Re: Rules for Cisco VPN Client

[Jason Opperisano <opie@817west.com>]

On Thu, Mar 10, 2005 at 10:36:08AM -0400, Tim Evans wrote:
> Anyone have working iptables rules for supporting the Cisco VPN client?  Thanks.

depends how the clients are configured.

you'll always need to allow UDP 500 for IKE.

then depending on the configuration of the clients you would need one
(or some, or all) of the following:

IP Proto 50 (ESP)
UDP 4500 (PIX NAT-T)
UDP 10000 (VPN CON NAT-T 1)
TCP 10000 (VPN CON NAT-T 2)

if the VPN server is a Concentrator--the encapsulation port can be set
to pretty much any arbitrary value--consult with the admin for details.

kitchen sink rules would be:

  iptables -A FORWARD -i $INSIDE_IF -o $OUTSIDE_IF -p 50 \
    -s $INSIDE_NET -d $VPN_GW -j ACCEPT

  iptables -A FORWARD -i $INSIDE_IF -o $OUTSIDE_IF -p udp \
    -s $INSIDE_NET -d $VPN_GW --dport 500 -j ACCEPT

  iptables -A FORWARD -i $INSIDE_IF -o $OUTSIDE_IF -p udp \
    -s $INSIDE_NET -d $VPN_GW --dport 4500 -j ACCEPT

  iptables -A FORWARD -i $INSIDE_IF -o $OUTSIDE_IF -p udp \
    -s $INSIDE_NET -d $VPN_GW --dport 10000 -j ACCEPT

  iptables -A FORWARD -i $INSIDE_IF -o $OUTSIDE_IF -p tcp --syn \
    -s $INSIDE_NET -d $VPN_GW --dport 10000 -j ACCEPT

again--if the TCP/UDP encapsulation port has been changed from the
default, you'd need to accommodate for that as well.

HTH...

-j

--
"Simpson, Homer Simpson, he's the greatest guy in his-tor-y. From
 the town of Springfield, he's about to hit a chestnut tree....D'oh!"
        --The Simpsons