Re: IPSec tcp session stalling ( me too ) ...

From: Volker (volker_at_vwsoft.com)
Date: 10/22/05

  • Next message: Matthew Grooms: "IPSec tcp session stalling ( me too ) ..." 
    Date: Sat, 22 Oct 2005 22:01:46 +0100
To: Matthew Grooms <mgrooms@shrew.net>

    Matthew,

    thanks for your reply. Glad to hear that I'm not the only one
    experiencing this problem. So the problem is IPSec + firewall but not
    related to pf or ipfw. Is it IPSec + bandwidth management??

    I've tried a different test setup and just pushed a bunch of
    (/dev/random) data over a tcp connection through the IPSec tunnel using:

            %gnetcat 10.128.1.6 49001 /dev/random
    at host B (10.128.6.1) and did

            %netcat -l -p 49001 > netcat.out
    on host A (10.128.1.6).

    After the file 'netcat.out' reached the file size of 66.108 bytes
    (around the same size as the scp transfer aborts every time) the tcp
    stream has been closed with:

    host B: write(net): Operation not permitted
    host A: read(net): Connection reset by peer

    I've managed to get a tcpdump of the gif interfaces on both hosts. Both
    files are attached to this message (hostA.cap and hostB.cap). These
    files viewed by ethereal gives a nice look at the tcp flow. There you
    can see hostB sends three RST packets at the end (for whatever reason).

    The only thing I've seen (looking a bit ugly) is that hostA answers
    packets (ACK) before the data payload is being received. At least that's
    the way tcpdump has seen these packets. That should be related to
    priorisation of ACK packets using ALTQ.

    Is anybody else here with deep TCP + IPSec knowledge able to get a look
    into this? Any known issues? Is there anything I might also check out?
    Is there a 64k limit with IPSec? :(

    Thanks,

    Volker

    On 2005-10-22 19:33, Matthew Grooms wrote:
    > Volker,
    >
    > I have noticed the same problem. In my case, it only seems to
    > happen when the traffic is being forwarded across interfaces and pf or
    > ipfw is enabled. I use purely IPSEC so I would agree that GRE isn't the
    > problem. This behavior is 100% reproducible for me. If traffic is
    > forwarded from the host providing the ESP protection or if the firewall
    > package is disabled, the problem goes away.
    >
    > Just some data points. I don't recall seeing this ever happen on
    > 4.x + ipfw. I experienced this on early 5.x + ipfw, late 5.x + pf and
    > 6.x + pf. I believe the ipfw versions I tested were prior to the pfil
    > hooks conversion.
    >
    > For example ...
    >
    > NODE 1 sftp client
    > NODE 2 sftp server
    > IPSEC policy requires ESP protection from NODE 1 or VPN A to NODE 2
    >
    > NODE 1 ------ VPN A ===== VPN B ----- NODE 2
    >
    > 1) NODE 1 <-> NODE 2 sftp via IPSEC pf enabled, traffic stalls
    > 2) NODE 1 <-> NODE 2 sftp via IPSEC pf disabled, no problems
    > 3) VPN A <-> NODE 2 sftp via IPSEC pf enabled, no problems
    >
    > NOTE : TCP protocol is irrelevant. Haven't tried UDP.

    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"

  • Next message: Matthew Grooms: "IPSec tcp session stalling ( me too ) ..."

    Relevant Pages

    • IPSec woes
      ... I'm going off of the handbook section for setting up IPsec but I'm ... trying to setup a point-to-point between my host and another. ... installed racoon from ports and the first time I tried to ping my peer ...
      (freebsd-questions)
    • VPN: Network to Host to Internet
      ... I have two freebsd boxes running 5.0 with IPSec enabled and racoon ... and then off to the internet. ... host to host or network to network, but not network to host to internet. ...
      (freebsd-questions)
    • Re: firewall advice
      ... Duane Arnold wrote: ... >>one of the firewalls is on the rare occasion that I would want to ... > But IPsec doesn't present that problem with BI or any other host based FW ...
      (comp.security.firewalls)
    • Re: firewall advice
      ... >> On those rare occasions when you have to take one of them down, ... and IPsec and nothing has to be taken down. ... >> out classes any third party host based FW being used to supplement ... I see you're one of the many millons that will do a third party ...
      (comp.security.firewalls)
    • Re: Question about flow control over ethernet with TCP
      ... tell the other host to slow down its number of packets transmitted per ... When the TCP connection is created, both computers do not know how ... So the Host A send the first packets to host B. ...
      (comp.os.linux.networking)