Slagter, EM wrote:
Hi,
I don't know whether this netfilter behaviour is a bug or intentional,
but at least for me it's not what I'd expect (nor want).
Our system (simplified to significant parts):
- linux i386 kernel 2.6.21.2 vanilla, almost all netfilter and ipsec
parts compiled in, no (relevant) modules
- one vlan interface connected to public internet
- one vlan interface connected to internal vlan, RFC addresses
- pluto ("openswan") to manage ISAKMP, appropriate config file
- some netfilter rules that include -m policy to separate the ipsec
traffic before and after encapsulation (for instance to prevent traffic
to be sent over internet without encryption)
Using this scenario, it works pretty much as documented.
As soon as I add SNAT to traffic originating from this vlan (as required
by our supplier), the rules that (properly) used to match on "-m policy
--pol ipsec --dir out --tunnel-src ... --tunnel-dst ..." no longer
match. Even if I remove the tunnel-src and --tunnel-dst the rule no
longer matches. If I change "the --pol ipsec" to "--pol none" the rule
matches again. This is wrong IMHO as the traffic is still encapsulated
(checked this with tshark) as expected.
I've checked the ChangeLogs of the kernel from 2.6.21.2 to current but
there doesn't seem to have been a relevant patch on this matter.
This is expected behaviour. Before NAT takes place, the packet
doesn't match a policy, it only does after getting mangled by
NAT, but at that point it already passed through your policy
matches.
-
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
