IPSec passthrough with iptables

IPSec passthrough with iptables

[Thomas Smith]

I need to be able to connect to clients IPSec VPN from
behind and iptables firewall. I know the VPN is
working and my firewall is masquing traffic but IPSec
doesn't work from systems behind my firewall.

I've got a pretty basic firewall. It's simply masquing
internal traffic.

Are there some iptables' rules or patches I'm missing?

Tom
hpcaz@yahoo.com

RE: IPSec passthrough with iptables

[Sneppe Filip]

Hi,

Thomas Smith [mailto:hpcaz@yahoo.com] wrote:
> 
> I need to be able to connect to clients IPSec VPN from
> behind and iptables firewall. I know the VPN is
> working and my firewall is masquing traffic but IPSec
> doesn't work from systems behind my firewall.
> 
> I've got a pretty basic firewall. It's simply masquing
> internal traffic.
> 
> Are there some iptables' rules or patches I'm missing?
> 

Well, you only need to allow udp port 500 traffic for IKE,
and protocols 50 (ESP) and 51 (AH).

However, you will find that most types of AH and NAT don't 
mix all that well, unless you do some really clever (read: 
hackish) NAT tricks. Basically, the IP addresses on both 
sides may not be NAT'ted. If you use NAT, you must NAT the
addresses back before they reach the other side.

Regards,
Filip

Re: IPSec passthrough with iptables

[Antony Stone]

On Tuesday 15 October 2002 5:47 am, Thomas Smith wrote:

> I need to be able to connect to clients IPSec VPN from
> behind and iptables firewall. I know the VPN is
> working and my firewall is masquing traffic but IPSec
> doesn't work from systems behind my firewall.
>
> I've got a pretty basic firewall. It's simply masquing
> internal traffic.
>
> Are there some iptables' rules or patches I'm missing?

No patches needed.   No special support in netfilter needed.

Make sure you are forwarding (both ways :-) protocol 50 (ESP), protocol 51 
(AH) and UDP sport 500 / dport 500 (IKE).

Also make sure you are using IPsec in tunnel mode, not transport mode 
(transport mode will not work through NAT).

Hope this helps,

Antony.

-- 

If the human brain were so simple that we could understand it,
we'd be so simple that we couldn't.

Re: IPSec passthrough with iptables

[George Agnelli]

I'm having a similar problem and am not very experienced yet with iptables.

> Make sure you are forwarding (both ways :-) protocol 50 (ESP), protocol 51
> (AH) and UDP sport 500 / dport 500 (IKE).

Could you show me the best way to write this in iptables syntax?

George

Re: IPSec passthrough with iptables

[Antony Stone]

On Tuesday 15 October 2002 12:09 pm, George Agnelli wrote:

> I'm having a similar problem and am not very experienced yet with iptables.
>
> > Make sure you are forwarding (both ways :-) protocol 50 (ESP), protocol
> > 51 (AH) and UDP sport 500 / dport 500 (IKE).
>
> Could you show me the best way to write this in iptables syntax?

iptables -A FORWARD -p esp -j ACCEPT
iptables -A FORWARD -p ah -j ACCEPT
iptables -A FORWARD -p udp --sport 500 --dport 500 -j ACCEPT

You may wish to add some -s and/or -d source & destination address 
restrictions on the above rules, eg:

iptables -A FORWARD -p esp -s a.b.c.d -d w.x.y.z -j ACCEPT
iptables -A FORWARD -p esp -s w.x.y.z -d a.b.c.d -j ACCEPT

where a.b.c.d and w.x.y.z are the two IPsec gateways which need to 
communicate.

Antony.

-- 

This email is intended for the use of the individual addressee(s) named above 
and may contain information that is confidential, privileged or unsuitable 
for overly sensitive persons with low self-esteem, no sense of humour, or 
irrational religious beliefs.

If you have received this email in error, you are required to shred it 
immediately, add some nutmeg, three egg whites and a dessertspoonful of 
caster sugar.   Whisk until soft peaks form, then place in a warm oven for 40 
minutes.   Remove promptly and let stand for 2 hours before adding some 
decorative kiwi fruit and cream.   Then notify me immediately by return email 
and eat the original message.

Re: IPSec passthrough with iptables

[David A Golden]

Just to muddy the waters, through experimentation, I have found that using 
Checkpoint SecuRemote (on windows) behind a Linux netfilter firewall, I can 
achieve an IPSEC connection using just:

iptables -A FORWARD -s $INTERNAL_NET -j ACCEPT
iptables -A FORWARD -d $INTERNAL_NET -m state --state ESTABLISHED,RELATED \
         -j ACCEPT

I.e. explicit per-protocol forwarding seems unnecessary.  (Though you might 
want to be explicit for security/control reasons.)  [Note, no UDP 
encapsulation, either]

I do experience weird time-outs occasionally, apparently connected to 
incoming IKE packets (UDP port 500) that aren't recognized as connected, 
but I can get around this by just accepting them to the firewall, which 
does nothing as there is nothing running on that port.  (I'm trying 
variations of reject/drop to see if there is a better way to reply.)

Regards,
David

At 09:00 AM 10/15/2002, Antony Stone wrote:
>On Tuesday 15 October 2002 12:09 pm, George Agnelli wrote:
>
> > I'm having a similar problem and am not very experienced yet with iptables.
> >
> > > Make sure you are forwarding (both ways :-) protocol 50 (ESP), protocol
> > > 51 (AH) and UDP sport 500 / dport 500 (IKE).
> >
> > Could you show me the best way to write this in iptables syntax?
>
>iptables -A FORWARD -p esp -j ACCEPT
>iptables -A FORWARD -p ah -j ACCEPT
>iptables -A FORWARD -p udp --sport 500 --dport 500 -j ACCEPT
>
>You may wish to add some -s and/or -d source & destination address
>restrictions on the above rules, eg:
>
>iptables -A FORWARD -p esp -s a.b.c.d -d w.x.y.z -j ACCEPT
>iptables -A FORWARD -p esp -s w.x.y.z -d a.b.c.d -j ACCEPT
>
>where a.b.c.d and w.x.y.z are the two IPsec gateways which need to
>communicate.
>
>Antony.

Re: IPSec passthrough with iptables

[Antony Stone]

On Wednesday 16 October 2002 4:45 am, David A Golden wrote:

> Just to muddy the waters, through experimentation, I have found that using
> Checkpoint SecuRemote (on windows) behind a Linux netfilter firewall, I can
> achieve an IPSEC connection using just:
>
> iptables -A FORWARD -s $INTERNAL_NET -j ACCEPT
> iptables -A FORWARD -d $INTERNAL_NET -m state --state ESTABLISHED,RELATED \
>          -j ACCEPT
>
> I.e. explicit per-protocol forwarding seems unnecessary.  (Though you might
> want to be explicit for security/control reasons.)

Well, quite.

We suggested some rules which would allow IPsec through your firewall, but 
which would at least block a few other protocols.   We also weren't sure 
whether you were initiating the IPsec connection from the inside or the 
outside of your firewall (it's clearly the inside, if the above rules work).

If you prefer to allow *every* protocol out of your network, then this 
includes IPsec, so you don't need to do anything specific.

Good that you have things working - now to consider how secure you want it...

Antony.

-- 

Anything that improbable is effectively impossible.

 - Murray Gell-Mann, Nobel Prizewinner in Physics