lkml.org 
[lkml]   [2003]   [Aug]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [OT] Connection tracking for IPSec
    From
    Date
    Am Mi, 2003-08-20 um 13.22 schrieb Felipe Alfaro Solana:

    > When using IPSec, if I open up protocols 50 and 51, all IPSec-protected
    > traffic passes through the firewall, but it's not checked against the
    > connection tracking module. How can I configure iptables so an
    > IPSec-protected packet, after being classified as IP protocol 50 or 51,
    > loop back one more time to pass through the connection tracking module?

    You're saying it's not honouring the netfilter rules at all?

    I'm having a related problem here. I switched my small home
    server/router to the 2.6 kernel and switched from klips(freeswan) to the
    new in-kernel ipsec. Racoon is working fine as keying daemon but the
    netfilter rules don't work anymore.

    I'm using it to encrypt between a single server in the internet (not a
    network) and my router at home. I want it to masquerade the traffic from
    my internal home network to the other machine, just like if there was no
    encrypted path.

    It doesn't work. The traffic from my internal network goes out
    masqueraded but unencrypted and the other machine answers, but
    encrypted, and on the return path my router at home throws the packet
    away because it doesn't know what to do with that packet.

    With klips it was possible to apply netfilter rules before and after the
    packets got encrypted, because there was an additional virtual device
    (ipsec0) that catches the traffic before encryption (or after
    decryption).

    --
    Christophe Saout <christophe@saout.de>
    Please avoid sending me Word or PowerPoint attachments.
    See http://www.fsf.org/philosophy/no-word-attachments.html

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:47    [W:0.066 / U:60.640 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site