RE: [Security Firewall] IPSEC Passthrough

This is a multi-part message in MIME format...

------------=_1129258827-811-1050
content-class: urn:content-classes:message
Content-Type: text/plain;
	charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable


Could someone perhaps comment on the following, im going to investigate the=
 default policies to see if it uses "input" statement:

https://lists.netfilter.org/pipermail/netfilter/2002-September/038697.html

-- snip --

2. Add following rules (in addition to my standard postrouting SNAT of=20
anything from the internal network):

iptables -A INPUT -i eth0 -p ah -j ACCEPT
iptables -A INPUT -i eth0 -p esp -j ACCEPT
iptables -A INPUT -i eth0 -p udp -m udp --dport 500 -j ACCEPT
iptables -A INPUT -i eth0 -p udp -m udp --dport 2746 -j ACCEPT
iptables -A FORWARD -i eth0 -p ah -d 172.16.0.0/16 -j ACCEPT
iptables -A FORWARD -i eth0 -p esp -d 172.16.0.0/16 -j ACCEPT
iptables -A FORWARD -i eth0 -p udp -d 172.16.0.0/16 -m udp \
	--dport 500 -j ACCEPT
iptables -A FORWARD -i eth0 -p udp -d 172.16.0.0/16 -m udp \
	--dport 2746 -j ACCEPT

Voila.  It worked.  I'm not sure if all of this is necessary (e.g. the AH=
=20
protocol bit) but I haven't had the time/chance/inclination to do a=20
methodical trial and error test of shutting off each rule to try and break=
=20
it.

In particular, I'm not sure why the INPUT part is necessaray if the SNAT is=
=20
working right, but it seemed to fix some timeout problem where the=20
connection works at first but then goes down if it sits idle for too=20
long.  (I use Lotus Notes at home and check e-mail periodically --=20
sometimes it fails to connect after sitting idle, but the INPUT statements=
=20
fixed it.)  I'll try to turn that off again and see if I can replicate the=
=20
breakage.

-- snip --

I have the same problem mentioned above.

Policy: "WAN  to  LAN  =3D Accept" results in continuous VPN traffic regard=
less of idle time.

Policy: "WAN:source_address  to LAN  =3D Accept" results in the timeout pro=
blem above.




-----Original Message-----
From: security-firewall-owner-4qZELD6FgxheH41UXmfQsti2O/[email protected] [mailto:security-firewall-o=
wner-4qZELD6FgxheH41UXmfQsti2O/[email protected]] On Behalf Of Dunlop, Sean
Sent: Thursday, 13 October 2005 3:53 PM
To: dieter-ZpcFK/w3DkEX+nLd/[email protected]; security-firewall-4qZELD6FgxheH41UXmfQsti2O/[email protected]
Subject: RE: [Security Firewall] IPSEC Passthrough


I have found most of the required info but much of it refers to masq'd traf=
fic for client to server.

My situation is no masq and either end is Checkpoint NG VPN gateway.

Logging shows dropping of Protocol 50 (ESP) when incoming policy is default=
ed to "drop"

There does not appear to be an ESP protocol in the "add rule" protocol list=
. Is there another name for it or has it been forgotten in this list. How c=
an I implement protocol 50 in a rule.

If I use an accept policy between the checkpoint VPN gateway addresses the =
tunnel works initially and then encrypted traffic stops flowing after an ex=
tended idle period. IKE key exchanges are occurring successfully every 12 h=
ours. Nothing is logged on the MNF2 when the problem occurs, traffic just w=
ont flow until a "shorewall restart" is executed.



-----Original Message-----
From: security-firewall-owner-4qZELD6FgxheH41UXmfQsti2O/[email protected] [mailto:security-firewall-o=
wner-4qZELD6FgxheH41UXmfQsti2O/[email protected]] On Behalf Of Dieter Sch=FCtze
Sent: Tuesday, 11 October 2005 12:44 PM
To: security-firewall-4qZELD6FgxheH41UXmfQsti2O/[email protected]
Subject: Re: [Security Firewall] IPSEC Passthrough

Open your browser, go to google and put this in:
ipsec Port numbers

The you get Pages like this:
http://www.isaserver.org/articles/IPSec_Passthrough.html


Sorry for that. ;-)

You need to open the Ports for IPsec and let them through from one Checkpoi=
nt to the other.


Regards

Dieter

Dunlop, Sean schrieb:
> I have a MNF2 box sitting between 2 Checkpoint NG R55 VPN gateways.
>=20
> What do I need to do to the MNF2 ruleset to allow IPSEC to passthrough?
>=20
>=20
>=20
>=20
> ----------------------------------------------------------------------
> --
>=20
> ____________________________________________________
> Want to buy your Pack or Services from Mandriva?=20
> Go to http://store.mandriva.com
> Join the Club : http://www.mandrivaclub.com=20
> ____________________________________________________











------------=_1129258827-811-1050
Content-Type: text/plain; name="message.footer"
Content-Disposition: inline; filename="message.footer"
Content-Transfer-Encoding: quoted-printable

____________________________________________________
Want to buy your Pack or Services from Mandriva?=20
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________

------------=_1129258827-811-1050--