NATd trouble

Hi,

I've the network below :

192.168.2.0/23
|
192.168.3.454 FreeBSD
x.x.x.x router 1
|
Internet
|
y.y.y.y FreeBSD
10.0.0.254 router 2
|
10.0.0.0/24

Each gateway run racoon.
Each network can go on Internet.
VPN is ok.

I would like to NAT packets from 192.168.2.0/23 to 10.0.0.0/24 with IP 192.168.3.254 on router 1. VPN interface is gif5 on router 1.

My ipfw rules :
dialup:~# ipfw show | grep 8670
00650 4 400 divert 8670 ip from 192.168.2.0/23 to 10.0.0.0/24
00660 4 400 divert 8670 ip from 10.0.0.0/24

natd in debug mode :

dialup:~# natd -v -p natd-vpn -interface gif5
natd[42308]: Aliasing to 192.168.3.254, mtu 1280 bytes
In [ICMP] [ICMP] 192.168.3.82 -> 10.0.0.1 8(0) aliased to
[ICMP] 192.168.3.82 -> 10.0.0.1 8(0)
Out [ICMP] [ICMP] 10.0.0.1 -> 192.168.3.82 0(0) aliased to
[ICMP] 10.0.0.1 -> 192.168.3.82 0(0)

As you can see, packets are not translated with IP 192.168.3.54.

Same result with natd -p natd-vpn -a 192.168.3.254.

I think the solution will be with -reverse, when I use it, packets are natd (ping from 192.168.3.61 to 10.0.0.1) :

dialup:/etc# natd -v -p natd-vpn -reverse -interface gif5
natd[43271]: Aliasing to 192.168.3.254, mtu 1280 bytes
In [ICMP] [ICMP] 192.168.3.61 -> 10.0.0.1 8(0) aliased to
[ICMP] 192.168.3.254 -> 10.0.0.1 8(0)

tcmpdup on remote gateway :
11:26:44.641090 IP 192.168.3.254 > 10.0.0.1: icmp 64: echo request seq 0
11:26:44.641240 IP 10.0.0.1 > 192.168.3.254: icmp 64: echo reply seq 0

But I haven't got any reply on localsite (192.168.2.0/23), I haven't got packet OUT on natd.

David.

Thanks !

Have a nice Christmas !
.

Relevant Pages

  • Re: How to see frag/defrag utilization of the router.
    ... > defragmentin/fragmenting of packets about wrong settings of MTU. ... > I have IPsec traffic going through the router and when it is present ... > 400-500 kbytes per second while the IPsec traffic only 30/40 kBytes ...
    (comp.dcom.sys.cisco)
  • VLAN MTU problem in 4.9 ?
    ... I have the following setup on a freebsd box acting as a router for multiple ... but since I upgraded from 4.9-RC2 on the FreeBSD ... PING 207.176.232.142: 1500 data bytes ... packets transmitted, 1 packets received, 0% packet loss ...
    (freebsd-net)
  • MS XP or FreeBSD Problem
    ... I administer a couple of FreeBSD boxes from my home using a ... The connection to the office LAN is via kernel ppp ... connection however is "lost" as soon as packets larger than 576 bytes are ... If I remove the MTU setting on the ppp link the problem goes away. ...
    (comp.unix.bsd.freebsd.misc)
  • Re: Whats happened to Microsoft Support?
    ... supports our servers and they suggested it could be the router that controls ... I've had the MTU setting changed from 1400 to 1500 at ... single byte of control bits to packets. ...
    (microsoft.public.exchange.admin)
  • Understanding path MTU discovery
    ... As far as I can tell from my reading, if a computer on the internet accesses our web server, but the reply from the server is too big (for example, the client computer is using a PPPoE link with an MTU of 1492), the client's ISP's gateway router will send an ICMP package back to our router. ... I understand that I could mark incoming packets from clients so that replies are sent out through the same interface they came in, but I would prefer to balance the output packets. ...
    (comp.os.linux.networking)