-----Original Message-----
From: Andrew Beverley [mailto:andy@andybev.com] 
Sent: Tuesday, January 31, 2012 11:18 PM
To: Prashant Batra (prbatra)
Cc: netdev@vger.kernel.org
Subject: Re: IP forwarding on a linux IPSec gateway

On Fri, 2012-01-27 at 15:31 +0530, Prashant Batra (prbatra) wrote:

So, it's clear that linux gateway is able to protect the data and send
to the connected gateway (ESP packets to outer IPs). And the second
gateway is responding with ESP packet which is decoded on linux gateway
and sent to the ip stack again by linux kernel (ICMP reply). But the
reply doesn't reach the host on left subnet.

Didn't somebody else have a similar problem recently? He found that it
worked using one internet provider but not another. If you're not seeing
anything received in tcpdump in the left subnet, then I would suspect
that the packet is getting lost in the WAN somewhere. What happens when
you ping in the other direction?
[Prashant] Hi Andy,

Thanks, for the reply, but I got it to work by adding "fwd" policy, after investigating some stats in proc.

Now, I am facing another issue with 2.6.38 kernel, when it started working on 2.6.34 kernel.  
Any links to understand the flow in the kernel for this kind of forwarding with IPSec to analyze where the problem could be
will be really helpful.

Andy