ipsec + nat

ipsec + nat

[Aleksandar Milivojevic]

I have a set of rules in filter table, that after some cleanup look something
like this:

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p esp -s 4.3.2.1 -d 1.2.3.4 -j ACCEPT
-A INPUT -j LOG --log-prefix "INPUT "

-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -p esp -s 1.2.3.4 -d 4.3.2.1 -j ACCEPT
-A OUTPUT -j LOG --log-prefix "OUTPUT "

-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -p icmp --icmp-type ping -s 10.1.2.3 -d 10.3.2.1 -m state --state NEW
-j ACCEPT
-A FORWARD -j LOG --log-prefix "FORWARD "

So far so good.  I can ping 10.3.2.1 from 10.1.2.3 over my IPSec tunnel.

However, if I add MASQUERADE target into nat table:

-A POSTROUTING -o ppp0 -j MASQUERADE

and than try to ping 10.3.2.1, things do not work anymore.  Tcpdump on ppp0
shows (edited for clarity):

   IP 1.2.3.4 > 4.3.2.1 ESP
   IP 4.3.2.1 > 1.2.3.4 ESP
   IP 10.3.2.1 > 10.1.2.3 ICMP echo reply

The log files show that the decrypted packet (ICMP echo reply from 10.3.2.1 to
10.1.2.3) was dropped by Netfilter.  So, the IPSec as such works, it was
Netfilter that blocked the returning packet.  Seems as if Netfilter haven't
placed it into ESTABLISHED state, as it does when NAT rule is not present.

Bug in Netfilter, or bug in my configuration?

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Re: ipsec + nat

[Trevor Cordes]

On Wed, Aug 03, 2005 at 04:12:33PM -0500, Aleksandar Milivojevic wrote:
> 
> and than try to ping 10.3.2.1, things do not work anymore.  Tcpdump on ppp0
> shows (edited for clarity):
> 
> Bug in Netfilter, or bug in my configuration?

Look at my bugzilla on ipsec+nat bugs :

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=143374

see if that's the problem.  If not, shoot me an email and I'll look your
problem over.  If it is the problem, please make noise & cc yourself on
the bugzilla so we can get this fixed.

ipsec nat

[robowarp]

Hi @all
having ppp0 as router web con, the linux router does masq 
and one net to eth1 as intranet (10.10.10.0/24)
one client wants to use ipsec client (gnu version)on windows 2k on
10.10.10.3/24 machine
rightsubnet in ipsec.conf is 130.0.0.12/32
has sombody a example script with iptables wich makes this
possible?
thx and Regards

-- 
+++ GMX - Mail, Messaging & more  http://www.gmx.net +++
Bitte lächeln! Fotogalerie online mit GMX ohne eigene Homepage!

ipsec & nat

[Simpson, Doug]

I have a redhat 7.3 box that is dualhomed.  It is my firewall and vpn
server.  I can successfully vpn (with IPSEC) into it.  If I use the
following command "iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE" I
cannot use VPN, but my internal network can only receive email (POP3) and
telnet after I use this command.
I have set up squid so I proxy my www traffic.
Can I NAT my pop3 and my telnet, and still VPN (IPSEC)?  
I am guessing my command is too general and I need to be more specific -
ports, source, etc defined.
Thanks,
Doug

Re: ipsec & nat

[Marcello Scacchetti]

Hi Doug,
i think your supposition is right, that's too general. Every packet
going out on eth0 will be natted and this is not what you want in case
of ipsec. Packet going out on the newly established vpn tunnel should
NOT be natted in any way. I can suggest you to nat what you really need
to nat so in this way you will get benefits on security side too.
If you know wich ip address will be assigned or are assigned on the
other side of the tunnel you can explicit disable nat on that
destination.

			Marcello


Il mer, 2002-12-11 alle 06:03, Simpson, Doug ha scritto:
> I have a redhat 7.3 box that is dualhomed.  It is my firewall and vpn
> server.  I can successfully vpn (with IPSEC) into it.  If I use the
> following command "iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE" I
> cannot use VPN, but my internal network can only receive email (POP3) and
> telnet after I use this command.
> I have set up squid so I proxy my www traffic.
> Can I NAT my pop3 and my telnet, and still VPN (IPSEC)?  
> I am guessing my command is too general and I need to be more specific -
> ports, source, etc defined.
> Thanks,
> Doug
-- 
Marcello Scacchetti <marcello.scacchetti@nextrem.it>