iptables and SPI

iptables and SPI

[dimitri borjac]

sorry to disturb all of you once more... and thank you Julian for your first 
answer...

but actually i think i wasn't clear enough in my last mail : is it possible 
to use iptables in order to NAT different VPN established between different 
NATted hosts and 1 remote gateway (the same gateway for all of them) ?  Such 
a NAT would be made by watching both addresses, ports and SPIs...

In other words :  is it possible for iptables to go and check the SPI field 
in the ESP Header of the IPsec packet in ESP tunnel mode ?

Hope i make me more clear this time :)
Thanks in advance !

Dimo

_________________________________________________________________
Hotmail : un compte GRATUIT qui vous suit partout et tout le temps ! 
http://g.msn.fr/FR1000/9493

Re: iptables and SPI

[Julian Gomez]

On Wed, Oct 22, 2003 at 01:26:59PM +0000, dimitri borjac spoke thusly:

>but actually i think i wasn't clear enough in my last mail : is it
>possible to use iptables in order to NAT different VPN established between
>different NATted hosts and 1 remote gateway (the same gateway for all of
>them) ? Such a NAT would be made by watching both addresses, ports and
>SPIs...

OK, understood the scenario. According to the man page, there is the
--espspi match. You'd need to hardcode the SPIs between the relevant IPsec
hosts. You might need to do some other bits and pieces also.

I cannot say for certain whether conntrack will handle this natively, you
might need to use one of the ROUTE matches also. This is a guess, I might
be talking out of my ass.

>In other words :  is it possible for iptables to go and check the SPI field 
>in the ESP Header of the IPsec packet in ESP tunnel mode ?

See above.

iptables and SPI...

[dimitri borjac]

Hi!
i sent this question to the user list but maybe you would have more precise 
answers ...

I'd like to know if it's possible to use the current version of iptables in 
order to NAT different VPN established between different NATted hosts and 1 
remote gateway (the same gateway for all of them) ?  Such a NAT would be 
made by watching both addresses, ports and SPIs...

In other words :  is it possible for iptables to go and check the SPI field
in the ESP Header of the IPsec packet in ESP tunnel mode ?

Hope i make me clear enough :)
Thanks in advance !

Dimo

_________________________________________________________________
MSN Messenger 6  http://g.msn.fr/FR1001/866 : ajoutez une image à votre 
pseudo pour dialoguer avec vos amis

Re: iptables and SPI...

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 1392 bytes --]

On Wed, Oct 22, 2003 at 04:44:51PM +0000, dimitri borjac wrote:
> Hi!
> i sent this question to the user list but maybe you would have more precise 
> answers ...
> 
> I'd like to know if it's possible to use the current version of iptables in 
> order to NAT different VPN established between different NATted hosts and 1 
> remote gateway (the same gateway for all of them) ?  Such a NAT would be 
> made by watching both addresses, ports and SPIs...

I don't really understand what you want to achieve.  Please try to
explain this in more detail.

> In other words :  is it possible for iptables to go and check the SPI field
> in the ESP Header of the IPsec packet in ESP tunnel mode ?

are you talking about freeswan or the 2.6 kenel ipsec implementation?
Is your iptables running on one end of a tunnel or just enroute your ESP
tunnel?  Are you using UDP ESP encapsulation mode (nat-traversal)?

> Hope i make me clear enough :)

no, unfortunately not.  Or I'm too stupid, sorry.

> Dimo

-- 
- Harald Welte <laforge@netfilter.org>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

RE: iptables and SPI...

[dimitri borjac]

Thx for trying to help me Harald :)

what i'm trying to do is to perform NAT based on IP_addresses/Ports/SPIs.

The situation would be different users NATted by a common local gateway (all 
the users are located on the same private network), making each one an IPsec 
tunnel (using ESP) to the same remote gateway.

The different tunnels start from each user, go through the local gateway 
(which NATts the users) and end at the remote gateway.

The problem for the local gateway is to NAT the different VPN, based on the 
private IP adresses of the users, the ports used (port 50 for ESP...) and 
the SPIs (in order to distinguish the different tunnels).

The problem is not for the chosen ipsec implementation since the local 
gateway only NATts and forwards the ispec packets. But with the current 
version of iptables, is it possible for the local gateway to perform NAT 
based on the SPIs (and @IP and ports...) ?  (i saw that extracting the SPI 
from the ESP header is possible thx to last p-o-m... but NAT with it ?)

I hope this explanation is more understandable :-/
Thx very much for your help !!

Regards,
dimo

_________________________________________________________________
Trouvez l'âme soeur sur MSN Rencontres http://g.msn.fr/FR1000/9551

RE: iptables and SPI...

[Henrik Nordstrom]

On Fri, 31 Oct 2003, dimitri borjac wrote:

> what i'm trying to do is to perform NAT based on IP_addresses/Ports/SPIs.

Why not simply using a IP-Sec implementation supporting the 
NAT-Transversal standard?

IP-Sec is generally not very happy about being NAT:ed. For examle AH is
totally incompatible with NAT (unless using the NAT-Transversal standard).

Regards
Henrik

RE: iptables and SPI...

[dimitri borjac]

>  -----Message d'origine-----
>  De : Henrik Nordstrom [mailto:hno@marasystems.com]
>  Envoyé : vendredi 31 octobre 2003 18:42
>  À : dimitri borjac
>  Cc : laforge@netfilter.org; netfilter-devel@lists.netfilter.org
>  Objet : RE: iptables and SPI...
>    On Fri, 31 Oct 2003, dimitri borjac wrote:
>   > what i'm trying to do is to perform NAT based on 
>IP_addresses/Ports/SPIs.
>   Why not simply using a IP-Sec implementation supporting the  
>NAT-Transversal standard?
>   IP-Sec is generally not very happy about being NAT:ed. For examle AH is
>  totally incompatible with NAT (unless using the NAT-Transversal 
>standard).
>   Regards
>  Henrik

Just because I don't want to be compelled to use NAT-Traversal :)

And the only solution in this case is to NAT using the SPI... indeed by 
default AH is not compatible with NAT, and neither is ESP in transport mode, 
but ESP in tunnel mode supports the NAT (since the whole encrypted IP packet 
is encapsulated in a new IP header).

The only problem then (with ESP in tunnel mode) is for the local gateway : 
it has to know who the encrypted packet coming back to the local network is 
destinated to... that's where the SPI is helpful.

So the problem is still there... is it possible to extend the NAT functions 
of iptables in order to make the local gateway read and use the SPI for 
NATting packets ?

Regards,
dimo

_________________________________________________________________
Trouvez l'âme soeur sur MSN Rencontres ! http://g.msn.fr/FR1000/9551

RE: iptables and SPI...

[Henrik Nordstrom]

On Fri, 31 Oct 2003, dimitri borjac wrote:

> So the problem is still there... is it possible to extend the NAT functions 
> of iptables in order to make the local gateway read and use the SPI for 
> NATting packets ?

You will need to write a ESP protocol conntrack module, similar to the UDP
or ICMP conntrack modules. Note however that this will only work assuming
it is the NAT:ed endpoint which sends the initial packet ESP per SPI. For 
situations where it is the other endpoint who sends the initial ESP packet 
for this SPI then you need to somehow decode IKE to know that the SPI has 
been negotiated. Unless my memory is wrong this may be a little hard due 
to encryption of the IKE protocol..

Regards
Henrik

Re: iptables and SPI...

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 2149 bytes --]

On Fri, Oct 31, 2003 at 03:32:46PM +0000, dimitri borjac wrote:
> what i'm trying to do is to perform NAT based on IP_addresses/Ports/SPIs.
> 
> The situation would be different users NATted by a common local gateway 
> (all the users are located on the same private network), making each one an 
> IPsec tunnel (using ESP) to the same remote gateway.
> 
> The different tunnels start from each user, go through the local gateway 
> (which NATts the users) and end at the remote gateway.

ok, so we are talking about 

- NAT'ing the IKE connection on port 500
and 
- NAT'ing the AH/ESP connection that is proto AH or ESP and has no port
  but just the SPI.

Basically what you are asking for, is ip_conntrack_{proto,nat}_{ah,esp}.c

> The problem for the local gateway is to NAT the different VPN, based on the 
> private IP adresses of the users, the ports used (port 50 for ESP...) and 
> the SPIs (in order to distinguish the different tunnels).

it's l4 protocol 50, not port 50.

> The problem is not for the chosen ipsec implementation since the local 
> gateway only NATts and forwards the ispec packets. 

oh yes, with standard ipsec you will run into problems.  IPsec does
generally NOT work across NAT boxes, unless you use the UDP
encapsulation mechanism.  Please try to read some general information
about IPsec and NAT.

> But with the current version of iptables, is it possible for the local
> gateway to perform NAT based on the SPIs (and @IP and ports...) ?  (i
> saw that extracting the SPI from the ESP header is possible thx to
> last p-o-m... but NAT with it ?)

no, however it is easy to implement.  The problem is 'just' that it
still wouldn't work because of IPsec's shortcomings wrt. NAT.

> Regards,
> dimo

-- 
- Harald Welte <laforge@netfilter.org>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]