Ipsec/L2tp with NETKEY

Ipsec/L2tp with NETKEY

[Martin]

Hi list!


I've been looking for a solution for this for a few days, but couldn't
find any solution.


I've configured a VPN in a Debian box using openswan to do ipsec and
l2tp, as it is pretty simple to implement on Windows and Mac users and
it doesn't needs any 3rd party software.

My problem is that openswan uses netkey for ipsec unless you patch the
kernel to use klips, and netkey doesn't create an ipsec0 interface, and
makes it really difficult to firewall things to l2tp, and having as a
unique soltution (without compiling kernel), leaving l2tp port wide
open.


Here is a diagram, just for fun ;)

MS-client ==== /ext interface/ Linux GW /internal interface/ ==== LAN


What I see is that user completes ipsec auth, and then tries to connect
to the l2tpd's port (7101) on the external interface, and then I must
accept connections in that port, or the vpn connection fails.


Any suggestions how to let connections on udp 1701 only to connections
before authenticated by ipsec?


Cheers


Martin

Re: Ipsec/L2tp with NETKEY

[Eray Aslan]

On 04.07.2009 03:21, Martin wrote:
[...]
> Here is a diagram, just for fun ;)
> 
> MS-client ==== /ext interface/ Linux GW /internal interface/ ==== LAN
> 
> 
> What I see is that user completes ipsec auth, and then tries to connect
> to the l2tpd's port (7101) on the external interface, and then I must
> accept connections in that port, or the vpn connection fails.
> 
> 
> Any suggestions how to let connections on udp 1701 only to connections
> before authenticated by ipsec?

On the openswan machine, mark the ESP packets and accept only marked
packets to l2tpd daemon:

# iptables -t mangle -A PREROUTING -i $EXT_INT -p 50 -j MARK --set-mark 1
# iptables -A INPUT -i $EX_INT -m mark --mark 1 -j ACCEPT
# iptables -A INPUT -i $EX_INT -p udp --dport 1701 -j DROP

-- 
Eray

Re: Ipsec/L2tp with NETKEY

[Eray Aslan]

On 06.07.2009 06:27, Martin wrote:
> 2009/7/4 Eray Aslan <eray.aslan@caf.com.tr <mailto:eray.aslan@caf.com.tr>>
> 
>     On 04.07.2009 03:21, Martin wrote:
>     [...]
>     > Any suggestions how to let connections on udp 1701 only to connections
>     > before authenticated by ipsec?
> 
>     On the openswan machine, mark the ESP packets and accept only marked
>     packets to l2tpd daemon:
> 
>     # iptables -t mangle -A PREROUTING -i $EXT_INT -p 50 -j MARK
>     --set-mark 1
>     # iptables -A INPUT -i $EX_INT -m mark --mark 1 -j ACCEPT
>     # iptables -A INPUT -i $EX_INT -p udp --dport 1701 -j DROP
>
> Thanks for the reply Eray.
> 
> Sadly, that doesn't seems to work, or at least I don't see any packet
> been mark using "iptables -L -n -v -t mangle"
> 
> Can be there something else or anything that I'm missing?

Better to reply on-list.  Others might help / correct the given advice.

If counters do not increase, you need to figure out why esp packets do
not match the marking line.  Perhaps try logging all packets in
mangle/PREROUTING for a short while and compare.

-- 
Eray