On Thu, Oct 30, 2003 at 03:05:09PM -0600, Mark Johnston wrote:
> [ -netters, please Cc me or security@ with replies. ]
>
> I'm running into trouble integrating dynamic racoon-based IPSec into a network
> with ipfw and natd. I need to be able to allow VPN access from any address
> from authenticated clients. I've got the dynamic VPN working, with racoon
> negotiating SAs and installing SPs, but the problem is that I can't tell
> whether an incoming packet on the internal interface should go through natd or
> not.
>
> The problem looks like this. I have 3 boxes, mobile, gateway, and internal,
> and I'm trying to ping internal from mobile.
>
> - gateway receives an ESP packet from mobile (encapsulating a ping).
> - gateway decrypts and transmits an ICMP packet to internal with mobile's
> source address.
> - internal generates the ICMP response to mobile.
> - gateway receives the response, runs it through natd, and sends it out in the
> clear to mobile with gateway's source address.
>
> The packet is going out in the clear because after natd rewrites it, its source
> address is gateway's external interface - not part of the SP.
This shouldn't happen. IPsec processing of the outgoing packet happens
_before_ it gets passed to ipfw(8) (which hands it to natd(8)) on the
external interface.
> What I want to
> accomplish, in pseudo-ipfw, is this:
>
> pass esp from any to me
> pass ip from known-sp-sources to 192.168.0.0/24
> pass ip from 192.168.0.0/24 to known-sp-destinations
> divert natd from 192.168.0.0/24 to any
This may be your problem. That rule should be something like,
divert natd from 192.168.0.0/24 to any via ${external_if}
Is that what you actually have? Are you doing NAT on the internal
interface? That would confuse things.
> deny ip from any to 192.168.0.0/24
> pass ip from me to any keep-state
>
> All I'm missing is the known-sp definitions. If anyone has any pointers on
> doing this, please share. If I'm going about it totally bass-ackwards, I'd
> like to hear that too. :)
--
Crist J. Clark | [EMAIL PROTECTED]
| [EMAIL PROTECTED]
http://people.freebsd.org/~cjc/ | [EMAIL PROTECTED]
_______________________________________________
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
