zahadny problem s ipsecem

Dobry den,

resim nasleduji problem: mam zprovoznen ipsec tunel host-to-net:

left...right====rightsubnet

Stroj left slouzi jako ipsec gateway a firewall, provadi se NAT. Vse je funkcni, pokud pingnu pocitac v righsubnet z pocitace left (stroje v rightsubnet maji verejna IP..). Pokud ale zkusim ping ze stroje, ktery je za left (tj. z privatni site, s tim, ze na stroji left se dela maskarada), pakety neprojdou ipsec tunelem. Tj. potreboval bych vedet, jak mam pakety "donutit" pouzit tunel.. Predem diky za napady...

pomocne udaje:

kernel 2.6.8, pouziva se nativni implementace ipsecu + openswan 2.2.0

ipsec.conf

  conn pokus
        authby=secret
        left=xxx.xxx.xxx.xxx
        right=yyy.yyy.yyy.yyy
        rightsubnet=zzz.zzz.zzz.zzz/24
        ikelifetime=120m
        keylife=3600s
        pfs=no
        keyingtries=0
        disablearrivalcheck=yes
        auth=esp
        esp=3des-sha1
        rekey=yes
        compress=no
        auto=start

pravidlo ve firewallu na stroji left:

 iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to xxx.xxx.xxx.xxx

 tcpdump 
 
 ping na stroj v siti rightsubnet - zzz.zzz.zzz.zzz

 1) ping primo z left - vse OK
 #ping zzz.zzz.zzz.zzz
 64 bytes from zzz.zzz.zzz.zzz: icmp_seq=1 ttl=254 time=15.1 ms

 # tcpdump -i eth1 -n
 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
 listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
 13:55:17.621575 IP xxx.xxx.xxx.xxx > yyy.yyy.yyy.yyy: ESP(spi=0x618b2837,seq=0x1f)
 13:55:17.628497 IP yyy.yyy.yyy.yyy > xxx.xxx.xxx.xxx: ESP(spi=0xd688505a,seq=0x1f)
 13:55:17.628497 IP zzz.zzz.zzz.zzz > xxx.xxx.xxx.xxx: icmp 64: echo reply seq 1
 13:55:18.621786 IP xxx.xxx.xxx.xxx > yyy.yyy.yyy.yyy: ESP(spi=0x618b2837,seq=0x20)
 13:55:18.627393 IP yyy.yyy.yyy.yyy > xxx.xxx.xxx.xxx: ESP(spi=0xd688505a,seq=0x20)
 13:55:18.627393 IP zzz.zzz.zzz.zzz > xxx.xxx.xxx.xxx: icmp 64: echo reply seq 2


 2) ping z pocitace za left - pakety nejdou tunelem
 #ping zzz.zzz.zzz.zzz
 From aaa.aaa.aaa.aaa icmp_seq=1 Packet filtered
 From aaa.aaa.aaa.aaa icmp_seq=2 Packet filtered

 aaa.aaa.aaa.aaa - nejake IP nesouvisejici s tunelem

 # tcpdump -i eth1 -n

 13:56:45.989568 IP xxx.xxx.xxx.xxx > zzz.zzz.zzz.zzz: icmp 64: echo request seq 1
 13:56:46.026350 IP aaa.aaa.aaa.aaa > xxx.xxx.xxx.xxx: icmp 36: host zzz.zzz.zzz.zzz unreachable - admin prohibited filter
 13:56:46.994649 IP xxx.xxx.xxx.xxx > zzz.zzz.zzz.zzz: icmp 64: echo request seq 2
 13:56:47.000502 IP aaa.aaa.aaa.aaa > xxx.xxx.xxx.xxx: icmp 36: host zzz.zzz.zzz.zzz unreachable - admin prohibited filter

Dotaz: zahadny problem s ipsecem