After doing some research, I found out that it is the rfc1323 option which
causes this problem.

If we disable the net.inet.tcp.rfc1323 the problems dissapear. Anyone has
an idea why IPSec causes the rfc1323 extended connections to stall ?

Best Regards

Kirill



> Hi,
>
> We have a quite wierd problem which I would like to find an answer for,
> here is a schema of the network:
>
>
> <---- Internet ----> !1 Firewall A  !2 <----- Intranet segment 1 ----->
>     |                         !3                          |
>     |                          |                          |
>   Host A                       |                        Host B
>                              |
>                     Leased Line/IPSec Tunnel
>                              |
>                              |
>                              |
>                             !1
>                           Firewall B !2 <----- Intranet Segment 2 ----->
>                                                  |
>                                                  |
>                                                Host C
>
> Firewalls A/B and Host B are running FreeBSD 4.6
> Host C is a dual boot machine with FreeBSD 4.6 and W2K
>
> Firewall A performs IPNat for all "inside" packets leaving trough the
> "outside" !1 interface. The ipnat statement is:
>
> map dc0 from 192.168.0.0/16 to any -> 0/32
>
> What works:
>
> Host B (Any OS) -> Host A
> Host C (NT) -> Host A
>
> What does not work:
>
> Host C (FreeBSD) -> Host A
>
> After a period of testing I have found out that by some unknown reason
> IPNat on Firewall A will flatly refuse to NAT packets which come from
> IPSec Tunnel and go to Internet and if the communicating host is
> FreeBSD. Not only that, but IPFilter will will also fail to keep state
> of those connections which went trough it. This is even more confusing
> because we use DHCP on Segment 2 and it delivers the same IP to the Host
> C regardless of its OS, when it is NT, everything works like a charm but
> when it is FreeBSD connections fail. This is a really funky problem I
> have no explanation for, did anyone ever seen something like that before
> ?
>
> To add more to confusion: We also have an IRIX host on the Segment 2 and
> its packets get natted without any problems.
>
> Best Regards
>
> Kirill
>
>
>
> To Unsubscribe: send mail to [EMAIL PROTECTED]
> with "unsubscribe freebsd-questions" in the body of the message




To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-questions" in the body of the message

Reply via email to