[NetBSD] 3.0.0, rasvpn et problèmes de mtu

'Lut,

J'ai un routeur dsl sous NetBSD 3.0.0, celui-ci fait office de rasvpn
(client shrewsoft), j'ai un problème lorsque je tente d'accéder aux
machines du lan interne depuis le client vpn. Le routeur renvoie une
demande de fragmentation aux hôtes du lan, mais avec une valeur de mtu
erronnée. (1419 en lieu et place de 552 comme defini dans le racoon.conf
et le pf.conf de la machine.

Le racoon utilisé est la version cvs d'ipsec-tools (support complet de
la section modecfg nécessaire, 2006-06-07 selon le changelog)

La trace pcap d'une tentative d'ouverture de session ssh vers un hôte du
lan depuis un client vpn est disponible ici :
http://emss.free.fr/informatique/sshroadwarrior.pcap

La trace a été enregistrée depuis le routeur en question.

Quelqu'un aurait-il une idée sur la question ?

Merci d'avance

Éric

pf.conf :
+---------------------------------------------------------------------------+
# $NetBSD: pf.conf,v 1.3 2005/03/15 16:05:03 peter Exp $
# $OpenBSD: pf.conf,v 1.28 2004/04/29 21:03:09 frantzen Exp $
#
# See pf.conf(5) and /usr/share/examples/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.

# Macros
ext_if="pppoe0"
int_if="vr0"
tunnel_if="gif0"

tcp_services="{ 22 }"
udp_services="{ 500, 4500 }"
allowed_hosts="{ A.B.C.D, E.F.G.H }"

roadwarriors="10.250.0.0/24"
icmp_types="echoreq"

# Options
set block-policy return
set loginterface $ext_if

# Scrub
scrub in on $int_if from any to $roadwarriors max-mss 552
scrub in

# Nat
nat on $ext_if from !($ext_if) -> ($ext_if:0)

# Filter
pass quick on $int_if

block in log
pass out keep state

pass quick on { lo $int_if $tunnel_if }
antispoof quick for { lo $int_if }

pass in log on $ext_if proto tcp \
from $allowed_hosts \
to ($ext_if) \
port $tcp_services flags S/SA keep state

pass in log on $ext_if proto udp \
to ($ext_if) \
port $udp_services keep state

pass in log on $ext_if proto esp \
to ($ext_if)

pass in log inet proto icmp all icmp-type $icmp_types keep state
+---------------------------------------------------------------------------+

racoon.conf :
+---------------------------------------------------------------------------+
#
# Common configuration file
#

# Path
path include "/etc/racoon" ;
path pre_shared_key "/etc/racoon/psk.txt" ;
path certificate "/etc/racoon/certs" ;
path script "/etc/racoon/scripts" ;

# Logging level : "notify", "debug" or "debug2".
log notify;

# Local configuration
include "local.conf" ;

# Padding
padding
{
maximum_length 20; # maximum padding length.
randomize off; # enable randomize length.
strict_check off; # enable strict check.
exclusive_tail off; # extract last one octet.
}

# Timer
timer
{
# These value can be changed per remote node.
counter 5; # maximum trying count to send.
interval 20 sec; # maximum interval to resend.
persend 1; # the number of packets per a send.

# NATT handling
natt_keepalive 10sec;

# timer for waiting to complete each phase.
phase1 30 sec;
phase2 15 sec;
}
+---------------------------------------------------------------------------+

local.conf :
+---------------------------------------------------------------------------+
#
# rtrbsdpanint configuration file
#

listen {
isakmp I.J.K.L [500];
isakmp_natt I.J.K.L [4500];
adminsock "/var/run/racoon.sock";
}

remote A.B.C.D {
exchange_mode main;
doi ipsec_doi;
situation identity_only;
nonce_size 16;
lifetime time 2 hour; # sec,min,hour
initial_contact on;
support_proxy on;
proposal_check obey; # obey, strict or claim
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key ;
dh_group 2 ;
}
}

remote anonymous {
exchange_mode aggressive;
certificate_type x509 "rasvpn.cert" "rasvpn.key";
my_identifier asn1dn;
proposal_check strict; # obey, strict or claim
lifetime time 24 hour; # sec,min,hour
generate_policy on;
passive on;

nat_traversal on;
ike_frag on;
esp_frag 552;
#script "phase1_up.sh" phase1_up;
#script "phase1_down.sh" phase1_down;
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method hybrid_rsa_server;
dh_group 2;
}
}

sainfo anonymous {
pfs_group 1;
lifetime time 1 hour;
encryption_algorithm 3des;
authentication_algorithm hmac_sha1;
compression_algorithm deflate ;
}

mode_cfg {
auth_source system;
conf_source local;
pool_size 254;
network4 10.250.0.1;
netmask4 255.255.255.255;
dns4 10.93.0.5;
wins4 10.93.0.5;
split_network include 10.93.0.0/24, 10.50.0.0/24, 10.240.160.0/24;
default_domain "example.com";
}
+---------------------------------------------------------------------------+

--
Cela n'a rien à voir avec un filtre. Je suis désolé, mais poster un
cancel sur son serveur qui est relié à d'autres serveurs est bel et
bien un abus.
-+- JH in <http://www.le-gnu.net> - Tu t'es vu quand t'abus ? -+-