Hi,
My IPsec roadwarrior setup on my laptop broke with one of the latest
snapshots because some outgoing connections are routed wrongly with a
source ip of 127.0.0.1.
On the roadwarrior laptop I use a dummy lo1 interface to which I assign
the internal VPN IP of the laptop.
wlan has the 172.26.153.40/28 subnet, VPN has the 172.26.153.49/28
subnet:
iwn0: flags=28843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,NOINET6> mtu 1500
lladdr 00:21:6b:a3:70:7a
priority: 4
groups: wlan
status: active
inet 172.26.153.40 netmask 0xfffffff0 broadcast 172.26.153.47
enc0: flags=0<>
priority: 0
groups: enc
status: active
lo1: flags=8149<UP,LOOPBACK,RUNNING,PROMISC,MULTICAST> mtu 33144
priority: 0
groups: lo egress
inet 172.26.153.49 netmask 0xfffffff0
inet6 fe80::1%lo1 prefixlen 64 scopeid 0x5
inet6 2001:4dd0:fbdf:8::49 prefixlen 48
Routing tables
default route goes to the VPN. Because the IPsec flow matches on
source ip, all VPN packets are routed via lo1 to assign the right
source ip:
Internet:
Destination Gateway Flags Refs Use Mtu Prio Iface
default 172.26.153.49 US 1 62 33144 9 lo1
127/8 127.0.0.1 UGRS 0 0 33144 8 lo0
127.0.0.1 127.0.0.1 UH 2 36 33144 4 lo0
172.26.153.32/28 link#2 UC 1 0 - 4 iwn0
172.26.153.33 00:1b:b1:f2:f4:6d UHLc 1 0 - 4 iwn0
172.26.153.40 127.0.0.1 UGS 0 0 33144 8 lo0
172.26.153.49 172.26.153.49 UH 0 120 33144 4 lo1
217.190.94.19 172.26.153.33 UGHS 2 215 - 12 iwn0
224/4 127.0.0.1 URS 0 0 33144 8 lo0
And route get seems to do the right thing:
$ route get 172.26.153.1
route to: alix
destination: default
mask: default
interface: lo1
if address: mortimer-ipsec (= 172.26.153.49)
priority: 9 ()
flags: <UP,DONE,STATIC>
use mtu expire
68 33144 0
In the following tests I run two tcpdumps in the background:
tcpdump: listening on pflog0, link-type PFLOG
tcpdump: listening on enc0, link-type ENC
ICMP echo requests get assigned the correct source ip and are
redirected to IPsec:
$ ping -c1 172.26.153.1
PING 172.26.153.1 (172.26.153.1): 56 data bytes
64 bytes from 172.26.153.1: icmp_seq=0 ttl=255 time=2.635 ms
--- 172.26.153.1 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 2.635/2.635/2.635/0.000 ms
(authentic,confidential): SPI 0x754c6616: 172.26.153.49 > 172.26.153.1: icmp:
echo request (encap)
(authentic,confidential): SPI 0x9464175d: 172.26.153.1 > 172.26.153.49: icmp:
echo reply (encap)
But udp/tcp packets get assigned the localhost(!) address and are
blocked by pf, because I disallow any traffic on lo1:
$ nc -u 172.26.153.1 53 </dev/zero
rule 3/(match) block out on lo1: 127.0.0.1.3621 > 172.26.153.1.53: 0 [0q]
(2048)
[demime 1.01d removed an attachment of type application/pgp-signature]
