Hello,
I am lost in a routing problem or a very simple NAT trouble I can't
resolve. OpenBSD 4.0 GENERIC kernel except for the RAID. My network
looks like this:
ISP -- router1 -- VPN -- router2 (em1: 193.189.180.129)
(bge1: 10.1.1.11)
It looks like NAT isn't working. Test:
# ping -I 10.1.1.11 -c2 209.85.129.147
PING 209.85.129.147 (209.85.129.147): 56 data bytes
--- 209.85.129.147 ping statistics ---
2 packets transmitted, 0 packets received, 100.0% packet loss
The packets are arriving on my ext_if but not into the tunnel.
# tcpdump -i em1 icmp
tcpdump: listening on em1, link-type EN10MB
23:54:14.180023 193.189.180.129 > fk-in-f147.google.com: icmp: echo request
23:54:15.190011 193.189.180.129 > fk-in-f147.google.com: icmp: echo request
23:54:16.200010 193.189.180.129 > fk-in-f147.google.com: icmp: echo request
ping -c2 209.85.129.147 from ext_if is just working fine.
# tcpdump -i enc0
tcpdump: WARNING: enc0: no IPv4 address assigned
tcpdump: listening on enc0, link-type ENC
00:02:13.582222 (authentic,confidential): SPI 0xceaad5b0:
193.189.180.129 > fk-in-f147.google.com: icmp: echo request (encap)
00:02:13.582255 (authentic,confidential): SPI 0x1bbc2fc6: esp
172.16.16.6 > 172.16.15.6 spi 0xCEAAD5B0 seq 648 len 132 (encap)
00:02:13.618286 (authentic,confidential): SPI 0x3bf920e4: esp
172.16.15.6 > 172.16.16.6 spi 0x127C2A0B seq 639 len 132 (encap)
00:02:13.618304 (authentic,confidential): SPI 0x127c2a0b:
fk-in-f147.google.com > 193.189.180.129: icmp: echo reply (encap)
00:02:14.590019 (authentic,confidential): SPI 0xceaad5b0:
193.189.180.129 > fk-in-f147.google.com: icmp: echo request (encap)
I am not sure what/(and If) should I set mygate to. I set it to
193.189.180.129, it is the same as ext_if??? Any hint for me?
# sysctl net.inet.ip.forwarding
net.inet.ip.forwarding=1
# pfctl -e
pfctl: pf already enabled
pf.conf:
================================
ext_if="em1"
int_if="bge1"
scrub in
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
nat on $ext_if from $int_if:network to any -> ($ext_if:0)
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
rdr pass on $ext_if proto tcp from <spamd> to port smtp \
-> 127.0.0.1 port spamd
rdr pass on $ext_if proto tcp from !<spamd-white> to port smtp \
-> 127.0.0.1 port spamd
anchor "ftp-proxy/*"
pass in quick all
pass out quick all
================================
Routing tables
Internet:
Destination Gateway Flags Refs Use Mtu
Interface
default 193.189.180.129 UGS 2 2709 - em1
10.1.1/24 link#4 UC 2 0 - bge1
127/8 127.0.0.1 UGRS 0 0 33224 lo0
127.0.0.1 127.0.0.1 UH 1 0 33224 lo0
172.16.15.6 172.16.16.5 UGHS 2 583 - bge0
172.16.16.4/30 link#3 UC 1 0 - bge0
172.16.16.5 00:90:69:c2:7c:00 UHLc 1 0 - bge0
193.189.180.128/27 link#2 UC 30 0 - em1
193.189.180.129 00:04:23:d4:fc:17 UHLc 1 0 - lo0
193.189.180.130 00:50:04:68:1d:86 UHLc 0 2 - em1
224/4 127.0.0.1 URS 0 0 33224 lo0
Encap:
Source Port Destination Port Proto
SA(Address/Proto/Type/Direction)
172.16.15.6/32 0 172.16.16.6/32 0 0
172.16.15.6/esp/use/in
172.16.16.6/32 0 172.16.15.6/32 0 0
172.16.15.6/esp/require/out
default 0 193.189.180.128/27 0 0
172.16.15.6/esp/use/in
193.189.180.128/27 0 default 0 0
172.16.15.6/esp/require/out
Mitja
