Re: linux-ipsec: IPSec & NAT

> I would appreciate your thoughts on NAT and IPSec...

It seems to me that the bottom line is that IPSEC's job is to make packets unintelligible and unalterable, and NAT absolutely relies on being able to understand packets and make helpful modifications to them en route. The two are basically not compatible.

The fundamental incompatibility means that you just don't get end-to-end IPSEC through NAT gateways. However, a NAT gateway could easily double as a security gateway, and could even have IPSEC connections to the hosts it is gatewaying for. But it's got to be able to take the IPSEC wrappings off the packets momentarily so that it can do NAT.

                                                          Henry Spencer
                                                       henry@spsystems.net
                                                     (henry@zoo.toronto.edu)