vpn/ipsec for jails (how to redirect/forward TCP)

nbari

nbari

Hi, I have a server with multiple public ip's (each per jail), on on jail I need a VPN-ipsec for doing so I created the ipsec tunnel on the main host using has PEAR the jail IP and later using pf just redirect-nat trafic to the jail doing something like this:
Code: 
nat pass on gif0 from 77.128.37.144 to 10.0.0.1 -> gif0
rdr pass on gif0 inet proto tcp from any to any port 8090 -> 77.128.37.144 port 8090
Code: 
<host B 10.0.0.1><----internet---><host FBSD host  77.128.37.140><==jails 77.128.37.140-144

this is the output of ifconfig:

Code: 
gif0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1280
        tunnel inet 77.128.37.144 --> 67.228.78.163
        inet 192.168.1.1 --> 10.0.0.1 netmask 0xffffffff

if ipsec is not running the redirection and nat work fine, from the jail 77.128.37.144 I can ping the private host B 10.0.0.1 and connect to port 8090 and also machines from host B can telnet/ping port 8090 on 77.128.37.144.

but if I enable ipsec and when the trafic becomes encrypted I can not route/nat the trafic.

what I need is to be available to connect from jail ip 77.128.37.144 to 10.0.0.1 on port 8090.

right now I am solving this with jumpgate (a TCP connection forwarder) running it from the master host but is there a way of doing the same with pf ?


my kernel has the following options:
Code: 
options   IPSEC
options   IPSEC_FILTERTUNNEL
options   IPSEC_DEBUG  
device    crypto
device    enc
Any ideas ?

regards.
 
I have added the

Code: 
options   IPSEC_NAT_T

on the kernel, any ideas how to make it work?
 
Recompile the kernel. You added it to the configuration file for the kernel. It still needs to be built. See The handbook.
 
I omit to comment that the kernel was already compiled and also the server as been rebooted, since for having IPSEC you need to rebuild the kernel Is a 'must' to rebuild the kernel and reboot when adding extra options.

but anyway besides that I can get it to work.

any more ideas ?
 
You must log in or register to reply here.
Back
Top