I have a FreeBSD 7.3 server and I configured IPsec on it but now I need to put my server behind a NAT. I know in order to using NAT I should add IPsec_NAT_T to my kernel but the problem is IPsec_NAT_T is not built in and I must add patch to my kernel.

How can I do that?


You have already figured out that you need to patch your kernel sources as you have a very old version. Never versions already have the option. And I think that -current (what will become 12) have deprecated the option and supports NAT-T by default.

So you need to figure out what kernel source version you have locally and are building from. When you know that then you can look for a patch-set which matches your sources.

Earlier versions seems to be here:



I found two later versions here (but no directory listing):

http://people.freebsd.org/~bz/20110123-01-stable7-natt.diff http://people.freebsd.org/~bz/20110603-02-stable7-natt.diff

I would try the latest version first. Make a copy of your sources and use the patch command. If it applies cleanly to your 7.3 sources you should be good to go. When the patches have been applied follow the steps for recompiling your kernel.

For your purpose you need to enable these:

options   IPSEC
device    crypto
options   IPSEC_NAT_T

You can find the steps in the FreeBSD Handbook

If the patch does not apply cleanly then look for other patchsets. The patches are fairly simple so it might be easier to add them manually. If you do not know how to do this - then you are much much better off upgrading your system. The pain of upgrading will be far lesser than learning how to program C to adapt the code :-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.