Project

General

Profile

Actions
Copy link

Bug #2993

closed
JP EL

IPsec in transport mode, tunneled traffic does not flow through enc0

Bug #2993: IPsec in transport mode, tunneled traffic does not flow through enc0

Added by Jim Pingle over 13 years ago. Updated about 12 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Ermal Luçi
Category:
IPsec
Target version:
2.2
Start date:
05/15/2013
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
All
Affected Architecture:

Description

When using IPsec in transport mode, the arriving packets show as arriving encrypted on the physical interface, but the packets never show up on enc0. However, hey are actually received and processed by the OS, as reply packets are issued and are seen leaving enc0.

This happens on 2.0.x and 2.1.

Because of the way the traffic arrives, the packets never hit pf, so they don't get a state in the inbound direction. Due to that, the usual asymmetric state issues occur: ICMP works once a reply makes a state, same for UDP and other stateless protocols, but TCP is broken unless you manually add a floating rule to pass out traffic with any TCP flags and use sloppy state.

Test VMs are currently setup and available with tunnels to test/debug.

Actions
Copy link

Also available in: Atom