Ipsec/L2tp with NETKEY
Hi list!
I've been looking for a solution for this for a few days, but couldn't find any solution.
I've configured a VPN in a Debian box using openswan to do ipsec and l2tp, as it is pretty simple to implement on Windows and Mac users and it doesn't needs any 3rd party software.
My problem is that openswan uses netkey for ipsec unless you patch the kernel to use klips, and netkey doesn't create an ipsec0 interface, and makes it really difficult to firewall things to l2tp, and having as a unique soltution (without compiling kernel), leaving l2tp port wide open.
Here is a diagram, just for fun ;)
MS-client ==== /ext interface/ Linux GW /internal interface/ ==== LAN
What I see is that user completes ipsec auth, and then tries to connect to the l2tpd's port (7101) on the external interface, and then I must accept connections in that port, or the vpn connection fails.
Any suggestions how to let connections on udp 1701 only to connections before authenticated by ipsec?
Cheers
Martin
On 04.07.2009 03:21, Martin wrote:
[...]
Quoted 5 lines
Here is a diagram, just for fun ;)
MS-client ==== /ext interface/ Linux GW /internal interface/ ==== LAN
Quoted 7 lines
What I see is that user completes ipsec auth, and then tries to connect to the l2tpd's port (7101) on the external interface, and then I must accept connections in that port, or the vpn connection fails.
Any suggestions how to let connections on udp 1701 only to connections before authenticated by ipsec?
On the openswan machine, mark the ESP packets and accept only marked packets to l2tpd daemon:
# iptables -t mangle -A PREROUTING -i $EXT_INT -p 50 -j MARK --set-mark 1 # iptables -A INPUT -i $EX_INT -m mark --mark 1 -j ACCEPT # iptables -A INPUT -i $EX_INT -p udp --dport 1701 -j DROP
Signature · 1 line
Eray
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 15 lines · Martin
2009/7/4 Eray Aslan <[email protected] <mailto:[email protected]>>
On 04.07.2009 03:21, Martin wrote:
[...]
> Any suggestions how to let connections on udp 1701 only to connections > before authenticated by ipsec?On the openswan machine, mark the ESP packets and accept only marked packets to l2tpd daemon:
# iptables -t mangle -A PREROUTING -i $EXT_INT -p 50 -j MARK --set-mark 1
# iptables -A INPUT -i $EX_INT -m mark --mark 1 -j ACCEPT # iptables -A INPUT -i $EX_INT -p udp --dport 1701 -j DROP
Quoted 6 lines
Thanks for the reply Eray.
Sadly, that doesn't seems to work, or at least I don't see any packet been mark using "iptables -L -n -v -t mangle"
Can be there something else or anything that I'm missing?
Better to reply on-list. Others might help / correct the given advice.
If counters do not increase, you need to figure out why esp packets do not match the marking line. Perhaps try logging all packets in mangle/PREROUTING for a short while and compare.
Signature · 1 line
Eray