Re: VPN over netfilter NAT

["John A. Sullivan III" <jsullivan@opensourcedevelopmentcorp.com>]

On Thu, 2004-09-16 at 07:36, Alexandros Papadopoulos wrote:
> I stumbled across 
> http://www.linuxhomenetworking.com/linux-adv/vpn-linux.htm today, which 
> states that "NAT breaks VPNs".
> 
> Is this just an over-simplifying statement that really means "if you're 
> reading this, then don't even try setting up a NAT-traversing VPN"?
> 
> This is exactly what I'm planning to do; I've got my mind set on having 
> the two VPN endpoints inside two NATed networks, both managed by 
> respective dedicated linux boxes running only netfilter.
> 
> If that is indeed possible (and doable for a first timer), could anyone 
> provide some relevant pointers to documentation?
> 
> Cheers
> 
> -A
There is quite a bit of (somewhat dated) information about using these
technologies together in the training section at
http://iscs.sourceforge.net 

One can use IPSec and NAT but with some caveats.  The simplest way is if
you can arrange for a one-to-one NAT so that the public address is fixed
and unique.

If you must do NAPT, i.e., many-to-one - port address translation, then
you can use NAT Traversal.  However, this will work for outbound
initiated connections only.  The initiating point needs to find the
other end point.  So, for example, one can use NAT-T for ones mobile
users but it would be near impossible to do so for the gateway to which
they connect.  I have never tried port-mapping a VPN gateway and have no
idea if that would work.

Good luck with it - John
-- 
John A. Sullivan III
Open Source Development Corporation
Financially sustainable open source development
http://www.opensourcedevel.com