3 ms·
"fine" with NAT is a bit of an overstatement, I don't think anyone who has seriously interacted with IPSEC would call it anything but a gigantic pain in the ass
by throwaway2048 7y ago
"fine" with NAT is a bit of an overstatement, I don't think anyone who has seriously interacted with IPSEC would call it anything but a gigantic pain in the ass
- vbezhenar 7y agoI'm not "seriously" interacted, but I have VPN server and I'm using it on all devices in my hope (laptop, PC, phone) which are behind WiFi NAT. They work just fine. I'm using strongswan and IKEv2 on server.
- throwaway2048 7y agoYour NAT behaves and likely has (working) IPSEC ALG stuff, plenty of setups don't.
- GhettoMaestro 7y agoBullshit. If you don't have ALG/fix-ups for FTP, IPSec, etc your device sucks.
- wahern 7y agoMore likely is that both ends are using IPSec NAT-T (https://tools.ietf.org/html/rfc3947 https://tools.ietf.org/html/rfc3947), which has been widely supported for some time. NAT-T encapsulates IP packets inside UDP, with the IKE daemons (usually) as the UDP endpoints.
- throwaway2048 7y agoNAT-T is unfortunately not very reliable.