☰

无法通过 ipsec enc0 (mtu=0) 上的 nat ping 远程主机

tag-icon • tag-icon nat ipsec ping openbsd mtu
无法通过 ipsec enc0 (mtu=0) 上的 nat ping 远程主机

我已将 ipsec vpn 连接到远程主机。由于远程主机仅接受一个 IP，因此我在 enc0 上为本地网络启用了 nat。从 ipsec 主机进行 ping 操作正常：

PING 172.20.162.150 (172.20.162.150): 56 data bytes
64 bytes from 172.20.162.150: icmp_seq=0 ttl=252 time=2.597 ms

但从本地网络 ping 不通：

PING 172.20.162.150 (172.20.162.150) 56(84) bytes of data.
From 192.168.1.5 icmp_seq=1 Frag needed and DF set (mtu = 0)

enc0 的 MTU = 0，我无法更改它

netstat -i
Name    Mtu   Network     Address              Ipkts Ierrs    Opkts Oerrs Colls
enc0    0     <Link>                              29     0       29     0     0
enc0    0     172.25.41.1 172.25.41.10            29     0       29     0     0

我尝试在 pf.conf 中使用 scrub，但没有帮助：

match in on enc0 scrub (no-df max-mss 1452)

或匹配所有 Scrub (no-df max-mss 1452)

sudo ifconfig enc0 mtu 1452 返回：

SIOCSIFMTU: Inappropriate ioctl for device

不幸的是，没有解决方案选项（（（

其他可能有助于理解的设置：

172.20.162.150 - remote host
172.25.41.10 - local ip for enc0 (only this ip accepted by 172.20.162.150)
192.168.1.0/24 local net and 192.168.1.5 ip of my host for local net

/etc/hostname.enc0
inet 172.25.41.10 255.255.255.255
up
!/sbin/route add -host 172.20.162.150 172.25.41.10

/etc/ipsec.conf
ike esp from 172.25.41.10/32 to 172.20.162.150/32 peer 80.*.*.132 \
    main auth hmac-sha1 enc aes-256 group modp1024 lifetime 86400 \
    quick auth hmac-sha1 enc aes-256 group modp1024 lifetime 3600 \
    psk ***********

/etc/pf.conf
pass from 172.20.162.150 to any
pass out quick on enc0 from <localnet> to 172.20.162.150 nat-to enc0 keep state (if-bound)

tcpdump for ping from local net for internal net if
192.168.1.13 > 172.20.162.150: icmp: echo request (id:777a seq:5) [icmp cksum ok] (DF) (ttl 64, id 30758, len 84)
192.168.1.5 > 192.168.1.13: icmp: 172.20.162.150 unreachable - need to frag [icmp cksum ok] (ttl 255, id 44410, len 56, bad ip cksum 0! -> 8ae7)

tcpdump for enc0 is empty.

Statistic for nat from pfctl:
sudo pfctl -s state | grep 172.20.162.150
all icmp 172.20.162.150:8 <- 192.168.1.13:30586       0:0
enc0 icmp 172.25.41.10:61751 (192.168.1.13:30586) -> 172.20.162.150:8       0:0

有人遇到过类似的问题吗，能迅速解决吗？

相关内容