Date: Thu, 30 Oct 2003 14:43:42 -0800 From: "Crist J. Clark" <cristjc@comcast.net> To: security@freebsd.org, net@freebsd.org Subject: Re: Using racoon-negotiated IPSec with ipfw and natd Message-ID: <20031030224342.GA32640@blossom.cjclark.org> In-Reply-To: <20031030210509.GA667@omoikane.mb.skyweb.ca> References: <20031030210509.GA667@omoikane.mb.skyweb.ca>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Oct 30, 2003 at 03:05:09PM -0600, Mark Johnston wrote: > [ -netters, please Cc me or security@ with replies. ] > > I'm running into trouble integrating dynamic racoon-based IPSec into a network > with ipfw and natd. I need to be able to allow VPN access from any address > from authenticated clients. I've got the dynamic VPN working, with racoon > negotiating SAs and installing SPs, but the problem is that I can't tell > whether an incoming packet on the internal interface should go through natd or > not. > > The problem looks like this. I have 3 boxes, mobile, gateway, and internal, > and I'm trying to ping internal from mobile. > > - gateway receives an ESP packet from mobile (encapsulating a ping). > - gateway decrypts and transmits an ICMP packet to internal with mobile's > source address. > - internal generates the ICMP response to mobile. > - gateway receives the response, runs it through natd, and sends it out in the > clear to mobile with gateway's source address. > > The packet is going out in the clear because after natd rewrites it, its source > address is gateway's external interface - not part of the SP. This shouldn't happen. IPsec processing of the outgoing packet happens _before_ it gets passed to ipfw(8) (which hands it to natd(8)) on the external interface. > What I want to > accomplish, in pseudo-ipfw, is this: > > pass esp from any to me > pass ip from known-sp-sources to 192.168.0.0/24 > pass ip from 192.168.0.0/24 to known-sp-destinations > divert natd from 192.168.0.0/24 to any This may be your problem. That rule should be something like, divert natd from 192.168.0.0/24 to any via ${external_if} Is that what you actually have? Are you doing NAT on the internal interface? That would confuse things. > deny ip from any to 192.168.0.0/24 > pass ip from me to any keep-state > > All I'm missing is the known-sp definitions. If anyone has any pointers on > doing this, please share. If I'm going about it totally bass-ackwards, I'd > like to hear that too. :) -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20031030224342.GA32640>