VPN behind Linux Firewall

VPN behind Linux Firewall

[kayegee]

[-- Attachment #1: Type: text/plain, Size: 2820 bytes --]

I have a LINUX firewall protecting my local LAN. I have 2 computers that use the Nortel VPN client to connect to my office. I can make the VPN connection, but I can't seem to stay connected for more than 10 to 15 min. Suddenly the system stops responding. If you look at the VPN icon, only the top half of the icon blinks. When things are working properly, both the top and bottom half of the VPN icon flash. While this is happening, other computers connected to the Internet continue to work without a problem. I was looking in /proc/net/ip_conntrack file and notice that I seem to lose my connection every time I get an entry like the following in that file:

unknown  50 523 src=192.168.XX.X dst=192.128.166.44 src=192.128.166.44 dst=XX.XXX.XXX.XX use=1 

I'm not sure why I'm getting an unknown packet. I'm also not sure how iptables should handle an unknown packet. If anyone can shed some light on this subject, I'd greatly appreciate it. 


192.168.XX.X  =  Local LAN address
XX.XXX.XXX.XX = My IP address

LINUX OS:        Redhat Kernel 2.4.18-3
iptables:            1.2.5
VPN Client:        Nortel 2.62.33



IPTables Setup File:

#!/bin/sh

#Path of the iptables program
IPTABLES="/sbin/iptables"

#Private LAN address
IN_LAN="192.168.XX.X/24"

# Private LAN Interface
IN_LAN_INTERFACE="eth0"

# Private LAN Interace Address
IN_LAN_INTERFACE_ADDR="192.168.XX.X"
 
# External LAN Interface
EXT_LAN_INTERFACE="eth1"

# External LAN Interface address
EXT_LAN_INTERFACE_ADDR="XX.XXX.XXX.XX"

# Flush all the current packet filtering rules
$IPTABLES -F

#Set Default policy to deny everything
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP

# Allow packets from the interal LAN to the firewall
$IPTABLES -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -i $IN_LAN_INTERFACE -j ACCEPT

# Allow packets coming to the external interface only if already established or related to a current session
$IPTABLES -A INPUT -i $EXT_LAN_INTERFACE -m state --state ESTABLISHED,RELATED -j ACCEPT


# Allow packets generated from the firewall.
$IPTABLES -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -j ACCEPT

# Allow packets coming from the internal LAN to the external interface
$IPTABLES -A FORWARD -s $IN_LAN -j ACCEPT

# Allow packetes coming to the external interface only if already established or related to a current session 
$IPTABLES -A FORWARD -j LOG
$IPTABLES -A FORWARD -i $EXT_LAN_INTERFACE -o $IN_LAN_INTERFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $IN_LAN_INTERFACE -o $EXT_LAN_INTERFACE -j ACCEPT

# Set up Network Translation
$IPTABLES -t nat -A POSTROUTING -o $EXT_LAN_INTERFACE -j SNAT --to $EXT_LAN_INTERFACE_ADDR 


[-- Attachment #2: Type: text/html, Size: 4346 bytes --]

Re: VPN behind Linux Firewall

[Antony Stone]

On Monday 24 June 2002 5:48 pm, kayegee wrote:

> I have a LINUX firewall protecting my local LAN. I have 2 computers that
> use the Nortel VPN client to connect to my office. I can make the VPN
> connection, but I can't seem to stay connected for more than 10 to 15 min.
> Suddenly the system stops responding. If you look at the VPN icon, only the
> top half of the icon blinks. When things are working properly, both the top
> and bottom half of the VPN icon flash. While this is happening, other
> computers connected to the Internet continue to work without a problem. I
> was looking in /proc/net/ip_conntrack file and notice that I seem to lose
> my connection every time I get an entry like the following in that file:
>
> unknown  50 523 src=192.168.XX.X dst=192.128.166.44 src=192.128.166.44
> dst=XX.XXX.XXX.XX use=1
>
> I'm not sure why I'm getting an unknown packet. I'm also not sure how
> iptables should handle an unknown packet. If anyone can shed some light on
> this subject, I'd greatly appreciate it.

'unknown' in this context simply means that the logging system doesn't know 
what to call protocol 50, which is ESP.   Therefore I surmise that the Nortel 
application is using IPsec.

Are you saying that this entry is *not* present in the connection tracking 
table whilst the VPN connection is operational ?

 

I think it might be interesting to add a logging rule, or use tcpdump / 
ethereal etc, to look for UDP packets from source port 500 to source port 
500, and see if these appear soon before the connection goes downj ?

UDP 500 is the Internet Key Exchange (IKE) protocol, and the two end systems 
might be trying to re-key (although 10-15 minutes is a bit quick), and 
something might be blocking that ?

Just a thought.

 

Antony.

RE: VPN behind Linux Firewall

[Rowan Reid]

[-- Attachment #1: Type: text/plain, Size: 379 bytes --]



 > I have a LINUX firewall protecting my local LAN. I have 2 computers
that use the Nortel VPN client to connect to my office.  
 
you may want to read up on pptp and IPSec masquarading. I'm not familiar
with Nortels VPN but if it uses pptp or IPSec you need to build in
kernel support for both.  link below.
 
ftp://ftp.rubyriver.com/pub/jhardin/masquerade/ip_masq_vpn.html 


[-- Attachment #2: Type: text/html, Size: 1687 bytes --]

Re: VPN behind Linux Firewall

[Antony Stone]

On Monday 24 June 2002 5:57 pm, Antony Stone wrote:

> I think it might be interesting to add a logging rule, or use tcpdump /
> ethereal etc, to look for UDP packets from source port 500 to source port
> 500, and see if these appear soon before the connection goes downj ?

Obviously that was supposed to read "...look for UDP packets from source port 
500 to destination port 500..."

> UDP 500 is the Internet Key Exchange (IKE) protocol, and the two end
> systems might be trying to re-key (although 10-15 minutes is a bit quick),
> and something might be blocking that ?
>
> Just a thought.
>
>
>
> Antony.