# IPSec over gif interface



## vodvorezlaya (Jan 20, 2010)

Hello.

There is a simple network with two gateways, each gateway one interface connected to the Internet (em1 interfaces) to a local area network (em0 interfaces).

FreeBSD01:

```
freebsd01# ifconfig 
em0: inet 192.168.192.151 netmask 0xffffff00 broadcast 192.168.192.255
em1: inet 10.0.0.1 netmask 0xff000000 broadcast 10.255.255.255
lo0: inet 127.0.0.1 netmask 0xff000000
gif0: tunnel inet 10.0.0.1 -> 10.10.10.1
       inet 192.168.192.151 -> 192.168.194.1 netmask 0xffffffff
```


```
freebsd02# ifconfig
em0: inet 192.168.194.1 netmask 0xffffff00 broadcast 192.168.194.255
em1: inet 10.10.10.1 netmask 0xff000000 broadcast 10.255.255.255
lo0: inet 127.0.0.1 netmask 0xff000000
gif0: tunnel inet 10.10.10.1 -> 10.0.0.1
      inet 192.168.194.1 -> 192.168.192.151 netmask 0xffffffff
```

Installed tunnel (gif0) between two external interfaces.
Installed and configured racoon, properly configured IPSec.

When I run on freebsd01 command:
`ping -S 192.168.192.151 192.168.194.1`

in another terminal at 
	
	



```
freebsd01 # tcpdump-pni gif0
IP192.168.192.151> 192.168.194.1: ICMP echo request, id 50693, seq 14, length 64
IP 10.10.10.1> 10.0.0.1: IP 192.168.194.1> 192.168.192.151: ICMP echo reply, id 50693, seq 14, length 64 (ipip-proto-4)
```

At 
	
	



```
freebsd02 # tcpdump-pni gif0
IP 10.0.0.1> 10.10.10.1: IP 192.168.192.151> 192.168.194.1: ICMP echo request, id 50693, seq 150, length 64 (ipip-proto-4)
IP 192.168.194.1> 192.168.192.151: ICMP echo reply, id 50693, seq 150, length 64
```
Incoming packets are not encapsulated in strange ways.
If disable IPSec example command [CMD=]setkey -PF[/CMD]all works well.

If you disable IPSec for example the command setkey-PF all works well.

That is not in freebsd 6, but it appeared to freebsd 7 and 8 versions.
Perhaps there is a solution?

Thank you.


----------



## SirDice (Jan 20, 2010)

Can you post the output of `# netstat -rn` on both machines with gif running?


----------



## DutchDaemon (Jan 20, 2010)

(please use proper 
	
	



```
and [cmd] tags: [url]http://forums.freebsd.org/showthread.php?t=8816[/url])
```


----------



## vodvorezlaya (Jan 21, 2010)

Ok: 


```
freebsd01# netstat -rn
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            192.168.192.1      UGS         0        0    em0
10.0.0.0/8         link#2             U           1       91    em1
10.0.0.1           link#2             UHS         0        0    lo0
127.0.0.1          link#3             UH          0       26    lo0
192.168.192.0/24   link#1             U           2      245    em0
192.168.192.151    link#1             UHS         0        0    lo0
192.168.194.0/24   192.168.194.1      UGS         0        0   gif0
192.168.194.1      link#4             UH          0       27   gif0
```


```
freebsd02# netstat -rn
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
10.0.0.0/8         link#2             U           1      690    em1
10.10.10.1         link#2             UHS         0        0    lo0
127.0.0.1          link#3             UH          0        0    lo0
192.168.192.0/24   192.168.192.151    UGS         0      225   gif0
192.168.192.151    link#4             UH          0       12   gif0
192.168.194.0/24   link#1             U           0        0    em0
192.168.194.1      link#1             UHS         0        0    lo0
```


----------



## vodvorezlaya (Jan 25, 2010)

Maybe there is a network of more advanced resources on FreeBSD?
Not solve the problem does not happen)


----------

