From owner-freebsd-security Thu Nov 2 5: 1:22 2000 Delivered-To: freebsd-security@freebsd.org Received: from point.osg.gov.bc.ca (point.osg.gov.bc.ca [142.32.102.44]) by hub.freebsd.org (Postfix) with ESMTP id A9F3D37B479 for ; Thu, 2 Nov 2000 05:01:18 -0800 (PST) Received: (from daemon@localhost) by point.osg.gov.bc.ca (8.8.7/8.8.8) id FAA02579; Thu, 2 Nov 2000 05:01:16 -0800 Received: from passer.osg.gov.bc.ca(142.32.110.29) via SMTP by point.osg.gov.bc.ca, id smtpda02577; Thu Nov 2 05:01:09 2000 Received: (from uucp@localhost) by passer.osg.gov.bc.ca (8.11.0/8.9.1) id eA2D19Z04660; Thu, 2 Nov 2000 05:01:09 -0800 (PST) Received: from cwsys9.cwsent.com(10.2.2.1), claiming to be "cwsys.cwsent.com" via SMTP by passer9.cwsent.com, id smtpdJV4655; Thu Nov 2 05:00:55 2000 Received: (from uucp@localhost) by cwsys.cwsent.com (8.11.1/8.9.1) id eA2D0s433714; Thu, 2 Nov 2000 05:00:54 -0800 (PST) Message-Id: <200011021300.eA2D0s433714@cwsys.cwsent.com> Received: from localhost.cwsent.com(127.0.0.1), claiming to be "cwsys" via SMTP by localhost.cwsent.com, id smtpdT33685; Thu Nov 2 04:59:54 2000 X-Mailer: exmh version 2.2 06/23/2000 with nmh-1.0.4 Reply-To: Cy Schubert - ITSD Open Systems Group From: Cy Schubert - ITSD Open Systems Group X-OS: FreeBSD 4.1.1-RELEASE X-Sender: cy To: anderson@centtech.com Cc: security Subject: Re: pipsecd - thru port In-reply-to: Your message of "Wed, 01 Nov 2000 08:45:12 CST." <3A002C78.7F3537D4@centtech.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Thu, 02 Nov 2000 04:59:54 -0800 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org In message <3A002C78.7F3537D4@centtech.com>, Eric Anderson writes: > I'm using ipsec (with pipsecd on two FreeBSD 4.1 machines) to build a > VPN. I need to go thru a firewall, but I don't know which ports to > forward thru, or if this is even possible.. So here's what I want to do: > > ----- ----- ------ > | A | -----|FW |------| B | > ----- ----- ------ > > machine A is a freebsd box inside the firewall (FW), B is the freebsd > box outside the firewall attempting to connect to A thru FW, in other > words, B thinks its connecting to FW port XX, but FW forwards port XX to > port XX on A, connecting the vpn thru the FW.. I currently have VPN's > set up with linux boxen with the SSH+PPP method, which works alright, it > would just work a LOT better with ipsec and such.. So, what ports do i > need to forward on FW to make this all work? Pipsecd and IPsec use ESP and AH, protocols 50 & 51 (/etc/protocols), NOT services (ports as in /etc/services) 50 & 51. Your firewall must be configured to pass packets matching the protocol. As a picture is worth a thousand words, here are samples from one of my IP Filter firewalls. pass in quick on xl0 proto esp from EXTERNAL_IP_ADDR to any pass out quick on xl0 proto esp from any to EXTERNAL_IP_ADDR pass in quick on xl0 proto ah from EXTERNAL_IP_ADDR to any pass out quick on xl0 proto ah from any to EXTERNAL_IP_ADDR Regards, Phone: (250)387-8437 Cy Schubert Fax: (250)387-5766 Team Leader, Sun/DEC Team Internet: Cy.Schubert@osg.gov.bc.ca Open Systems Group, ITSD, ISTA Province of BC To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message