[prev in list] [next in list] [prev in thread] [next in thread]
List: strongswan-users
Subject: [strongSwan] NAT-T problems and strongswan.
From: s.a.deheer () sr-solutions ! nl (S ! A ! de Heer)
Date: 2004-05-06 23:46:29
Message-ID: 005401c433b3$69123520$2202a8c0 () lapdog
[Download RAW message or body]
Found the answer to my own problem.
Using left=%defaultroute and interfaces=%defaultroute solved my problem on
the right side.
Now I have a working connection between the servers.
Thanks so far for all the help.
Greetings,
S.A. de Heer
----- Original Message -----
From: "S.A. de Heer" <s.a.deheer@sr-solutions.nl>
To: "Andreas Steffen" <andreas.steffen@strongsec.net>
Cc: <users@lists.strongswan.org>
Sent: Thursday, May 06, 2004 11:30 PM
Subject: Re: [strongSwan] NAT-T problems and strongswan.
>
>
> I added the following to the right side:
> left = % any and leftsubnetwithin = %any
> The result of this is the message:
> packet from 82.161.xx.138:500: initial Main Mode message received on
> 217.63.xx.48:500 but no connection has been authorized.
> When I tried left=%any and lefsubnetwithin = 192.168.0.0/24
>
> There seems to be a strange route add by strongswan during the connection
> process.
>
> This was the result.
>
> May 6 23:22:13 sv1 pluto[11784]: packet from 82.161.xx.138:500: received
> Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
> May 6 23:22:13 sv1 pluto[11784]: packet from 82.161.xx.138:500: ignoring
> Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
> May 6 23:22:13 sv1 pluto[11784]: packet from 82.161.xx.138:500: ignoring
> Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
> May 6 23:22:13 sv1 pluto[11784]: "sv11-sv1.42384"[1] 82.161.xx.138 #1:
> responding to Main Mode from unknown peer 82.161.xx.138
> May 6 23:22:13 sv1 pluto[11784]: "sv11-sv1.42384"[1] 82.161.xx.138 #1:
> NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is
NATed
> May 6 23:22:13 sv1 pluto[11784]: "sv11-sv1.42384"[1] 82.161.xx.138 #1:
Peer
> ID is ID_FQDN: '@sv11.xx.qlict.nl'
> May 6 23:22:13 sv1 pluto[11784]: | NAT-T: new mapping
> 82.161.xx.138:500/4500)
> May 6 23:22:13 sv1 pluto[11784]: "sv11-sv1.42384"[1] 82.161.xx.138:4500
#1:
> sent MR3, ISAKMP SA established
> May 6 23:22:13 sv1 pluto[11784]: "sv11-sv1.42384"[1] 82.161.xx.138:4500
#2:
> responding to Quick Mode
> May 6 23:22:13 sv1 pluto[11784]: "sv11-sv1.42384"[1] 82.161.xx.138:4500
#2:
> route-host output: RTNETLINK answers: Network is unreachable
> May 6 23:22:13 sv1 pluto[11784]: "sv11-sv1.42384"[1] 82.161.xx.138:4500
#2:
> route-host output: /usr/lib/ipsec/_updown: `ip route add 192.168.0.11/32
via
> 82.161.xx.138 dev ipsec0' failed
> May 6 23:22:13 sv1 pluto[11784]: "sv11-sv1.42384"[1] 82.161.xx.138:4500
#2:
> route-host command exited with status 2
> May 6 23:22:23 sv1 pluto[11784]: "sv11-sv1.42384"[1] 82.161.xx.138:4500
#2:
> route-host output: RTNETLINK answers: Network is unreachable
> May 6 23:22:23 sv1 pluto[11784]: "sv11-sv1.42384"[1] 82.161.xx.138:4500
#2:
> route-host output: /usr/lib/ipsec/_updown: `ip route add 192.168.0.11/32
via
> 82.161.xx.138 dev ipsec0' failed
> May 6 23:22:23 sv1 pluto[11784]: "sv11-sv1.42384"[1] 82.161.xx.138:4500
#2:
> route-host command exited with status 2
> May 6 23:22:24 sv1 pluto[11784]: ERROR: "sv11-sv1.42384"[1]
> 82.161.xx.138:4500 #2: pfkey write() of SADB_DELETE message 22 for Delete
SA
> esp.7f7adad0@217.63.xx.48 failed. Errno 3: No such process
> May 6 23:22:24 sv1 pluto[11784]: | 02 04 00 03 0b 00 00 00 16 00 00
00
> 08 2e 00 00
> May 6 23:22:24 sv1 pluto[11784]: | 03 00 01 00 7f 7a da d0 00 01 00
00
> 00 00 00 00
> May 6 23:22:24 sv1 pluto[11784]: | ff ff ff ff 00 00 00 00 03 00 05
00
> 00 00 00 00
> May 6 23:22:24 sv1 pluto[11784]: | 02 00 00 00 52 a1 4f 8a 00 00 00
00
> 00 00 00 00
> May 6 23:22:24 sv1 pluto[11784]: | 03 00 06 00 00 00 00 00 02 00 00
00
> d9 3f 0e 30
> May 6 23:22:24 sv1 pluto[11784]: | 00 00 00 00 00 00 00 00
> May 6 23:22:43 sv1 pluto[11784]: "sv11-sv1.42384"[1] 82.161.xx.138:4500
#2:
> route-host output: RTNETLINK answers: Network is unreachable
> May 6 23:22:43 sv1 pluto[11784]: "sv11-sv1.42384"[1] 82.161.xx.138:4500
#2:
> route-host output: /usr/lib/ipsec/_updown: `ip route add 192.168.0.11/32
via
> 82.161.xx.138 dev ipsec0' failed
> May 6 23:22:43 sv1 pluto[11784]: "sv11-sv1.42384"[1] 82.161.xx.138:4500
#2:
> route-host command exited with status 2
>
> ----- Original Message -----
> From: "Andreas Steffen" <andreas.steffen@strongsec.net>
> To: "S.A. de Heer" <s.a.deheer@sr-solutions.nl>
> Cc: <users@lists.strongswan.org>
> Sent: Thursday, May 06, 2004 11:09 PM
> Subject: Re: [strongSwan] NAT-T problems and strongswan.
>
>
> > An assertion occurred:
> >
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2: ASSERTION
FAILED
> at
> > > kernel.c:2276: c->kind == CK_PERMANENT || c->kind == CK_INSTANCE
> >
> > It seems that you must use the leftsubnetwithin= wildcard definition
> > in combination with a roadwarrior connection left=%any.
> >
> > Regards
> >
> > Andreas
> >
> > S.A. de Heer wrote:
> >
> > > Hello Andreas,
> > >
> > > I followed your suggestion but its results where not correct. With the
> first
> > > option using leftsubnet=192.168.0.11/32 on the right machine resulted
in
> the
> > > same errors. When I tried the leftsubnetwitin option I got the
following
> > > response, so anymore ideas are welcome.
> > >
> > > May 6 22:38:52 sv1 pluto[11058]: packet from 82.161.xx.138:500:
> ignoring
> > > Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
> > > May 6 22:38:52 sv1 pluto[11058]: "sv11-sv1.42384" #1: responding to
> Main
> > > Mode
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #1: NAT-Traversal:
> Result
> > > using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #1: Peer ID is
> ID_FQDN:
> > > '@sv11.xx.qlict.nl'
> > > May 6 22:38:53 sv1 pluto[11058]: | NAT-T: new mapping
> > > 82.161.xx.138:500/4500)
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #1: sent MR3,
ISAKMP
> SA
> > > established
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2: responding to
> Quick
> > > Mode
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2: ASSERTION
FAILED
> at
> > > kernel.c:2276: c->kind == CK_PERMANENT || c->kind == CK_INSTANCE
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2: interface
> ipsec0/eth0
> > > 217.63.14.48
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2: interface
> ipsec0/eth0
> > > 217.63.14.48
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2: %myid = (none)
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2: debug none
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
> "sv1.42383-42384":
> > >
>
10.0.1.0/24===217.63.14.48[@sv1.42384.ip.nltree.nl]---217.63.xx.1...212.178.
> > > xx.97---212.178.xx.120[@sv1.42383.ip.nltree.nl]===10.0.0.0/24;
unrouted;
> > > eroute owner: #0
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
> "sv1.42383-42384":
> > > ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz:
> 100%;
> > > keyingtries: 0
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
> "sv1.42383-42384":
> > > policy: RSASIG+ENCRYPT+TUNNEL+PFS; prio: 24,24; interface: eth0;
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
> "sv1.42383-42384":
> > > newest ISAKMP SA: #0; newest IPsec SA: #0;
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
> "sv1.42383-42384":
> > > IKE algorithms wanted: 5_000-1-5, 5_000-2-5, 5_000-1-2, 5_000-2-2,
> > > flags=-strict
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
> "sv1.42383-42384":
> > > IKE algorithms found: 5_192-1_128-5, 5_192-2_160-5, 5_192-1_128-2,
> > > 5_192-2_160-2,
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
> "sv1.42383-42384":
> > > ESP algorithms wanted: 3_000-1, 3_000-2, flags=-strict
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
> "sv1.42383-42384":
> > > ESP algorithms loaded: 3_168-1_128, 3_168-2_160,
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
"sv11-sv1.42384":
> > >
>
217.63.xx.48:4500[@sv1.42384.xx.nl]...82.161.xx.137---82.161.xx.138:4500[@sv
> > > 11.xx.qlict.nl]===192.168.0.11/32; unrouted; eroute owner: #0
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
"sv11-sv1.42384":
> > > ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz:
> 100%;
> > > keyingtries: 0
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
"sv11-sv1.42384":
> > > policy: RSASIG+ENCRYPT+TUNNEL+PFS; prio: 32,24; interface: eth0;
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
"sv11-sv1.42384":
> > > newest ISAKMP SA: #1; newest IPsec SA: #0;
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
"sv11-sv1.42384":
> > > IKE algorithms wanted: 5_000-1-5, 5_000-2-5, 5_000-1-2, 5_000-2-2,
> > > flags=-strict
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
"sv11-sv1.42384":
> > > IKE algorithms found: 5_192-1_128-5, 5_192-2_160-5, 5_192-1_128-2,
> > > 5_192-2_160-2,
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
"sv11-sv1.42384":
> > > IKE algorithm newest: 3DES_CBC_192-MD5-MODP1536
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
"sv11-sv1.42384":
> > > ESP algorithms wanted: 3_000-1, 3_000-2, flags=-strict
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
"sv11-sv1.42384":
> > > ESP algorithms loaded: 3_168-1_128, 3_168-2_160,
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2: #2:
> "sv11-sv1.42384"
> > > (null) ((null)); EVENT_SO_DISCARD in 0s
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2: #1:
> "sv11-sv1.42384"
> > > STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in
> 3330s;
> > > newest ISAKMP
> > > May 6 22:38:53 sv1 pluto[11058]: "sv11-sv1.42384" #2:
> > >
> > > May 6 22:39:05 sv1 ipsec__plutorun: Restarting Pluto subsystem...
> > > May 6 22:39:05 sv1 pluto[11297]: Starting Pluto (strongSwan Version
> 2.0.2
> > > X.509-1.5.4 PLUTO_USES_KEYRR)
> > > May 6 22:39:05 sv1 pluto[11297]: including NAT-Traversal patch
> (Version
> > > 0.6c)
> > > May 6 22:39:05 sv1 pluto[11297]: ike_alg_register_enc(): Activating
> > > OAKLEY_AES_CBC: Ok (ret=0)
> > > May 6 22:39:05 sv1 pluto[11297]: ike_alg_register_enc(): Activating
> > > OAKLEY_BLOWFISH_CBC: Ok (ret=0)
> > > May 6 22:39:05 sv1 pluto[11297]: ike_alg_register_enc(): Activating
> > > OAKLEY_SERPENT_CBC: Ok (ret=0)
> > > May 6 22:39:05 sv1 pluto[11297]: ike_alg_register_hash(): Activating
> > > OAKLEY_SHA2_256: Ok (ret=0)
> > > May 6 22:39:05 sv1 pluto[11297]: ike_alg_register_hash(): Activating
> > > OAKLEY_SHA2_512: Ok (ret=0)
> > > May 6 22:39:05 sv1 pluto[11297]: ike_alg_register_enc(): Activating
> > > OAKLEY_TWOFISH_CBC: Ok (ret=0)
> > > May 6 22:39:05 sv1 pluto[11297]: ike_alg_register_enc(): Activating
> > > OAKLEY_SSH_PRIVATE_65289: Ok (ret=0)
> > > May 6 22:39:05 sv1 pluto[11297]: Using KLIPS IPsec interface code
> > > May 6 22:39:05 sv1 pluto[11297]: Changing to directory
> > > '/etc/ipsec.d/cacerts'
> > > May 6 22:39:05 sv1 pluto[11297]: Changing to directory
> > > '/etc/ipsec.d/aacerts'
> > > May 6 22:39:05 sv1 pluto[11297]: Changing to directory
> > > '/etc/ipsec.d/ocspcerts'
> > > May 6 22:39:05 sv1 pluto[11297]: Changing to directory
> '/etc/ipsec.d/crls'
> > > May 6 22:39:05 sv1 pluto[11297]: | from whack: got --esp=3des
> > > May 6 22:39:05 sv1 pluto[11297]: | from whack: got --ike=3des
> > > May 6 22:39:05 sv1 pluto[11297]: added connection description
> > > "sv11-sv1.42384"
> > > May 6 22:39:06 sv1 pluto[11297]: | from whack: got --esp=3des
> > > May 6 22:39:06 sv1 pluto[11297]: | from whack: got --ike=3des
> > > May 6 22:39:06 sv1 pluto[11297]: added connection description
> > > "sv1.42383-42384"
> > > May 6 22:39:06 sv1 pluto[11297]: listening for IKE messages
> > > May 6 22:39:06 sv1 pluto[11297]: adding interface ipsec0/eth0
> 217.63.xx.48
> > > May 6 22:39:06 sv1 pluto[11297]: adding interface ipsec0/eth0
> > > 217.63.xx.48:4500
> > > May 6 22:39:06 sv1 pluto[11297]: loading secrets from
> "/etc/ipsec.secrets"
> > > May 6 22:39:23 sv1 pluto[11297]: packet from 82.161.xx.138:4500:
Quick
> Mode
> > > message is for a non-existent (expired?) ISAKMP SA
> > >
> > > ----- Original Message -----
> > > From: "Andreas Steffen" <andreas.steffen@strongsec.net>
> > > To: "S.A. de Heer" <s.a.deheer@sr-solutions.nl>
> > > Cc: <users@lists.strongswan.org>
> > > Sent: Thursday, May 06, 2004 6:35 PM
> > > Subject: Re: [strongSwan] NAT-T problems and strongswan.
> > >
> > >
> > >
> > >>The error message
> > >>
> > >> > "sv11-sv1.42384" #1: cannot respond to IPsec SA request
> > >> > because no connection is known for
> > >> > 217.63.xx.48:4500[@sv1.42384.xx.nl]...
> > >> > 82.161.xx.138:4500[@sv11.xx.qlict.nl]===192.168.0.11/32
> > >>
> > >>must be taken literally. Your connection definition is
> > >>
> > >> > conn sv11-sv1.42348
> > >> > authby=rsasig
> > >> > auth=esp
> > >> > right= 217.63.xx.48
> > >> > rightid=@sv1.42384.xx.nl
> > >> > rightrsasigkey=aaaaa
> > >> > left=82.161.xx.138
> > >> > leftnexhop=82.161.xx.137
> > >> > leftrsasigkey=asdasdasd
> > >> >
> > >>due to NAT the outer IP address differs from the inner IP
> > >>address. Therefore you must add the line
> > >>
> > >>leftsubnet=192.168.0.11/32
> > >>
> > >>or
> > >>
> > >>leftsubnetwithin=192.168.0.0/16
> > >>
> > >>I am not familiar with Mathieu Lafon's virtual_private=
> > >>notation because I've never used it.
> > >>
> > >>Regards
> > >>
> > >>Andreas
> > >>
> > >>S.A. de Heer wrote:
> > >>
> > >>>Hello,
> > >>>
> > >>>My setup stops in STATE_QUICK_I1.
> > >>>
> > >>>My network layout is this:
> > >>>
> > >>>LEFT
> > >>>RIGHT
> > >>>Linux server Linux Gateway Internet
> > >
> > > Linux
> > >
> > >>>server
> > >>>192.168.0.11 ---- 192.168.0.1
> > >
> > > Public
> > >
> > >>>IP address
> > >>> NAT to 82.161.xx.138 -------
> > >>>217.63.xx.48
> > >>>
> > >>>Both linux servers are running strongswan 2.0.2
> > >>>
> > >>>My configuration is as on the right side:
> > >>>config setup
> > >>> interfaces"ipsec=eth0"
> > >>> nat_traversal = yes
> > >>> virtual_private = %v:192.168.0.0/24
> > >>>
> > >>>conn sv11-sv1.42348
> > >>> authby=rsasig
> > >>> auth=esp
> > >>> right= 217.63.xx.48
> > >>> rightid=@sv1.42384.xx.nl
> > >>> rightrsasigkey=aaaaa
> > >>> left=82.161.xx.138
> > >>> leftnexhop=82.161.xx.137
> > >>> leftrsasigkey=asdasdasd
> > >>>
> > >>>On the left side i have:
> > >>>
> > >>>config setup
> > >>> interfaces=%defaultroute
> > >>> nat_traversal = yes
> > >>> virtual_private = %v:192.168.0.0/24
> > >>>
> > >>>conn left-right
> > >>> authby=rsasig
> > >>> auth=esp
> > >>> right=217.63.xx.48
> > >>> rightid=@sv1.42384.xx.nl
> > >>> rightrsasigkey=aaaaa
> > >>> left= 192.168.0.11
> > >>> leftnexhop= 192.168.0.1
> > >>> leftrsasigkey=asdasdasd
> > >>>
> > >>>I start the connection from the linux server on the left side. Which
> > >
> > > results
> > >
> > >>>in the following output
> > >>>in the logs of the right side:
> > >>>
> > >>>May 6 16:06:03 sv1 pluto[8949]: packet from 82.161.xx.138:500:
> received
> > >>>Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
> > >>>May 6 16:06:03 sv1 pluto[8949]: packet from 82.161.xx.138:500:
> ignoring
> > >>>Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
> > >>>May 6 16:06:03 sv1 pluto[8949]: packet from 82.161.xx.138:500:
> ignoring
> > >>>Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
> > >>>May 6 16:06:03 sv1 pluto[8949]: "sv11-sv1.42384" #1: responding to
> Main
> > >>>Mode
> > >>>May 6 16:06:03 sv1 pluto[8949]: "sv11-sv1.42384" #1: NAT-Traversal:
> > >
> > > Result
> > >
> > >>>using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
> > >>>May 6 16:06:03 sv1 pluto[8949]: "sv11-sv1.42384" #1: Peer ID is
> > >
> > > ID_FQDN:
> > >
> > >>>'@sv11.xx.qlict.nl'
> > >>>May 6 16:06:03 sv1 pluto[8949]: | NAT-T: new mapping
> > >>>82.161.xx.138:500/4500)
> > >>>May 6 16:06:03 sv1 pluto[8949]: "sv11-sv1.42384" #1: sent MR3,
ISAKMP
> > >
> > > SA
> > >
> > >>>established
> > >>>May 6 16:06:03 sv1 pluto[8949]: "sv11-sv1.42384" #1: cannot respond
to
> > >>>IPsec SA request because no connection is known for
> > >>>
> > >
> > >
>
217.63.xx.48:4500[@sv1.42384.xx.nl]...82.161.xx.138:4500[@sv11.xx.qlict.nl]=
> > >
> > >>>==192.168.0.11/32
> > >>>May 6 16:06:03 sv1 pluto[8949]: "sv11-sv1.42384" #1: sending
encrypted
> > >>>notification INVALID_ID_INFORMATION to 82.161.xx.138:4500
> > >>>May 6 16:06:13 sv1 pluto[8949]: "sv11-sv1.42384" #1: Quick Mode I1
> > >
> > > message
> > >
> > >>>is unacceptable because it uses a previously used Message ID
0x4730b741
> > >>>(perhaps this is a duplicated packet)
> > >>>May 6 16:06:13 sv1 pluto[8949]: "sv11-sv1.42384" #1: sending
encrypted
> > >>>notification INVALID_MESSAGE_ID to 82.161.79.138:4500
> > >>>
> > >>>Any help is welcome.
> > >>>
> > >>>Greetings,
> > >>>
> > >>>Sjoerd
> >
> > =======================================================================
> > Andreas Steffen e-mail: andreas.steffen@strongsec.com
> > strongSec GmbH home: http://www.strongsec.com
> > Alter Z?richweg 20 phone: +41 1 730 80 64
> > CH-8952 Schlieren (Switzerland) fax: +41 1 730 80 65
> > ==========================================[strong internet security]===
> >
>
> _______________________________________________
> Users mailing list
> Users@lists.strongswan.org
> http://lists.strongswan.org/mailman/listinfo/users
>
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic