ --------------ms020402030305090906000203 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgMFADCABgkqhkiG9w0BBwEAAKCC Bl8wggZbMIIEQ6ADAgECAgEpMA0GCSqGSIb3DQEBCwUAMIGQMQswCQYDVQQGEwJVUzEQMA4G A1UECBMHRmxvcmlkYTESMBAGA1UEBxMJTmljZXZpbGxlMRkwFwYDVQQKExBDdWRhIFN5c3Rl bXMgTExDMRwwGgYDVQQDExNDdWRhIFN5c3RlbXMgTExDIENBMSIwIAYJKoZIhvcNAQkBFhND dWRhIFN5c3RlbXMgTExDIENBMB4XDTE1MDQyMTAyMjE1OVoXDTIwMDQxOTAyMjE1OVowWjEL MAkGA1UEBhMCVVMxEDAOBgNVBAgTB0Zsb3JpZGExGTAXBgNVBAoTEEN1ZGEgU3lzdGVtcyBM TEMxHjAcBgNVBAMTFUthcmwgRGVubmluZ2VyIChPQ1NQKTCCAiIwDQYJKoZIhvcNAQEBBQAD ggIPADCCAgoCggIBALmEWPhAdphrWd4K5VTvE5pxL3blRQPyGF3ApjUjgtavqU1Y8pbI3Byg XDj2/Uz9Si8XVj/kNbKEjkRh5SsNvx3Fc0oQ1uVjyCq7zC/kctF7yLzQbvWnU4grAPZ3IuAp 3/fFxIVaXpxEdKmyZAVDhk9az+IgHH43rdJRIMzxJ5vqQMb+n2EjadVqiGPbtG9aZEImlq7f IYDTnKyToi23PAnkPwwT+q1IkI2DTvf2jzWrhLR5DTX0fUYC0nxlHWbjgpiapyJWtR7K2YQO aevQb/3vN9gSojT2h+cBem7QIj6U69rEYcEDvPyCMXEV9VcXdcmW42LSRsPvZcBHFkWAJqMZ Myiz4kumaP+s+cIDaXitR/szoqDKGSHM4CPAZV9Yh8asvxQL5uDxz5wvLPgS5yS8K/o7zDR5 vNkMCyfYQuR6PAJxVOk5Arqvj9lfP3JSVapwbr01CoWDBkpuJlKfpQIEeC/pcCBKknllbMYq yHBO2TipLyO5Ocd1nhN/nOsO+C+j31lQHfOMRZaPQykXVPWG5BbhWT7ttX4vy5hOW6yJgeT/ o3apynlp1cEavkQRS8uJHoQszF6KIrQMID/JfySWvVQ4ksnfzwB2lRomrdrwnQ4eG/HBS+0l eozwOJNDIBlAP+hLe8A5oWZgooIIK/SulUAsfI6Sgd8dTZTTYmlhAgMBAAGjgfQwgfEwNwYI KwYBBQUHAQEEKzApMCcGCCsGAQUFBzABhhtodHRwOi8vY3VkYXN5c3RlbXMubmV0Ojg4ODgw CQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBaAwCwYDVR0PBAQDAgXgMCwGCWCGSAGG+EIB DQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUxRyULenJaFwX RtT79aNmIB/u5VkwHwYDVR0jBBgwFoAUJHGbnYV9/N3dvbDKkpQDofrTbTUwHQYDVR0RBBYw FIESa2FybEBkZW5uaW5nZXIubmV0MA0GCSqGSIb3DQEBCwUAA4ICAQBPf3cYtmKowmGIYsm6 eBinJu7QVWvxi1vqnBz3KE+HapqoIZS8/PolB/hwiY0UAE1RsjBJ7yEjihVRwummSBvkoOyf G30uPn4yg4vbJkR9lTz8d21fPshWETa6DBh2jx2Qf13LZpr3Pj2fTtlu6xMYKzg7cSDgd2bO sJGH/rcvva9Spkx5Vfq0RyOrYph9boshRN3D4tbWgBAcX9POdXCVfJONDxhfBuPHsJ6vEmPb An+XL5Yl26XYFPiODQ+Qbk44Ot1kt9s7oS3dVUrh92Qv0G3J3DF+Vt6C15nED+f+bk4gScu+ JHT7RjEmfa18GT8DcT//D1zEke1Ymhb41JH+GyZchDRWtjxsS5OBFMzrju7d264zJUFtX7iJ 3xvpKN7VcZKNtB6dLShj3v/XDsQVQWXmR/1YKWZ93C3LpRs2Y5nYdn6gEOpL/WfQFThtfnat HNc7fNs5vjotaYpBl5H8+VCautKbGOs219uQbhGZLYTv6okuKcY8W+4EJEtK0xB08vqr9Jd0 FS9MGjQE++GWo+5eQxFt6nUENHbVYnsr6bYPQsZH0CRNycgTG9MwY/UIXOf4W034UpR82TBG 1LiMsYfb8ahQJhs3wdf1nzipIjRwoZKT1vGXh/cj3gwSr64GfenURBxaFZA5O1acOZUjPrRT n3ci4McYW/0WVVA3lDGCBRMwggUPAgEBMIGWMIGQMQswCQYDVQQGEwJVUzEQMA4GA1UECBMH RmxvcmlkYTESMBAGA1UEBxMJTmljZXZpbGxlMRkwFwYDVQQKExBDdWRhIFN5c3RlbXMgTExD MRwwGgYDVQQDExNDdWRhIFN5c3RlbXMgTExDIENBMSIwIAYJKoZIhvcNAQkBFhNDdWRhIFN5 c3RlbXMgTExDIENBAgEpMA0GCWCGSAFlAwQCAwUAoIICTTAYBgkqhkiG9w0BCQMxCwYJKoZI hvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNjEyMDgyMjQ5MzJaME8GCSqGSIb3DQEJBDFCBEAK sUVXXqO2vJpy4iYrFOPbgcsCLDmRBx/d0SaIEJ7hQd6on5SKPBDeb0MAOuSP44M5JEBWXY2D kstLGIlkikh5MGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBAjAK BggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYI KoZIhvcNAwICASgwgacGCSsGAQQBgjcQBDGBmTCBljCBkDELMAkGA1UEBhMCVVMxEDAOBgNV BAgTB0Zsb3JpZGExEjAQBgNVBAcTCU5pY2V2aWxsZTEZMBcGA1UEChMQQ3VkYSBTeXN0ZW1z IExMQzEcMBoGA1UEAxMTQ3VkYSBTeXN0ZW1zIExMQyBDQTEiMCAGCSqGSIb3DQEJARYTQ3Vk YSBTeXN0ZW1zIExMQyBDQQIBKTCBqQYLKoZIhvcNAQkQAgsxgZmggZYwgZAxCzAJBgNVBAYT AlVTMRAwDgYDVQQIEwdGbG9yaWRhMRIwEAYDVQQHEwlOaWNldmlsbGUxGTAXBgNVBAoTEEN1 ZGEgU3lzdGVtcyBMTEMxHDAaBgNVBAMTE0N1ZGEgU3lzdGVtcyBMTEMgQ0ExIjAgBgkqhkiG 9w0BCQEWE0N1ZGEgU3lzdGVtcyBMTEMgQ0ECASkwDQYJKoZIhvcNAQEBBQAEggIAoeiSWDUx 4u3kAZhfbMrcLuRQzFmBryxSOXSZ/LbclvE4uoULLu+j1edCRkqVeW70SvRHHXI2TZX6hTgw ptjKCZ9ZuMzwDkPwX1zkg1T4e+KeBSudOdn2FAARnbWEiKy8moPNEbyIBvsKXtiTnKfp+7wE cWhYpPyPaE+WB6q7wc7cebduX/QnPeDVlrpNEGzfQC5VZISDx6OencfPFdm4orGQ7HlPOfuX l2OkP5jTUoaA5m7YNNtT4JYehPyZ9ddq4sxQTPMIRi2/gmvgdePyEgwaWs9CY7GcRPt2/svP 6/A0mdVkdzR4jl7idchhmNXHol+Q6LwZxzp5WpT6A3vAdY6Arc7nhprtB0uKWvnHcymkltjN cZh1C9mKTbSbOn+O3BW6DR4jDj/rRBj/nPqKrn9qwjwGeyChdoHMV8jmOMyXeq4PwbWdPTx2 UGRtw5enEDL5Pn/4GON1U+UIPnO1mrxdXj7LhqEH04uHwGMiB63rQ+GYBoHkbwVF2lL6zEFI YVf6IXO9zgxjNQZqJYQo8vJ6uc1bHZHxbeBcyXMimc0nmOTIajb+3jiLejNcbErlLwBkjrw/ OTyQY4vh4x5RQ8CBQgDVX04KOB6tsD60AwIcHnhLd/TXBN52owQWRjcZJE527wovtC0ah503 x3GL+IspHCsokKNbgfTD2knGcVsAAAAAAAA= --------------ms020402030305090906000203--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?099203a1-f601-bb79-548d-27c62fcbf556>