FreeBSD 6.3 gre and traceroute

Julian Elischer julian at elischer.org
Fri Nov 14 10:37:36 PST 2008


Stephen Clark wrote:
> Stephen Clark wrote:

>>>>>
>>>>> 10.0.129.1 FreeBSD workstation
>>>>>  ^
>>>>>  |
>>>>>  | ethernet
>>>>>  |
>>>>>  v
>>>>> 10.0.128.1 Freebsd FW "A"
>>>>>  ^
>>>>>  |
>>>>>  | gre / ipsec
>>>>>  |
>>>>>  v
>>>>> 192.168.3.1 FreeBSD FW "B"
>>>>>  ^
>>>>>  |
>>>>>  | ethernet
>>>>>  |
>>>>>  v
>>>>> 192.168.3.86 linux workstation
>>>>>

>> Also just using gre's without the 
>> underlying ipsec tunnels seems to
>> work properly.


This is the crux of the matter.
IPSEC happens INSIDE the IP stack. The IP stack is responsible for
the ICMP generation so it is much more likely that there is an 
interaction there.

Now is there an IPSEC rule to make sure that the ICMP packet can get 
back?  It could b ehtat in teh IP stack there is some confusion as to 
whether the return packet should be encrypted or not and it might get 
dropped.

the code involved is in /sys/netinet and /sys/netipsec but you'll
probably regret looking in there ;-)



>>
>>
> Another data point I had been using option FILTER_GIF I tried a kernel
> without that option and it behaved the same.
> 
> Steve
> 



More information about the freebsd-stable mailing list