But  even v6 in v4 doesn’t seem to work with NETLINK XFRM interface.





From: Loren M. Lang []
Sent: Friday, January 13, 2012 12:58 PM
To: Prashant Batra (prbatra)
Subject: Re: [Ipsec-tools-devel] ipsec tunnel with different inner and outer ip families


On 1/12/2012 11:11 PM, Prashant Batra (prbatra) wrote:



Does linux 2.6.* support an IPSec tunnel with different family of inner and outer addresses , like v4 in v6 or v6 in v4.

After trying ip xfrm * from user space, the utility doesn’t seem to accept two different families in a single command.

Yes, I've done this in the past, but I took a different approach.  If I recall correctly, I use IPSec in tunnel mode to tunnel IPv6 inside ESP running over IPv4.  I haven't used ip xfrm before, but I did it with setkey and /etc/ipsec.conf with lines like the following:

spdadd ipv6 -P in ipsec esp/transport//require;
spdadd ipv6 -P out ipsec esp/transport//require;

Unfortunately, I'm not in a state to test this right now.


#ip xfrm policy add dir out src dst tmpl src 2001:db8:0:242::36/128 dst 2001:db8:0:242::37/128 proto esp  mode tunnel

Error: an inet prefix is expected rather than "2001:db8:0:242::36/128".


So, I tried sending a NETLINK SPD add message) from user space with, selector as v4 addresses and tmpl as v6 address.

Policy got added but kernel doesn’t seem to be interpreting the addresses correctly.


src dst

        dir out priority 1024

        tmpl    src dst   /* I gave ipv6 addresses here*/

                proto esp spi 0x00000000 reqid 0 mode tunnel


Can someone help me with this?




RSA(R) Conference 2012
Mar 27 - Feb 2
Save $400 by Jan. 27
Register now!

Ipsec-tools-devel mailing list

Loren M. Lang
Public Key:
Fingerprint: 10A0 7AE2 DAF5 4780 888A  3FA4 DCEE BB39 7654 DE5B