Re: [ossig] Re: [myoss] Linux kernel IP stack, 7-layer OSI cake andSNAT shenanigans

[SianLun Lau <wahlau@xxxxxxx>]

On Thu, 4 Nov 2004 21:00:57 +0800
Christopher DeMarco <cdemarco@fastmail.fm> wrote:

> > so in a  way, you don't  need NAT in  order to make the two
> > networks realise each other's existance.
> 
> That's cute, I  didn't realize that.  But  the problem is that in
> this case the other party we're connecting to is expecting  us to
> come from the same network as  they're using -  and I don't intend
> to re-address my network.  So the NAT requirement still stands.

what application they need to use in order to demand the same network?
we have people who connect remotely using ipsec tunnel, to get his
remote desktop from Canada to Germany without needing the *same*
network, so i doubt they really understood *same* network when they
say with what they have asked.

with NAT it does not help the situation at all, you can't even reach a
specific NAT'ed workstation or server from the other side, unless you
do some port forwarding :)

> No takers on whether I can do the NAT on  the same physical machine
> as the IPsec?

you gotta use your iptables that it would NAT your packets rushing
towards IPSECx i guess. i have no idea. read through the freeswan
faqs, or iptables manuals.

SL


---------------------------------------------------------
To unsubscribe: send mail to ossig-request@mncc.com.my
with "unsubscribe ossig" in the body of the message