Linux firewall + NAT Traversal + IPsec

Linux firewall + NAT Traversal + IPsec

[John Mok]

Hi,

I'm new to Linux. Is it possible make a Linux box with firewall + NAT, 
such that client PC(s) from the NATed internal network could connect to 
a VPN gateway on the Internet :-

 client PC ----- Linux iptables firewall + NAT ---- Internet ---- IPsec 
VPN gateway
192.168.x.x/16                                              (e.g. 
Checkpoint FW-1)
(VPN client)

I hope someone could help to advise what software / kernel patch is 
required on the Linux box to NAT traversal work and where to get the 
HOWTO(s)?

Thanks a lot.

John Mok

RE: Linux firewall + NAT Traversal + IPsec

[Sietse van Zanen]

 As far as I know, you would not need anything on the Linux box.

It will all depend on whether the clients and server IPSEC implementation
support IPSEC NAT T(raversal).

Microsofts IPSEC implementation does. But has some drawbacks.

-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of John Mok
Sent: 07 April 2005 19:50
To: netfilter@lists.netfilter.org
Subject: Linux firewall + NAT Traversal + IPsec

Hi,

I'm new to Linux. Is it possible make a Linux box with firewall + NAT, such
that client PC(s) from the NATed internal network could connect to a VPN
gateway on the Internet :-

 client PC ----- Linux iptables firewall + NAT ---- Internet ---- IPsec VPN
gateway
192.168.x.x/16                                              (e.g. 
Checkpoint FW-1)
(VPN client)

I hope someone could help to advise what software / kernel patch is required
on the Linux box to NAT traversal work and where to get the HOWTO(s)?

Thanks a lot.

John Mok

Re: Linux firewall + NAT Traversal + IPsec

[Taylor, Grant]

If I understood John correctly he is wanting to use his Linux IPSec firewall
/ NAT router as one end of the IPSec VPN tunnel.  If that is indeed the case
then yes Linux can be configured to do so.  You will need to look at
FreeS/WAN (dyeing / defunct (as I know it)) and / or OpenS/WAN (alive and
kicking very strongly).  There are some interoprability incompatabilities
between different IPSec implementations between FreeS/WAN / OpenS/WAN and
other vendor's IPSec VPN products.  I personaly know that I have gotten
OpenS/WAN (version unknown at the moment) to work with Linksys BFEVP41
(first version) routers as long as I keep a ping flowing through the VPN.



Grant. . . .

> As far as I know, you would not need anything on the Linux box.
>
> It will all depend on whether the clients and server IPSEC implementation
> support IPSEC NAT T(raversal).
>
> Microsofts IPSEC implementation does. But has some drawbacks.