Handling RoadWarrior VPN Traffic with IPtables
Jan,
This really looks like might work. I read iptables man page and sounds pretty logical. I'm gonna test it, and then I'll reply here saying if it worked or not. So far, thank you.
Quoted 28 lines · Jan Engelhardt
Quoted 11 lines · Henrique Netfilter
The l2tpd is encaspuled inside the ESP traffic of the IPSec tunnel, and when it reaches my external interface, it must be redirected to my internal interface (where the l2tpd daemon listens) to continue the connection. If I had a KLIPS kernel, I could easily just DNAT the incoming L2TP requisition on interface ipsec0 to my internal interface:
iptables -t nat -A PREROUTING -i ipsecX -p udp --sport 1701 --dport 1701 -j DNAT --to-destination X.X.X.X <------ my internal interface IP
Quoted 6 lines
But since my kernel is NETKEY, I can't, since there is no ipsec interface, and I can't just DNAT the incoming traffic from my external to my internal interface for security reasons (since I want that only traffic coming from the IPSec tunnel to access the l2tpd daemon).
-i eth0 -m policy --dir in --pol ipsec
[--tunnel-src theirip] [--tunnel-dst yourip]Should be able to accurately replace -i ipsecX. See the iptables manpage. --tunnel-src, --tunnel-dst are just for ensuring that you match exactly one tunnel, you can omit it if it satisfies you.
Yes, it does work.
Followed the packet counter for the rule, it increases with each connection. Thanks a lot, saved my life.
Quoted 38 lines · Henrique Netfilter
Jan,
This really looks like might work. I read iptables man page and sounds pretty logical. I'm gonna test it, and then I'll reply here saying if it worked or not. So far, thank you.
Quoted 28 lines · Jan Engelhardt
Quoted 11 lines · Henrique Netfilter
The l2tpd is encaspuled inside the ESP traffic of the IPSec tunnel, and when it reaches my external interface, it must be redirected to my internal interface (where the l2tpd daemon listens) to continue the connection. If I had a KLIPS kernel, I could easily just DNAT the incoming L2TP requisition on interface ipsec0 to my internal interface:
iptables -t nat -A PREROUTING -i ipsecX -p udp --sport 1701 --dport 1701 -j DNAT --to-destination X.X.X.X <------ my internal interface IP
Quoted 6 lines
But since my kernel is NETKEY, I can't, since there is no ipsec interface, and I can't just DNAT the incoming traffic from my external to my internal interface for security reasons (since I want that only traffic coming from the IPSec tunnel to access the l2tpd daemon).
-i eth0 -m policy --dir in --pol ipsec
[--tunnel-src theirip] [--tunnel-dst yourip]Should be able to accurately replace -i ipsecX. See the iptables manpage. --tunnel-src, --tunnel-dst are just for ensuring that you match exactly one tunnel, you can omit it if it satisfies you.