Re: [OT] Connection tracking for IPSec

[Christophe Saout <christophe@saout.de>]

Am Mi, 2003-08-20 um 13.22 schrieb Felipe Alfaro Solana:

> When using IPSec, if I open up protocols 50 and 51, all IPSec-protected
> traffic passes through the firewall, but it's not checked against the
> connection tracking module. How can I configure iptables so an
> IPSec-protected packet, after being classified as IP protocol 50 or 51,
> loop back one more time to pass through the connection tracking module?

You're saying it's not honouring the netfilter rules at all?

I'm having a related problem here. I switched my small home
server/router to the 2.6 kernel and switched from klips(freeswan) to the
new in-kernel ipsec. Racoon is working fine as keying daemon but the
netfilter rules don't work anymore.

I'm using it to encrypt between a single server in the internet (not a
network) and my router at home. I want it to masquerade the traffic from
my internal home network to the other machine, just like if there was no
encrypted path.

It doesn't work. The traffic from my internal network goes out
masqueraded but unencrypted and the other machine answers, but
encrypted, and on the return path my router at home throws the packet
away because it doesn't know what to do with that packet.

With klips it was possible to apply netfilter rules before and after the
packets got encrypted, because there was an additional virtual device
(ipsec0) that catches the traffic before encryption (or after
decryption).

--
Christophe Saout <christophe@saout.de>
Please avoid sending me Word or PowerPoint attachments.
See http://www.fsf.org/philosophy/no-word-attachments.html