Re: Support for IPSec NAT-T in transoprt mode

2012-05-02 Thread Zmiter
24.04.2012 23:10, Andreas Longwitz ?: There is one limitation I would like to get over. From man 8 setkey: System that do not perform the port check cannot support multiple endpoints behind the same NAT. I think this is a FreeBSD kernel restriction: For the first incoming L2TP packet the

Re: Support for IPSec NAT-T in transoprt mode

2012-05-02 Thread Bjoern A. Zeeb
On 2. May 2012, at 18:50 , Zmiter wrote: 24.04.2012 23:10, Andreas Longwitz ?: There is one limitation I would like to get over. From man 8 setkey: System that do not perform the port check cannot support multiple endpoints behind the same NAT. I think this is a FreeBSD kernel

Re: Support for IPSec NAT-T in transoprt mode

2012-04-24 Thread Andreas Longwitz
I run FreeBSD 8.2, ipsec-tools-0.8.0_2 and mpd-5.5. To get NATed VPN clients working through L2TP/IPSec I use the patches given in kern/146190 for the files esp_var.h, ipsec.c, ipsec_input.c (only the Ignore checksum part) and xform_esp.c. Further the following patch: --- key.c.1st 2011-09-29

Re: Support for IPSec NAT-T in transoprt mode

2012-04-16 Thread VANHULLEBUS Yvan
Hi. On Sun, Apr 15, 2012 at 04:40:03PM +0300, Zmiter wrote: 14.04.2012 19:59, Bjoern A. Zeeb ??: On 13. Apr 2012, at 04:28 , Zmiter wrote: Hello. Does FreeBSD 8.[0-4] support IPSec NAT-T in transport mode? Or it's still in broken state? It's not broken; it was never

Re: Support for IPSec NAT-T in transoprt mode

2012-04-16 Thread Zmiter
16.04.2012 12:59, VANHULLEBUS Yvan написал: I didn't review/try the patch, but kernel part seems to be done. Upon my testing it's not so good as it seems. I found some trouble with it. 1. sysctl net.inet.esp.esp_ignore_natt_cksum works not as expected. If there is troubles with function

Re: Support for IPSec NAT-T in transoprt mode

2012-04-15 Thread Zmiter
14.04.2012 19:59, Bjoern A. Zeeb написал: On 13. Apr 2012, at 04:28 , Zmiter wrote: Hello. Does FreeBSD 8.[0-4] support IPSec NAT-T in transport mode? Or it's still in broken state? It's not broken; it was never implemented. No FreeBSD tree shipped does support transport mode at this time.

Re: Support for IPSec NAT-T in transoprt mode

2012-04-15 Thread Zmiter
15.04.2012 16:47, Patrick M. Hausen написал: Racoon for IKE, standard IPSEC as shipped with RELENG_6. Was is removed afterwards? The problem in traversing NAT. IPSec+L2TP works great WITHOUT NAT. NAT-T feature was implemented in 8.0 (There was some patches fo 7.0 as I remember). But it lacks

Re: Support for IPSec NAT-T in transoprt mode

2012-04-15 Thread Patrick M. Hausen
Hi, all, Am 14.04.2012 um 18:59 schrieb Bjoern A. Zeeb: No FreeBSD tree shipped does support transport mode at this time. I remember that I ran a Soekris device with RELENG_6 NanoBSD to drive my VPN connection via transport mode. Racoon for IKE, standard IPSEC as shipped with RELENG_6. Was is

Re: Support for IPSec NAT-T in transoprt mode

2012-04-14 Thread Bjoern A. Zeeb
On 13. Apr 2012, at 04:28 , Zmiter wrote: Hello. Does FreeBSD 8.[0-4] support IPSec NAT-T in transport mode? Or it's still in broken state? It's not broken; it was never implemented. No FreeBSD tree shipped does support transport mode at this time. There are patches but you also need to

Support for IPSec NAT-T in transoprt mode

2012-04-12 Thread Zmiter
Hello. Does FreeBSD 8.[0-4] support IPSec NAT-T in transport mode? Or it's still in broken state? I need to connect NATed VPN clients through L2TP/IPSec and seeing nothing in mpd5 logs, but growing counters of bad checksums in udp packets. After some research I found an opened kern/146190 with