<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Hello,</p>
<p>I have a general question about nflog. <br>
</p>
<p>When i establish a vpn-con like 192.168.200.0/24 - to -
192.168.44.0/24 <br>
</p>
<p>and on my site there is an interface on vpn-gw like
192.168.200.1, i am able <br>
</p>
<p>to capture the output decap traffic in nflog:5 with <br>
</p>
<p>iptables -t mangle -I POSTROUTING -m policy --pol ipsec --dir
out -j NFLOG --nflog-group 5<br>
</p>
<p>and <br>
</p>
<p>tcpdump -ni nflog:5 <br>
</p>
<p>But when i establish a vpn-conn like 192.168.11.0/24 - to -
192.168.44.0/24</p>
<p>and my local subnet is still 192.168.200.0/24 ... so i have to
snat my subnet to 192.168..11.0/24 <br>
</p>
<p>iptables -t nat -A POSTROUTING -s 192.168.200.0/24 -d
192.168.44.0/24 -o $WAN -j NETMAP --to 192.168.11.0/24<br>
</p>
<p>there ist no route in table 220 ... and i am not able to capture
the decapsulated IPsec out traffic</p>
<p>....</p>
<p><span id="result_box" class="short_text" lang="en"><span class="">is
there any way to do this anyway?</span></span></p>
<p>regards<br>
</p>
<pre class="moz-signature" cols="72">--
Thomas Will
Xinux e.K.
Wichernstrasse 18
66482 Zweibruecken
Registergericht
Amtsgericht Zweibruecken
HRA 1518
P: +49 6332 44040
F: +49 6332 899227
M: +49 170 5218548
M: +49 176 97497102
E: <a class="moz-txt-link-abbreviated" href="mailto:thomas.will@xinux.de">thomas.will@xinux.de</a>
W: <a class="moz-txt-link-freetext" href="http://www.xinux.com">http://www.xinux.com</a></pre>
</body>
</html>