I rebuilt your setup but can't reproduce the problem.
I picked A.A.A.A=3.3.3.3 and B.B.B.B=4.4.4.4 and used FreeBSD 8.3-STABLE
i386 with GENERIC plus IPSEC, and installed ipsec-tools-0.8.0_3.
------------------------------ gatewayA ------------------------------
/etc/rc.conf
ifconfig_em0="inet 1.1.1.254 netmask 255.255.255.0"
ifconfig_em1="inet 3.3.3.3 netmask 255.255.255.0"
gif_interfaces="gif0"
gifconfig_gif0="3.3.3.3 4.4.4.4"
ifconfig_gif0="1.1.1.254 2.2.2.254 netmask 255.255.255.0"
defaultrouter="3.3.3.1"
static_routes="gif"
route_gif="-net 2.2.2.0/24 2.2.2.254"
gateway_enable="YES"
racoon_enable="YES"
pf_enable="YES"
# ifconfig gif0
gif0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1280
tunnel inet 3.3.3.3 --> 4.4.4.4
inet 1.1.1.254 --> 2.2.2.254 netmask 0xffffff00
options=1<ACCEPT_REV_ETHIP_VER>
# netstat -anr
Destination Gateway Flags Refs Use Netif Expire
default 3.3.3.1 UGS 0 1948 em1
1.1.1.0/24 link#1 U 0 1270 em0
1.1.1.254 link#1 UHS 1 0 lo0
2.2.2.0/24 2.2.2.254 UGS 0 1873 gif0
2.2.2.254 link#5 UH 0 39 gif0
3.3.3.0/24 link#2 U 0 0 em1
3.3.3.3 link#2 UHS 0 0 lo0
127.0.0.1 link#4 UH 0 0 lo0
/etc/pf.conf is a simple (and identical on gatewayB)
set state-policy if-bound
set skip on { lo }
scrub in log all fragment reassemble
block log
pass
# pfctl -ss
em0 icmp 2.2.2.2:25352 <- 1.1.1.1 0:0
em1 esp 3.3.3.3 -> 4.4.4.4 MULTIPLE:MULTIPLE
/usr/local/etc/racoon/psk.txt
4.4.4.4 topsecret
/usr/local/etc/racoon/ipsec.conf
flush;
spdflush;
spdadd 1.1.1.0/24 2.2.2.0/24 any -P out ipsec esp/tunnel/3.3.3.3-4.4.4.4/use;
spdadd 2.2.2.0/24 1.1.1.0/24 any -P in ipsec esp/tunnel/4.4.4.4-3.3.3.3/use;
/usr/local/etc/racoon/racoon.conf
(exact copy of handbook example, only differences:)
listen
isakmp 3.3.3.3 [500];
isakmp_natt 3.3.3.3 [4500];
remote 4.4.4.4 [500]
my_identifier address 3.3.3.3;
peers_identifier address 4.4.4.4;
sainfo (address 1.1.1.0/24 any address 2.2.2.0/24 any)
------------------------------ gatewayB ------------------------------
ifconfig_em0="inet 2.2.2.254 netmask 255.255.255.0"
ifconfig_em1="inet 4.4.4.4 netmask 255.255.255.0"
gif_interfaces="gif0"
gifconfig_gif0="4.4.4.4 3.3.3.3"
ifconfig_gif0="2.2.2.254 1.1.1.254 netmask 255.255.255.0"
defaultrouter="4.4.4.1"
static_routes="gif"
route_gif="-net 1.1.1.0/24 1.1.1.254"
gateway_enable="YES"
racoon_enable="NO"
pf_enable="YES"
# ifconfig gif0
gif0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1280
tunnel inet 4.4.4.4 --> 3.3.3.3
inet 2.2.2.254 --> 1.1.1.254 netmask 0xffffff00
options=1<ACCEPT_REV_ETHIP_VER>
# netstat -anr
Destination Gateway Flags Refs Use Netif Expire
default 4.4.4.1 UGS 0 2066 em1
1.1.1.0/24 1.1.1.254 UGS 0 2023 gif0
1.1.1.254 link#5 UH 0 0 gif0
2.2.2.0/24 link#1 U 0 1984 em0
2.2.2.254 link#1 UHS 1 0 lo0
4.4.4.0/24 link#2 U 0 0 em1
4.4.4.4 link#2 UHS 0 0 lo0
127.0.0.1 link#4 UH 0 0 lo0
# pfctl -ss
em1 esp 4.4.4.4 <- 3.3.3.3 MULTIPLE:MULTIPLE
em0 icmp 1.1.1.1:25352 -> 2.2.2.2 0:0
/usr/local/etc/racoon/psk.txt
3.3.3.3 topsecret
/usr/local/etc/racoon/ipsec.conf
flush;
spdflush;
spdadd 2.2.2.0/24 1.1.1.0/24 any -P out ipsec esp/tunnel/4.4.4.4-3.3.3.3/use;
spdadd 1.1.1.0/24 2.2.2.0/24 any -P in ipsec esp/tunnel/3.3.3.3-4.4.4.4/use;
/usr/local/etc/racoon/racoon.conf
listen
isakmp 4.4.4.4 [500];
isakmp_natt 4.4.4.4 [4500];
remote 3.3.3.3 [500]
my_identifier address 4.4.4.4;
peers_identifier address 3.3.3.3;
sainfo (address 2.2.2.0/24 any address 1.1.1.0/24 any)
------------------------------ router ------------------------------
When I ping from gatewayB to 1.1.1.1 (or from 1.1.1.1 to 2.2.2.2),
I see only encrypted packets:
13:23:52.800285 IP (tos 0x0, ttl 63, id 6391, offset 0, flags [none], proto ESP
(50), length 136)
4.4.4.4 > 3.3.3.3: ESP(spi=0x016bdbe7,seq=0x5e), length 116
13:23:52.801401 IP (tos 0x0, ttl 64, id 5827, offset 0, flags [none], proto ESP
(50), length 136)
3.3.3.3 > 4.4.4.4: ESP(spi=0x04049e8b,seq=0x5e), length 116
13:23:53.820296 IP (tos 0x0, ttl 63, id 6394, offset 0, flags [none], proto ESP
(50), length 136)
4.4.4.4 > 3.3.3.3: ESP(spi=0x016bdbe7,seq=0x5f), length 116
13:23:53.821230 IP (tos 0x0, ttl 64, id 5829, offset 0, flags [none], proto ESP
(50), length 136)
3.3.3.3 > 4.4.4.4: ESP(spi=0x04049e8b,seq=0x5f), length 116
There must be something in your setup that causes the difference.
If there's a non-trivial pf.conf, maybe try with a trivial one first.
Kind regards,
Daniel
