From owner-freebsd-security@FreeBSD.ORG  Fri May  2 12:09:24 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id E350B37B401
	for <freebsd-security@freebsd.org>;
	Fri,  2 May 2003 12:09:24 -0700 (PDT)
Received: from cactus.fi.uba.ar (cactus.fi.uba.ar [157.92.49.108])
	by mx1.FreeBSD.org (Postfix) with ESMTP id AE9E543FAF
	for <freebsd-security@freebsd.org>;
	Fri,  2 May 2003 12:09:23 -0700 (PDT)
	(envelope-from fgleiser@cactus.fi.uba.ar)
Received: from cactus.fi.uba.ar (cactus.fi.uba.ar [157.92.49.108])
	by cactus.fi.uba.ar (8.12.3/8.12.3) with ESMTP id h42J6oBn020947;
	Fri, 2 May 2003 16:06:50 -0300 (ART)
	(envelope-from fgleiser@cactus.fi.uba.ar)
Date: Fri, 2 May 2003 16:06:50 -0300 (ART)
From: Fernando Gleiser <fgleiser@cactus.fi.uba.ar>
To: Guy Middleton <guy@obstruction.com>
In-Reply-To: <20030430165348.A23754@chaos.obstruction.com>
Message-ID: <20030502160124.Q9299-100000@cactus.fi.uba.ar>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Spam-Status: No, hits=-120.1 required=5.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT,
	      QUOTE_TWICE_1,REPLY_WITH_QUOTES,USER_IN_WHITELIST
	version=2.53
X-Spam-Checker-Version: SpamAssassin 2.53 (1.174.2.15-2003-03-30-exp)
cc: freebsd-security@freebsd.org
Subject: Re: how to configure a FreeBSD firewall to pass IPSec?
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 02 May 2003 19:09:25 -0000

On Wed, 30 Apr 2003, Guy Middleton wrote:

>
> Ok, now I'm confused.  The same client (Cisco VPN 3.5 on Windows) works
> through a LinkSys router / NAT gateway (a BEFSR81) at a different location.
> The LinkSys even has a friendly little check-box to allow IPSec pass-through.
>
> I would like the FreeBSD gateway to work the same way as the LinkSys.

I have set up both Cisco and Checkpoint VPNs behind a FreeBSD router/firewall
runing IPFilter using both ESP and UDP encapsulation. It works like a charm.
In the ESP case, I have to 'bimap' (one to one NAT) the internal host
to an external IP. The UDP encapsulated case worked right out of the box.


			Fer