Re: Handling RoadWarrior VPN Traffic with IPtables

[Henrique Netfilter <henrique.netfilter@gmail.com>]

Yes, it does work.
Followed the packet counter for the rule, it increases with each connection.
Thanks a lot, saved my life.

Henrique Netfilter wrote:
> Jan,
>
> This really looks like might work. I read iptables man page and sounds 
> pretty logical.
> I'm gonna test it, and then I'll reply here saying if it worked or not.
> So far, thank you.
>
>
>
> Jan Engelhardt wrote:
>> On Friday 2008-04-25 17:05, Henrique Netfilter wrote:
>>  
>>> The l2tpd is encaspuled inside the ESP traffic of the IPSec tunnel,
>>> and when it reaches my external interface, it must be redirected to
>>> my internal interface (where the l2tpd daemon listens) to continue
>>> the connection. If I had a KLIPS kernel, I could easily just DNAT
>>> the incoming L2TP requisition on interface ipsec0 to my internal
>>> interface:
>>>
>>> iptables -t nat -A PREROUTING -i ipsecX -p udp --sport 1701 --dport
>>> 1701 -j DNAT --to-destination X.X.X.X <------ my internal interface
>>> IP
>>>
>>> But since my kernel is NETKEY, I can't, since there is  no ipsec
>>> interface, and I can't just DNAT the incoming traffic from my
>>> external to my internal interface for security reasons (since I
>>> want that only traffic coming from the IPSec tunnel to access the
>>> l2tpd daemon).
>>>     
>>
>> -i eth0 -m policy --dir in --pol ipsec
>> [--tunnel-src theirip] [--tunnel-dst yourip]
>>
>> Should be able to accurately replace -i ipsecX. See the iptables
>> manpage. --tunnel-src, --tunnel-dst are just for ensuring that
>> you match exactly one tunnel, you can omit it if it satisfies you.
>>
>>   
>