[lkml]   [2003]   [Aug]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [OT] Connection tracking for IPSec

--On Wednesday, August 20, 2003 01:22:49 PM +0200 Felipe Alfaro Solana
<> wrote:

> Hi all!
> I'm starting with IPSec right now. To make it work, I must open up
> protocols 50 and 51 to pass across my Linux firewalls, but I want to use
> connection tracking much like I do when not using IPSec.
> For example,
> iptables -A INPUT -m state --state RELATED,ESTABLISHED

Hmm. You can't do this if the end host does the ESP (AH is another
matter). Ever. If the ESP is working, the router can't tell what is
inside the packet; this is the whole point of IPSEC. If you want this
functionality, you can only provide it on the end host, or else do the
IPSEC on the router.

> When using IPSec, if I open up protocols 50 and 51, all IPSec-protected
> traffic passes through the firewall, but it's not checked against the
> connection tracking module. How can I configure iptables so an
> IPSec-protected packet, after being classified as IP protocol 50 or 51,
> loop back one more time to pass through the connection tracking module?

You can't, by design of IPSEC. However, you do have a couple of options:

1) let through IPSEC only for hosts you trust
2) for hosts you must firewall at the router, do the IPSEC there too, and
do not allow those hosts to use IPSEC.

These aren't exclusive.

> I don't want to set up IPSec to get addititional protection by using AH
> and ESP and then let any machine talking IPSec pass entirely through my
> firewall ignoring the rest of rules.
> Thanks!

You're welcome.


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:47    [W:0.089 / U:0.416 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site