Date: Thu, 20 Oct 2005 23:25:30 +0100 (BST) From: Vince Hoffman <jhary@unsane.co.uk> To: Holm Tiffe <holm@freibergnet.de> Cc: freebsd-net@freebsd.org Subject: Re: urgent: RELENG_5 ipfw/nat/IPSEC Problem.. Message-ID: <20051020225940.H16510@unsane.co.uk> In-Reply-To: <20051019180114.GB38872@pegasus.freiberg-net.de> References: <20051019180114.GB38872@pegasus.freiberg-net.de>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 19 Oct 2005, Holm Tiffe wrote:
> Hi,
>
> I have a currently big problem with the following setup:
>
> A FreeBSD Box, running 5_STABLE is connected wirh one interface to the
> public, with the other to an nated' subnet with private address space.
> I need to allow at least one host from inside the private network access
> to an outside Cisco VPN concentrator. I've learned in the meantime, that
> allowing udp connections from inside to the outside net and vis versa is'nt
> doing the job.
> (I've struggeled in the meantime over tcpdump, that is showing isakmp
> packets leaving the external interface, but they dont't really do this..)
>
> What exactly I have to do get this working?
>
What I found I needed to do to connect to the work Cisco VPN through my
FreeBSD NAT firewall was to tell it not to NAT the source port of the
isakmp packets, as isakmps need to have source and destination port 500.
using pf the command is (taken from man pf.conf)
# Map outgoing packets' source port to an assigned proxy port instead of
# an arbitrary port.
# In this case, proxy outgoing isakmp with port 500 on the gateway.
nat on $ext_if inet proto udp from any port = isakmp to any -> ($ext_if) \
port 500
Not sure about the same for ipfw/natd but i'm sure its doable.
Vince
> The FreeBSD Box is out of reach (around 50km from here), I can't access the
> hosts on the inside network and I dont't have access to the cisco
> concentrator, so I can't test different setups ..
>
> Can please anyone help?
>
> Regards,
>
> Holm
>
> ps: please Cc me, I've currently not subscribed to this list.
> --
> L&P::Kommunikation GbR Holm Tiffe * Administration, Development
> FreibergNet.de Internet Systems phone +49 3731 419010
> Bereich Server & Technik fax +49 3731 4196026
> D-09599 Freiberg * Am St. Niclas Schacht 13 http://www.freibergnet.de
>
> _______________________________________________
> freebsd-net@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20051020225940.H16510>