Re: pf & isakmpd: NAT through encryption interface?

[Dag Richards]

Stephen Bosch wrote:
Dag Richards wrote:
Stephen Bosch wrote:
Imagine the following scenario:
You have two VPN endpoints. One is an OpenBSD system running isakmpd 
and pf, the other is a VPN concentrator from some vendor.

The OpenBSD already has other VPNs set up, all using the same 
internal network. Renumbering isn't going to work.

The VPN concentrator operator has an internal addressing scheme he 
insists other endpoints conform to.

The question, then:

Is it even possible to NAT through an encryption interface? For example:

OpenBSD internal network: 192.168.45.0/24
Network other guy would prefer OpenBSD use: 10.110.40.0/24

Network other guy is using: 10.110.10.0/24

The command might look like this:

nat on $enc_if from 192.168.45.0:network to 10.110.10.0:network -> 
10.110.40.10

Forgive me if this i) is impossible, ii) is crazy, iii) the syntax of 
the command is wrong.

I'd rather run it past the list than tinker on production equipment.

Thanks for any help and advice,

-Stephen-

blind leading the blind here but ....
This was recently discussed, and it was pointed out that
the decision to encrypt happens before the nat-ing.

Correct me if I am wrong, then -- this should work. I should be able to 
set up a NAT rule that will affect encrypted traffic in the way I want.

Someone mentioned to me that this does work in 3.9. Will it work in 3.8? 
That's what our gear is running.

-Stephen-

Um no, it wont work. Once the traffic is encrypted you will no longer be 
able to nat it.  The original packet is now and encrypted blob that is 
the payload of a new packet with a source of your gateway and dest their 
GW. you can nat the wrapper packet but not the payload.

I have 2x ibm x series somethings for fw's, and 2x hp dl360s for vpn 
servers all running 3.9.