NAT over enc(4)

classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view

NAT over enc(4)

Denis Fondras
Hello all,

I'm trying to build an IPSec VPN between two sites and both sites are
using the same addressing plan. I'm using OpenBSD 5.1 on a Soekris board
on one site and a closed-source appliance on the other end.

I remembered an old article on
( and tried to
adapt but without luck so far.

I need a 1:1 NAT mapping as multiple servers must be accessible from
either site.

Here is my setup (public IP and PSK changed) :

* /etc/ipsec.conf :
ike esp from ( to peer main auth hmac-sha1 enc aes-256 group modp1024 quick auth
hmac-sha1 enc aes-256 group modp1024 psk "mypsk"

* /etc/pf.conf :
match on enc0 from to binat-to source-hash

* pfctl -sr :
match out on enc0 inet from to nat-to source-hash 0xa28e791d2929a414834ebd15872704fa static-port
match in on enc0 inet from to rdr-to source-hash 0xa28e791d2929a414834ebd15872704fa

* ifconfig :
         lladdr 00:00:24:ce:b9:34
         priority: 0
         groups: egress
         media: Ethernet autoselect (1000baseT full-duplex)
         status: active
         inet6 fe80::200:24ff:fece:b934%em0 prefixlen 64 scopeid 0x1
         inet netmask 0xffffff00 broadcast
         lladdr 00:00:24:ce:b9:35
         priority: 0
         media: Ethernet autoselect (1000baseT
         status: active
         inet6 fe80::200:24ff:fece:b935%em1 prefixlen 64 scopeid 0x2
         inet netmask 0xffffff00 broadcast

* route -n show -encap
Routing tables

Source             Port  Destination        Port  Proto
192.168.6/24       0     192.168.0/24       0     0
192.168.0/24       0     192.168.6/24       0     0

My local and remote net is and forwarding is enabled.

I can see the IPSec tunnel is up and the routes are set.
If I ping from the remote site to the site behind the OpenBSD router
(ping from for example), I can see from a
tcpdump session that icmp echo from to appears
on em0 and dies there. Nothing pass on em1.

On the other hand, if I ping from the OpenBSD site to the other side
(ping from for example), I can see on enc0 a
trace of icmp echo from to (and not from to as one might expect).

What did I miss ?
In's article it is stated that you need both routers to be
OpenBSD. I understand that but still want to believe I should see some
trafic on em1, don't you think so ?

Thank you in advance,

Reply | Threaded
Open this post in threaded view

Re: NAT over enc(4)

Denis Fondras
Hello Mitja,

Le 05/02/2013 22:36, Mitja Muženič a écrit :
> I'm the author of the article you quoted.

Your article is really great, I'm glad to get some help from you :)

> Do you have a default gateway? IPsec on OpenBSD behaves weirdly if you don't
> have one (even if it's not needed!). This scenario is likely to happen
> especially in the test setups with directly connected firewalls...

Yes, I have one. In fact this is not a lab setup. I'm doing the test in
production environment. I can break it as this is not a site of great
importance. The two sites are connected via the Internet.

> The trick is that both ipsec tunnel perform a sanity check on the address
> range of the traffic. On this side the tunnel is between 192.168.0/24 and
> 192.168.6/24 [1], but we tell the peer that he ought to establish a tunnel
> from _his_ 192.168.0/24 to 192.168.7/24 [2]. So your traffic from the remote
> to fails the source check on this end, as there is
> no NAT on remote device and this side sees traffic from, not
> as defined by the tunnel [1], so it's silently discarded. If you
> try to bypass this by pinging from to, such traffic
> won't match the remote site's source tunnel definition [2] and will be
> dropped on the remote end already before even entering the tunnel.

It isn't clear to me. There is NAT on remote the device and I can see
traffic from

> There shouldn't be any traffic from 192.168.x.0 on your em0, that's your
> public interface, isn't it? I presume this comes from you actually testing
> this in a lab and em0 is actually directly connected to the remote device?
> So the private traffic on em0 is leakage from far side because that traffic
> does not enter the vpn tunnel at all.

em0 is my public facing interface and it is connected to an ISP that
route traffic to the other site.

> This is unexpected, you should be seeing icmp echo from to
> Double check that your "match on enc0..." rules really apply to
> those packets, I've been bitten by the "match" logic before. For test
> purposes you can always rewrite that rule to "pass out quick on enc0...".
> Also see that you don't have a "set skip on enc0" line.

I don't for sure. The whole pf.conf was posted at the top of the first
mail. There is nothing more than the first "match" rule.
I'm pretty sure the problem lies with PF, can't see where for now but
I'm still searching.

Thank you very much for the answer.