Re: Iptables, nat, and IPSec

[Daniel Lopes <lopsch@lopsch.com>]

dave beach schrieb:
>  > It´s an IPSec problem. I don´t want to go into detail but you probably
> should try NAT-Traversal.
>  > For the theory http://www.ipsec-howto.org/x180.html
> 
> Okay, I've read the reference. If I understand correctly, I need to use a
> NAT methodology that implements "NAT Traversal" (the reference is a little
> vague on this; in fairness, it does say "There are no RFCs at the moment").
> It might be therefore fair to say that the Linksys implementation includes
> NAT Traversal, enabling it to handle multiple IPSec passthrough connections.
> 
> Which leads me to what I suppose was the original question, now slightly
> modified: does iptables support NAT Traversal?
> 
> 
from the webpage:
"What does NAT traversal do to help? NAT-traversal again encapsulates 
the ESP packets in UDP packets. These can easily be handled by a NAT 
device since they provide ports."

So you have to activate on your clients the NAT-T "feature" and be sure 
the other side supports it too.

And to answer your question, yes every NAT device should be able to 
handle multiple IPSec NAT-Ted connections because they are wrapped 
within UDP packets and so every connection can be tracked. Essentially 
is that both sides which use IPSec are aware of NAT-T and it is 
correctly configured.