IP forwarding on a linux IPSec gateway

IP forwarding on a linux IPSec gateway

[Prashant Batra (prbatra)]

Hi,

I am trying to establish an IPSec tunnel to protect a subnet behind a linux machine and a subnet behind some other gateway.
Lefsubnet - 172.17.0.0/16 (behind linux gateway)
Rightsubnet - 172.16.0.0/16

From a host on left subnet, I am trying to ping to a host on right subnet-
ping 172.16.60.1 -I 172.17.70.87

tcpdump capture on linux machine connected to left subnet-
04:27:09.939598 IP 172.17.70.87 > 172.16.60.1: icmp 64: echo request seq 170

Tcpdump capture on linux machine connected on right subnet-
04:26:32.941624 IP 1.1.0.1 > 192.168.101.101: ESP(spi=0x020000c3,seq=0x16d)                 //Outer IPs
04:26:32.943940 IP 192.168.101.101 > 1.1.0.1: ESP(spi=0x10000102,seq=0x16d)
04:26:32.943940 IP 172.16.60.1 > 172.17.70.87: icmp 64: echo reply seq 133

So, it's clear that linux gateway is able to protect the data and send to the connected gateway (ESP packets to outer IPs).
And the second gateway is responding with ESP packet which is decoded on linux gateway and sent to the ip stack again by linux kernel (ICMP reply).
But the reply doesn't reach the host on left subnet.

I enabled ip_forwarding through /proc/sys/net/ipv4/ip_forwarding.

Please let me know, if I am missing something.

Any help would be appreciated.

Regards,
Prashant

Re: IP forwarding on a linux IPSec gateway

[Andrew Beverley]

On Fri, 2012-01-27 at 15:31 +0530, Prashant Batra (prbatra) wrote:
> So, it's clear that linux gateway is able to protect the data and send
> to the connected gateway (ESP packets to outer IPs). And the second
> gateway is responding with ESP packet which is decoded on linux gateway
> and sent to the ip stack again by linux kernel (ICMP reply). But the
> reply doesn't reach the host on left subnet.

Didn't somebody else have a similar problem recently? He found that it
worked using one internet provider but not another. If you're not seeing
anything received in tcpdump in the left subnet, then I would suspect
that the packet is getting lost in the WAN somewhere. What happens when
you ping in the other direction?

Andy

RE: IP forwarding on a linux IPSec gateway

[Prashant Batra (prbatra)]

-----Original Message-----
From: Andrew Beverley [mailto:andy@andybev.com] 
Sent: Tuesday, January 31, 2012 11:18 PM
To: Prashant Batra (prbatra)
Cc: netdev@vger.kernel.org
Subject: Re: IP forwarding on a linux IPSec gateway

On Fri, 2012-01-27 at 15:31 +0530, Prashant Batra (prbatra) wrote:
> So, it's clear that linux gateway is able to protect the data and send
> to the connected gateway (ESP packets to outer IPs). And the second
> gateway is responding with ESP packet which is decoded on linux gateway
> and sent to the ip stack again by linux kernel (ICMP reply). But the
> reply doesn't reach the host on left subnet.

Didn't somebody else have a similar problem recently? He found that it
worked using one internet provider but not another. If you're not seeing
anything received in tcpdump in the left subnet, then I would suspect
that the packet is getting lost in the WAN somewhere. What happens when
you ping in the other direction?
[Prashant] Hi Andy,

Thanks, for the reply, but I got it to work by adding "fwd" policy, after investigating some stats in proc.

Now, I am facing another issue with 2.6.38 kernel, when it started working on 2.6.34 kernel.  
Any links to understand the flow in the kernel for this kind of forwarding with IPSec to analyze where the problem could be
will be really helpful.

Andy

RE: IP forwarding on a linux IPSec gateway

[Andrew Beverley]

On Tue, 2012-01-31 at 23:41 +0530, Prashant Batra (prbatra) wrote:
> Any links to understand the flow in the kernel for this kind of
> forwarding with IPSec to analyze where the problem could be will be
> really helpful.

Does this excellent diagram from Jan help at all?

http://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg

Andy