Project

General

Profile

Actions

Bug #2884

closed

Tunnel status in case of NAT before IPSec

Added by Michele Di Maria about 11 years ago. Updated almost 11 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
IPsec
Target version:
Start date:
03/15/2013
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.1
Affected Architecture:

Description

Hi,
the status of the Phase2 is reported as down in case of NAT before IPSec, while the tunnel is up and working properly.
The SPD entries look like (Source, Destination, Direction):
- Remote network, Local natted network, >
- Local non-natted network, Remote network, <

Looking at the code, the Phase2 is reported down because the entries are not "specular" (natted/not natted).

Thanks,
Michele

Actions #1

Updated by Chris Buechler about 11 years ago

  • Category set to IPsec
  • Target version set to 2.1

I've noticed this on every install I've worked on with NAT lately too, it works just fine but the status always shows down.

Actions #2

Updated by Michele Di Maria about 11 years ago

Since the SPD entries are not specular, in stead of searching for the "in" entry, we could look for the "out" entry, which is the same for natted/not natted entries... in this case the tunnel is reported as working.

To do that, we should change in /etc/inc/ipsec.inc the line 357 to:
else if (!empty($ph2ent['natlocalid']) && ipsec_lookup_ipsec_sa($spd,$sad,"out",$loc_ip,$rmt_ip,$loc_id,$rmt_id))

Chris, if you think this is not a problem I can change it on GitHub...

Actions #3

Updated by Chris Buechler about 11 years ago

That sounds sane. I haven't dug into this part of the code though. If it works and you think that's reasonable, go ahead and send a pull request.

Actions #4

Updated by Michele Di Maria about 11 years ago

Done! ;)

Actions #5

Updated by Chris Buechler about 11 years ago

  • Status changed from New to Feedback

thanks!

Actions #6

Updated by Renato Botelho almost 11 years ago

  • Status changed from Feedback to Resolved
Actions

Also available in: Atom PDF