From owner-freebsd-net@FreeBSD.ORG Thu May 12 16:21:54 2011 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 8394F106566B for ; Thu, 12 May 2011 16:21:54 +0000 (UTC) (envelope-from lacombar@gmail.com) Received: from mail-gy0-f182.google.com (mail-gy0-f182.google.com [209.85.160.182]) by mx1.freebsd.org (Postfix) with ESMTP id 3F9798FC0A for ; Thu, 12 May 2011 16:21:54 +0000 (UTC) Received: by gyg13 with SMTP id 13so732610gyg.13 for ; Thu, 12 May 2011 09:21:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=QjvhUvpe/w61P1BN1CwJ7eEx3TZCn0+ABk8IGVjysQQ=; b=wbrxz6aE9Yfu4m1ZvdZ42lZQZ3I/yWKQJ+BbPglifLaaXicbnafbPKDG5VUGQy/Nf7 d7ILfo+UwSVngj8RDU2/5DgFUUmg18kn+DOyvXlbGi1E2Agl51pL8x+e3iqf1kCWLeDY AyU4oa4lZ6zKy3aaWbHW2GDQy6Yh4bgOmY1ow= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=WOP0nvoL/IpQfnatd59TyzkrlhTDVr42UF4e77ila+NVj1l4TvL38Xhx8J1V53KCnK EajjlCEfev2iBNIgclHeqd8WUFGlU/oyb5kEZNjgDScj+BCKz4e0E8mc9S/T4z38M/an pkF/uvPEpZU9t5oKiFkARdlemoHrZZ/ijfxUE= MIME-Version: 1.0 Received: by 10.42.152.199 with SMTP id j7mr453892icw.404.1305217313445; Thu, 12 May 2011 09:21:53 -0700 (PDT) Received: by 10.42.178.70 with HTTP; Thu, 12 May 2011 09:21:53 -0700 (PDT) In-Reply-To: <54805.960.2090-2700-1520430731-1305210003@email.cz> References: <54805.960.2090-2700-1520430731-1305210003@email.cz> Date: Thu, 12 May 2011 12:21:53 -0400 Message-ID: From: Arnaud Lacombe To: sample@email.cz Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Cc: freebsd-net@freebsd.org Subject: Re: FreeBSD 7 and FreeBSD 8 OpenVPN problem X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 May 2011 16:21:54 -0000 Hi, On Thu, May 12, 2011 at 10:20 AM, wrote: > Hi, > > I have a problem with the different behavior of OpenVPN under FreeBSD 7 a= nd FreeBSD 8. Problem is as follows. I have created an OpenVPN server and I= PSEC tunnel. I have a client which is connecting via OpenVPN to LAN. > > This is working properly (client is able to reach all computers inside LA= N and their services) in both cases - FreeBSD 7 and 8. The problem occurs w= hen I want to connect (e.g. PING) the LAN interface of FreeBSD - for exampl= e "em0" with IP 192.168.1.1. > > On FreeBSD 7 (server) when I run tcpdump, I see packets coming from the O= penVPN network on the FreeBSD LAN interface ("em0" with IP 192.168.1.1) - e= verything works as should. > > On FreeBSD 8 (server) - the ping from the client to LAN interface "em0" i= s working (I get reply from ip 192.168.1.1 (em0) on client PC), but when I = run tcpdump on the LAN interface (192.168.1.1 - em0), I don't see any ICMP = packets. (I wonder, what is answering me then?). > I wonder if this does not have to do with how OpenVPN re-inject packet in the kernel, what path it follows, and where the bpf hook are. I am not sure of what would be expected when sniffing on an interface. Would you intend to see only the traffic going in and out the physical interface ? or would you intend to see all the the traffic matching a parameter associated with an interface (IP address, ...) ? You should also have an internal route trough `lo0' for local traffic. I found out that even without that route, local traffic go trough `lo0', with all the consequences, like IPv4 checksum not being computed [which does not even seem to be tunable btw.]. - Arnaud