Re: IPSec Flow and SA to unexpected subnet

2017-11-29 Thread Stuart Henderson
On 2017-11-27, Tobias Urdin wrote: > Had the same problem with a shitty Netgear on the other end. > > OpenBSD happily accepted the flow with a 0/0 from forcing all traffic to > the destination over that tunnel. Yes, I once found the hard way that you can do this from an OpenBSD client too, I thin

Re: IPSec Flow and SA to unexpected subnet

2017-11-29 Thread Stuart Henderson
On 2017-11-27, Paul Suh wrote: > Note the two starred flows that are not listed in my ipsec.conf > configuration. The 172.16.0.0/16 subnet does exist on the Sonicwall end, and > I'm pretty sure that the Sonicwall is requesting that a flow be set up for > that subnet. However, I would think that

Re: IPSec Flow and SA to unexpected subnet

2017-11-27 Thread Tobias Urdin
Had the same problem with a shitty Netgear on the other end. OpenBSD happily accepted the flow with a 0/0 from forcing all traffic to the destination over that tunnel. I logged in to the Netgear GUI and explicitly set the subnets to tunnel instead of all which was selected before. Best regards

IPSec Flow and SA to unexpected subnet

2017-11-26 Thread Paul Suh
Folks, I set up a router using 6.2-stable, and created IKEv1 tunnels using isakmpd, something I've done many times before. The other end is a Sonicwall NSA 4500, which I've used as an endpoint before as well. My ipsec.conf file is: > ike active esp \ > from 192.168.144.0/24 \ >