DaemonForums - View Single Post - connect to an other site using ipsec-nat

wesley · #25 **(View Single Post)** 22nd September 2009

Here additional protocol information :

tcpdump -neti enc0 :
-----------------------
(authentic,confidential): SPI 0x01112673: 192.168.191.254.30740 > 192.168.192.113.21: S 2719148255:2719148255(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (encap)
(authentic,confidential): SPI 0x01112673: 192.168.191.254.29712 > 192.168.192.115.21: S 26857501:26857501(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (encap)
(authentic,confidential): SPI 0x01112673: 192.168.191.254.29712 > 192.168.192.115.21: S 26857501:26857501(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (encap)
(authentic,confidential): SPI 0x01112673: 192.168.191.254.30740 > 192.168.192.113.21: S 2719148255:2719148255(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (encap)
(authentic,confidential): SPI 0x01112673: 192.168.191.254.29712 > 192.168.192.115.21: S 26857501:26857501(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (encap)
(authentic,confidential): SPI 0x01112673: 192.168.191.254.30740 > 192.168.192.113.21: S 2719148255:2719148255(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (encap)
(authentic,confidential): SPI 0x01112673: 192.168.191.254.27440 > 192.168.192.113.21: S 3748804944:3748804944(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (encap)
(authentic,confidential): SPI 0x01112673: 192.168.191.254.7600 > 192.168.192.115.21: S 2048028966:2048028966(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (encap)
(authentic,confidential): SPI 0x01112673: 192.168.191.254.27440 > 192.168.192.113.21: S 3748804944:3748804944(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (encap)
(authentic,confidential): SPI 0x01112673: 192.168.191.254.7600 > 192.168.192.115.21: S 2048028966:2048028966(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (encap)
(authentic,confidential): SPI 0x01112673: 192.168.191.254.27440 > 192.168.192.113.21: S 3748804944:3748804944(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (encap)
(authentic,confidential): SPI 0x01112673: 192.168.191.254.7600 > 192.168.192.115.21: S 2048028966:2048028966(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (encap)
(authentic,confidential): SPI 0x01112673: 192.168.191.254.6478 > 192.168.192.113.21: S 208296092:208296092(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (encap)
(authentic,confidential): SPI 0x01112673: 192.168.191.254.11298 > 192.168.192.115.21: S 3712341480:3712341480(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (encap)
(authentic,confidential): SPI 0x01112673: 192.168.191.254.11298 > 192.168.192.115.21: S 3712341480:3712341480(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (encap)
(authentic,confidential): SPI 0x01112673: 192.168.191.254.6478 > 192.168.192.113.21: S 208296092:208296092(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (encap)
(authentic,confidential): SPI 0x01112673: 192.168.191.254.11298 > 192.168.192.115.21: S 3712341480:3712341480(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (encap)
(authentic,confidential): SPI 0x01112673: 192.168.191.254.6478 > 192.168.192.113.21: S 208296092:208296092(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (encap)

tcpdump -neti pflog0 action block :
-----------------------------------

rule 0/(match) block out on rl0: 192.168.191.254.26486 > 192.168.192.115.21: S 4267692740:4267692740(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.22980 > 192.168.192.113.21: S 3045080857:3045080857(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.26486 > 192.168.192.115.21: S 4267692740:4267692740(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.22980 > 192.168.192.113.21: S 3045080857:3045080857(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.26486 > 192.168.192.115.21: S 4267692740:4267692740(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block in on bge0: 192.168.0.90.137 > 192.168.0.255.137: udp 50
rule 0/(match) block out on rl0: 192.168.191.254.24461 > 192.168.192.113.21: S 2995623372:2995623372(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.32214 > 192.168.192.115.21: S 2747258712:2747258712(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.24461 > 192.168.192.113.21: S 2995623372:2995623372(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.32214 > 192.168.192.115.21: S 2747258712:2747258712(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.24461 > 192.168.192.113.21: S 2995623372:2995623372(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.32214 > 192.168.192.115.21: S 2747258712:2747258712(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block in on bge0: 192.168.0.90.138 > 192.168.0.255.138: udp 201
rule 0/(match) block out on rl0: 192.168.191.254.28033 > 192.168.192.113.21: S 144558888:144558888(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.22274 > 192.168.192.115.21: S 1192551097:1192551097(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.22274 > 192.168.192.115.21: S 1192551097:1192551097(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.28033 > 192.168.192.113.21: S 144558888:144558888(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.22274 > 192.168.192.115.21: S 1192551097:1192551097(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.28033 > 192.168.192.113.21: S 144558888:144558888(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block in on bge0: 192.168.0.13.138 > 192.168.0.255.138: udp 201
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block out on rl0: 192.168.191.254.20032 > 192.168.192.113.21: S 627212253:627212253(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.8843 > 192.168.192.115.21: S 3116891829:3116891829(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.8843 > 192.168.192.115.21: S 3116891829:3116891829(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.20032 > 192.168.192.113.21: S 627212253:627212253(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.8843 > 192.168.192.115.21: S 3116891829:3116891829(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.20032 > 192.168.192.113.21: S 627212253:627212253(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block in on bge0: 192.168.0.106.138 > 192.168.0.255.138: udp 201 (DF)
rule 0/(match) block in on bge0: 192.168.0.106.138 > 192.168.0.255.138: udp 204 (DF)
rule 0/(match) block in on bge0: 192.168.0.96.137 > 192.168.0.255.137: udp 68
rule 0/(match) block in on bge0: 192.168.0.96.137 > 192.168.0.255.137: udp 68
rule 0/(match) block in on bge0: 192.168.0.96.137 > 192.168.0.255.137: udp 68
rule 0/(match) block in on bge0: 192.168.0.96.137 > 192.168.0.255.137: udp 68
rule 0/(match) block in on bge0: 192.168.0.96.137 > 192.168.0.255.137: udp 68
rule 0/(match) block in on bge0: 192.168.0.96.137 > 192.168.0.255.137: udp 68
rule 0/(match) block in on bge0: 192.168.0.96.137 > 192.168.0.255.137: udp 68
rule 0/(match) block in on bge0: 192.168.0.96.137 > 192.168.0.255.137: udp 68
rule 0/(match) block in on bge0: 192.168.0.96.137 > 192.168.0.255.137: udp 68
rule 0/(match) block in on bge0: 192.168.0.96.137 > 192.168.0.255.137: udp 68
rule 0/(match) block in on bge0: 192.168.0.96.137 > 192.168.0.255.137: udp 68
rule 0/(match) block in on bge0: 192.168.0.96.137 > 192.168.0.255.137: udp 68
rule 0/(match) block in on bge0: 192.168.0.93.138 > 192.168.0.255.138: udp 201
rule 0/(match) block in on bge0: 192.168.0.96.138 > 192.168.0.255.138: udp 201
rule 0/(match) block in on bge0: 192.168.0.96 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.96 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92.137 > 192.168.0.255.137: udp 50
rule 0/(match) block in on bge0: 192.168.0.92.137 > 192.168.0.255.137: udp 50
rule 0/(match) block in on bge0: 192.168.0.92.137 > 192.168.0.255.137: udp 50
rule 0/(match) block in on bge0: 192.168.0.92.137 > 192.168.0.255.137: udp 50
rule 0/(match) block in on bge0: 192.168.0.92.137 > 192.168.0.255.137: udp 50
rule 0/(match) block in on bge0: 192.168.0.92.137 > 192.168.0.255.137: udp 50
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block out on rl0: 192.168.191.254.26415 > 192.168.192.113.21: S 2708323010:2708323010(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.24441 > 192.168.192.115.21: S 3574680055:3574680055(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block in on bge0: 10.0.0.115.137 > 10.0.0.255.137: udp 50 (DF)
rule 0/(match) block in on bge0: 10.0.0.115.137 > 10.0.0.255.137: udp 50 (DF)
rule 0/(match) block in on bge0: 10.0.0.115.137 > 10.0.0.255.137: udp 50 (DF)
rule 0/(match) block out on rl0: 192.168.191.254.24441 > 192.168.192.115.21: S 3574680055:3574680055(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.26415 > 192.168.192.113.21: S 2708323010:2708323010(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block in on bge0: 10.0.0.115.137 > 10.0.0.255.137: udp 50 (DF)
rule 0/(match) block in on bge0: 10.0.0.115.138 > 10.0.0.255.138: udp 183 (DF)
rule 0/(match) block in on bge0: 10.0.0.114.137 > 10.0.0.255.137: udp 50
rule 0/(match) block in on bge0: 10.0.0.114.137 > 10.0.0.255.137: udp 50
rule 0/(match) block out on rl0: 192.168.191.254.24441 > 192.168.192.115.21: S 3574680055:3574680055(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.26415 > 192.168.192.113.21: S 2708323010:2708323010(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block in on bge0: 10.0.0.114.137 > 10.0.0.255.137: udp 50
rule 0/(match) block in on rl0: 222.186.24.88.6000 > 11.11.11.11.2967: S 424673280:424673280(0) win 16384
rule 0/(match) block in on bge0: 192.168.0.96.138 > 192.168.0.255.138: udp 201
rule 0/(match) block in on bge0: 192.168.0.92.137 > 192.168.0.255.137: udp 50
rule 0/(match) block in on bge0: 192.168.0.92.137 > 192.168.0.255.137: udp 50
rule 0/(match) block in on bge0: 192.168.0.92.137 > 192.168.0.255.137: udp 50
rule 0/(match) block out on rl0: 192.168.191.254.22620 > 192.168.192.113.21: S 1458540138:1458540138(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.5512 > 192.168.192.115.21: S 1144270903:1144270903(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.5512 > 192.168.192.115.21: S 1144270903:1144270903(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.22620 > 192.168.192.113.21: S 1458540138:1458540138(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.5512 > 192.168.192.115.21: S 1144270903:1144270903(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.21194 > 192.168.192.113.21: S 2050700805:2050700805(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.10586 > 192.168.192.115.21: S 2056532055:2056532055(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block in on bge0: 192.168.0.96.138 > 192.168.0.255.138: udp 174
rule 0/(match) block in on bge0: 192.168.0.96.137 > 192.168.0.255.137: udp 50
rule 0/(match) block in on bge0: 192.168.0.96.137 > 192.168.0.255.137: udp 50
rule 0/(match) block in on bge0: 192.168.0.96.137 > 192.168.0.255.137: udp 50
rule 0/(match) block in on bge0: 192.168.0.96.137 > 192.168.0.255.137: udp 50
rule 0/(match) block out on rl0: 192.168.191.254.21194 > 192.168.192.113.21: S 2050700805:2050700805(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.10586 > 192.168.192.115.21: S 2056532055:2056532055(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.21194 > 192.168.192.113.21: S 2050700805:2050700805(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.10586 > 192.168.192.115.21: S 2056532055:2056532055(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block in on bge0: 192.168.0.144.138 > 192.168.0.255.138: udp 201
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.90.137 > 192.168.0.255.137: udp 50
rule 0/(match) block in on bge0: 192.168.0.90.137 > 192.168.0.255.137: udp 50
rule 0/(match) block in on bge0: 192.168.0.90.137 > 192.168.0.255.137: udp 50
rule 0/(match) block in on bge0: 192.168.0.96.138 > 192.168.0.255.138: udp 201
rule 0/(match) block out on rl0: 192.168.191.254.23460 > 192.168.192.113.21: S 2343404651:2343404651(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.2484 > 192.168.192.115.21: S 194258043:194258043(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.23460 > 192.168.192.113.21: S 2343404651:2343404651(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.2484 > 192.168.192.115.21: S 194258043:194258043(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.23460 > 192.168.192.113.21: S 2343404651:2343404651(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.2484 > 192.168.192.115.21: S 194258043:194258043(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block in on bge0: 192.168.0.92 > 224.0.0.22: igmp-2 [v2] [ttl 1]
rule 0/(match) block out on rl0: 192.168.191.254.22382 > 192.168.192.113.21: S 939136304:939136304(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.4963 > 192.168.192.115.21: S 118026792:118026792(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.4963 > 192.168.192.115.21: S 118026792:118026792(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
rule 0/(match) block out on rl0: 192.168.191.254.

If you can help me please.?.