Re: IPSEC not blocking specific IP address per Ethereal

From: T. Sean Weintz (strap_at_hanh-ct.org)
Date: 04/19/05

  • Next message: Roger Abell: "Re: Strange DNS problem" 
    Date: Mon, 18 Apr 2005 18:18:04 -0400

    Alfredo wrote:
    > Win2k advanced server, updated service packs, IP sec with a few pinholes
    > for some daemons, port blocking working well per GRC's "Shields UP",
    > etc.
    >
    > However, when I try to block a specific IP address by using IPSEC, the
    > packets get through anyway according to my ethereal sniffer which is
    > running on the same machine. I have added a very specific filter
    > against those IPs but ethereal still shows their packets getting in past
    > the front door.
    >
    > (At least that's what I think is happening, it could be that ethereal is
    > capturing the packets before IPSEC gets to block them, which would be
    > worrisome because that would certainly be an exploitable
    > vulnerability.)
    >
    Yup. That is what's happening. Winpcap, which allows the captures for
    ethereal, is snagging the packets before they get passed to the IP
    stack. Think about it - winpcap is non layer 3 specific - it will
    capture IPX, etc. -- not just IP. It HAS to work before things get
    passed to the IP stack. The IPSEC settings in windoze are of course IP
    specific, therefore are higher level than winpcap.

  • Next message: Roger Abell: "Re: Strange DNS problem"

    Relevant Pages

    • Re: IPSEC not blocking specific IP address per Ethereal
      ... > However, when I try to block a specific IP address by using IPSEC, the ... > against those IPs but ethereal still shows their packets getting in past ... > capturing the packets before IPSEC gets to block them, ... Think about it - winpcap is non layer 3 specific - it will ...
      (comp.security.firewalls)
    • Re: Interaction between ipfw, IPSEC and natd
      ... > which means that NAT is extremely hard to use in an IPSEC environment. ... do not need IPSEC packets to be routed through the firewall at all. ... 'untrusted IPSEC tunnel' (that is, a tunnel which you want to filter traffic ...
      (FreeBSD-Security)
    • Re: Interaction between ipfw, IPSEC and natd
      ... >> which means that NAT is extremely hard to use in an IPSEC environment. ... > do not need IPSEC packets to be routed through the firewall at all. ... > and dest address and injects it into the outside interface of the firewall; ...
      (FreeBSD-Security)
    • FW: IPSEC tunnel problem
      ... I had a problem with IPSEC which is actually already solved on ... Subject: IPSEC tunnel problem ... Why the router replies with ICMP host-unreachable to the TCP packets ... WAN interface, ipencap in on WAN interface, in on gif and out packet on ...
      (freebsd-net)
    • Re: Netscreen Remote, NAT and Windows 2000
      ... > is based off 192.168.0.2 and the hash that the foreign VPN box generates ... > any good VPN box it discards the packets since it can't authenticate. ... This is true for transport-mode IPSEC packets, ... > non-routable IP address NAT but that's just me. ...
      (comp.security.firewalls)