Re: pf isakmpd: NAT through encryption interface?

2006-07-02 Thread Matthew Closson
On Wed, 28 Jun 2006, Stephen Bosch wrote: Hi, Roy: Roy Morris wrote: Yes it does work! I guess I better hold on to these two boxes I have. Seems they are the only ones that do! lol I have A. clients on each end behind a vpn/pf box B. enc0 binat from internal client to public IP of other

Re: pf isakmpd: NAT through encryption interface?

2006-06-29 Thread Roy Morris
Hi, Roy: Roy Morris wrote: Yes it does work! I guess I better hold on to these two boxes I have. Seems they are the only ones that do! lol I have A. clients on each end behind a vpn/pf box B. enc0 binat from internal client to public IP of other side client C.

pf isakmpd: NAT through encryption interface?

2006-06-28 Thread Stephen Bosch
Imagine the following scenario: You have two VPN endpoints. One is an OpenBSD system running isakmpd and pf, the other is a VPN concentrator from some vendor. The OpenBSD already has other VPNs set up, all using the same internal network. Renumbering isn't going to work. The VPN

Re: pf isakmpd: NAT through encryption interface?

2006-06-28 Thread Dag Richards
Stephen Bosch wrote: Imagine the following scenario: You have two VPN endpoints. One is an OpenBSD system running isakmpd and pf, the other is a VPN concentrator from some vendor. The OpenBSD already has other VPNs set up, all using the same internal network. Renumbering isn't going to

Re: pf isakmpd: NAT through encryption interface?

2006-06-28 Thread Stephen Bosch
Dag Richards wrote: Stephen Bosch wrote: Imagine the following scenario: You have two VPN endpoints. One is an OpenBSD system running isakmpd and pf, the other is a VPN concentrator from some vendor. The OpenBSD already has other VPNs set up, all using the same internal network.

Re: pf isakmpd: NAT through encryption interface?

2006-06-28 Thread Dag Richards
Stephen Bosch wrote: Dag Richards wrote: Stephen Bosch wrote: Imagine the following scenario: You have two VPN endpoints. One is an OpenBSD system running isakmpd and pf, the other is a VPN concentrator from some vendor. The OpenBSD already has other VPNs set up, all using the same

Re: pf isakmpd: NAT through encryption interface?

2006-06-28 Thread Roy Morris
Stephen Bosch wrote: Dag Richards wrote: Stephen Bosch wrote: Imagine the following scenario: You have two VPN endpoints. One is an OpenBSD system running isakmpd and pf, the other is a VPN concentrator from some vendor. The OpenBSD already has other VPNs set up, all using the

Re: pf isakmpd: NAT through encryption interface?

2006-06-28 Thread Roy Morris
Roy Morris wrote: Stephen Bosch wrote: Dag Richards wrote: Stephen Bosch wrote: Imagine the following scenario: You have two VPN endpoints. One is an OpenBSD system running isakmpd and pf, the other is a VPN concentrator from some vendor. The OpenBSD already has other VPNs set up, all

Re: pf isakmpd: NAT through encryption interface?

2006-06-28 Thread Dag Richards
Roy Morris wrote: Stephen Bosch wrote: Dag Richards wrote: Stephen Bosch wrote: Imagine the following scenario: You have two VPN endpoints. One is an OpenBSD system running isakmpd and pf, the other is a VPN concentrator from some vendor. The OpenBSD already has other VPNs set up, all

Re: pf isakmpd: NAT through encryption interface?

2006-06-28 Thread Markus Wernig
Dag Richards wrote: Um no, it wont work. Once the traffic is encrypted you will no longer be able to nat it. The original packet is now and encrypted blob that is the payload of a new packet with a source of your gateway and dest their GW. you can nat the wrapper packet but not the payload.

Re: pf isakmpd: NAT through encryption interface?

2006-06-28 Thread Stephen Bosch
Hi, Roy: Roy Morris wrote: Yes it does work! I guess I better hold on to these two boxes I have. Seems they are the only ones that do! lol I have A. clients on each end behind a vpn/pf box B. enc0 binat from internal client to public IP of other side client C. /etc/hostname.if alias for the

Re: pf isakmpd: NAT through encryption interface?

2006-06-28 Thread Stephen Bosch
Roy Morris wrote: Stephen Bosch wrote: Dag Richards wrote: Um no, it wont work. Once the traffic is encrypted you will no longer be able to nat it. The original packet is now and encrypted blob that is the payload of a new packet with a source of your gateway and dest their GW. you can