VPN Passthrough with iptables

From: Ian G Batten (I.G.Batten@batten.eu.org)
Date: 09/19/02 

From: Ian G Batten <I.G.Batten@batten.eu.org>
Date: 19 Sep 2002 10:20:21 GMT

If I have this scenario:

[PC]--local ethernet---[Linux Firewall/NAT]---Internet---[VPN Server]

how do I configure the Firewall/NAT box so that it will do IPSec VPN
passthrough from a VPN client on the PC to the VPN Server? The client
will and server will Symantec, if that matters, but I would like to pass
through arbitrary IPSec. I don't believe this is hard, as most
commodity SOHO routers support ``VPN Passthrough'' as part of their NAT
offering, and just knowing what they do would be sufficient (I'm fluent
with iptables, but not with IPSec).

I would be happy with a solution which only works for one PC.

>From basic reading, I believe I need to use IKE key exchange, pass
outbound UDP traffic headed for a remote port 500 through (applying
simply the SNAT but leaving the source port alone) and use DNAT to pass
incoming traffic for port 500 on the NAT host to port 500 on the VPN
client. I think I can use SPI tracking on more recent kernels to
discriminate.

Am I on the right lines?

ian

Relevant Pages

  • Re: Unable to Connect Multiple VPN Clients via Linksys Router
    ... office's VPN using Cisco VPN Client 4.0.5client software over the ... behavior that when doing NAT on low UDP ports such as UDP port 500, ... they will not NAT the source port. ...
    (comp.dcom.sys.cisco)
  • RE: IPSEC VPN connection from client in SBS 2003 premium
    ... the IPSec protocol cannot pass through ISA if IPSec ... pass-through would not work in firewall client method. ... VPN scenario, between the remote client and the VPN gateway, all VPN ...
    (microsoft.public.windows.server.sbs)
  • Re: RPC and IPSec
    ... On which machine did you define the port range? ... Are you sure you don't have a firewall blocking your client from attaching ... I have impemented the IPSec policy in the domain controller GPO. ... Do I need to alter the RPC port range in registry on my DC's to make this ...
    (microsoft.public.windows.server.active_directory)
  • Re: RRAS IPSec on W2003 Server behind NAT
    ... Clients are Windows XP SP2 or later and have found out that with SP2, ... Vista/7 clients to be able to connect to a Windows 2003 VPN server [not ... IPSec are appreciated ... either an issue in your VPN config on the server, and/or on the client. ...
    (microsoft.public.windows.server.networking)
  • Re: VPN Passthrough with iptables
    ... > how do I configure the Firewall/NAT box so that it will do IPSec VPN ... > passthrough from a VPN client on the PC to the VPN Server? ... > simply the SNAT but leaving the source port alone) and use DNAT to pass ...
    (comp.security.firewalls)
Quantcast