Linux Netfilter discussions
 help / color / mirror / Atom feed
* Iptables do nat with Protocol 47 or GRE
@ 2004-05-14 10:24 Sez
  2004-05-14 10:39 ` Antony Stone
  0 siblings, 1 reply; 16+ messages in thread
From: Sez @ 2004-05-14 10:24 UTC (permalink / raw)
  To: netfilter

Hi people,

I have a a vpn server in my Intranet. If i want access to this server i will
pass my firewall.

The diagram is

VPN_CLIENT(W2k box) ---- router ---- (192.168.55.94 eth0) FIREWALL
(192.168.55.95 eth1)-------- (192.168.55.92)VPN_SERVER

I create all iptables rules and VPN_CLIENT can connect to server. One client
go well. But if another client try to connect he has this error
		*** error  721: Remote server don't response. ***

I see in the log file that all packets from second client was dropped. And
first client go well his connection.

Here are my important iptables rules:

iptables -t nat -A PREROUTING -s 0.0.0.0/0  -d 192.168.55.94 -p TCP --dport
1723 -j DNAT --to 192.168.55.92:1723
iptables -t nat -A PREROUTING -s 0.0.0.0/0  -d 192.168.55.94 -p GRE -j DNAT
--to 192.168.55.92

iptables -t nat -A POSTROUTING -p TCP -s 0.0.0.0/0 -d 192.168.55.92 --dport
1723 -o eth1 -j MASQUERADE
iptables -t nat -A POSTROUTING -p GRE -s 0.0.0.0/0 -d 192.168.55.92 -o eth1
-j MASQUERADE

And other rules...

I receive packet
		
	 SOURCE --> IP_VPN_CLIENT 
	DESTINATION --> 192.168.55.94

	and I forward all packets and change ip source and ip destination.
Firewall out

	SOURCE --> 192.168.55.95
	DESTINATION--> 192.168.55.92
	
I also do the same to return de packet. I change the ip source, because
VPN_SERVER has another gateway, it don't have Firewall with GATEWAY.

Don't Iptables have nat with differents gre connections??? Or have I some
errors?
Thanks!

SERGI



^ permalink raw reply	[flat|nested] 16+ messages in thread
* RE: Iptables do nat with Protocol 47 or GRE
@ 2004-05-14 16:52 Daniel Chemko
  0 siblings, 0 replies; 16+ messages in thread
From: Daniel Chemko @ 2004-05-14 16:52 UTC (permalink / raw)
  To: netfilter

Antony Stone wrote:
> On Friday 14 May 2004 2:00 pm, Sez wrote:
> 
>> I have a microsoft server to l2tp/ipsec. And my firewall is a Linux.
>> I understand that if i create a server in micro$oft box, i can
>> routing the traffic with Linux with any problem (no recompile,
>> multiple users, nat with l2tp/ipsec).
> 
> Can someone who knows about L2TP / IPsec step in here please?

I am pretty sure that all distinguishable features of IPSec are vurried
inside the encrypted tunnel, which means it can't be conntracked
uniquely through NAT. So, the only way to successfully have IPSec
tunnels is hand coding each Source-Destination w/Protocol into the NAT
tables. That's how CISCO says to forward them anyways:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft
/122t/122t13/ftnatesp.htm

Since there doesn't seem to be a conntrack helper I can only assume its
because there's no session id equivilent as there is in PPTP.


^ permalink raw reply	[flat|nested] 16+ messages in thread
* RE: Iptables do nat with Protocol 47 or GRE
@ 2004-05-14 17:42 Daniel Chemko
  0 siblings, 0 replies; 16+ messages in thread
From: Daniel Chemko @ 2004-05-14 17:42 UTC (permalink / raw)
  To: Sezmillenium, netfilter



Sezmillenium wrote:
> Hi!
> 
> OK. I have this situation
> 
> 
> VPN_CLIENT(w2k box) ---> router ---> FIREWALL (NAT) ---> M$ Server
> 
> 
> I want to configure only the Firewall.
> 
> First, I tried to create a connection with pptp. Pptp need protocol
> GRE and iptables don't support nat with protocol GRE. I must
> recompile the Kernel...  

Option #1
Patch the kernel with POM. This isn't that hard. It should probably be
done for all the other really-good-things inside the newer netfilter
system.

Option #2
You can support One2One NAT as follows:

# This is one to one NAT with an extra field to discriminate which
client IP address the data is coming from.
# If you want to have multiple clients connect to the system
simultaniously, you repeat these rules for every client you have (NOTE
you need a public Ip for each one)
# If you want many clients, but only one at a time, you can drop the
fields with ${CLI_IP1} in it. This will mean that if > 1 person uses the
VPN at any given time, the VPN will die for one of them, but it means
you don't need an IP address for each user.
iptables -A PREROUTING --source ${CLI_IP1} --destination ${PUBLIC_IP1}
-j DNAT --to ${VPNSERVER}
iptables -A FORWARD --source ${CLI_IP1} --destination ${VPNSERVER} -j
ACCEPT
iptables -A FORWARD --source ${VPNSERVER} --destination ${CLI_IP1} -j
ACCEPT
iptables -A POSTROUTING --source ${VPNSERVER} --destination ${CLI_IP1}
-j DNAT --to ${PUBLIC_IP1}

Option #3
You can host PPTP or IPSEC from your machine. This probably also
involves kernel patching but its by far the best solution. You could
filter traffic coming and going from the VPN tunnel right from the
firewall. This prevents road warriors from infecting home office with
worms, etc.. Well, at least a well defined ruleset does.

PPTP
Look for poptop and pppd with the radius_plugin. This way, it works like
your micrsoft PPTP server but you don't need the firewall workaround. In
order for this to work, you need to spend 10 minutes learning the basics
of radius and setup "Internet Authentication Server" on a windows
2000/2003 DC.

IPSec
If you want Ipsec, you can also look at what used to be freeswan.org and
is now a lot of smaller projects apparently.


^ permalink raw reply	[flat|nested] 16+ messages in thread
end of thread, other threads:[~2004-05-14 17:42 UTC | newest]

Thread overview: 16+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-05-14 10:24 Iptables do nat with Protocol 47 or GRE Sez
2004-05-14 10:39 ` Antony Stone
2004-05-14 10:50   ` Sez
2004-05-14 10:59     ` Antony Stone
2004-05-14 11:14   ` Sez
2004-05-14 11:30     ` Antony Stone
2004-05-14 12:11       ` Sez
2004-05-14 12:27         ` Antony Stone
2004-05-14 12:15       ` Sez
2004-05-14 12:44         ` Antony Stone
2004-05-14 13:00           ` Sez
2004-05-14 13:14             ` Antony Stone
2004-05-14 14:12               ` Alexis
2004-05-14 16:52               ` Sezmillenium
  -- strict thread matches above, loose matches on Subject: below --
2004-05-14 16:52 Daniel Chemko
2004-05-14 17:42 Daniel Chemko

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox