Messages in this thread | | | Date | Wed, 20 Aug 2003 16:43:04 +0200 | From | Wiktor Wodecki <> | Subject | Re: [OT] Connection tracking for IPSec |
| |
On Wed, Aug 20, 2003 at 01:22:49PM +0200, Felipe Alfaro Solana wrote: > I'm starting with IPSec right now. To make it work, I must open up > protocols 50 and 51 to pass across my Linux firewalls, but I want to use > connection tracking much like I do when not using IPSec. > > For example, > > iptables -A INPUT -m state --state RELATED,ESTABLISHED > > When using IPSec, if I open up protocols 50 and 51, all IPSec-protected > traffic passes through the firewall, but it's not checked against the > connection tracking module. How can I configure iptables so an > IPSec-protected packet, after being classified as IP protocol 50 or 51, > loop back one more time to pass through the connection tracking module? > > I don't want to set up IPSec to get addititional protection by using AH > and ESP and then let any machine talking IPSec pass entirely through my > firewall ignoring the rest of rules.
you can use iptables to open proto 50 and 51 to specific ip's, too:
iptables -A INPUT -i eth0 -p 50 -s n.n.n.n -j ACCEPT iptables -A INPUT -i eth0 -p 51 -s n.n.n.n -j ACCEPT iptables -A INPUT -i eth0 -p 51 -s n.m.n.n -j DROP
this will work. If you want netfilter to fully recognize ipsec states you have to do it yourself, afaik there is no ipsec support for the statefull/conntrack system.
But you are better of asking here: netfilter-devel@lists.samba.org
-- Regards,
Wiktor Wodecki [unhandled content-type:application/pgp-signature] | |