[lkml]   [2003]   [Aug]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[OT] Connection tracking for IPSec
Hi all!

I'm starting with IPSec right now. To make it work, I must open up
protocols 50 and 51 to pass across my Linux firewalls, but I want to use
connection tracking much like I do when not using IPSec.

For example,

iptables -A INPUT -m state --state RELATED,ESTABLISHED

When using IPSec, if I open up protocols 50 and 51, all IPSec-protected
traffic passes through the firewall, but it's not checked against the
connection tracking module. How can I configure iptables so an
IPSec-protected packet, after being classified as IP protocol 50 or 51,
loop back one more time to pass through the connection tracking module?

I don't want to set up IPSec to get addititional protection by using AH
and ESP and then let any machine talking IPSec pass entirely through my
firewall ignoring the rest of rules.


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:47    [W:0.057 / U:0.164 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site