LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 01-07-2010, 06:14 PM   #1
ecvoyager
LQ Newbie
 
Registered: May 2009
Posts: 2

Rep: Reputation: 0
How to set iptables for IPSec tunnel?


I want to setup firewall protection with iptables to support IPSec tunnels. That is, the firewall will drop anything from any host if it is not from an established IPSec tunnel. And it will accept anything (any protocols) if it's from an IPSec tunnel.

I tried:
iptables -N my-fw
iptables -A my-fw -p esp -j ACCEPT
iptables -A my-fw -p tcp --sport 500 --dport 500 -j ACCEPT
iptables -A my-fw -j DROP

iptables -A INPUT -i eth0 -j my-fw

Then I tried to ping from one end of the tunnel to the other end of the tunnel and ping didn't go through. I need to modify my rules as below to make it work:

iptables -N my-fw
iptables -A my-fw -p esp -j ACCEPT
iptables -A my-fw -p icmp -j ACCEPT
iptables -A my-fw -p udp --sport 500 --dport 500 -j ACCEPT
iptables -A my-fw -p tcp --sport 500 --dport 500 -j ACCEPT
iptables -A my-fw -j DROP

iptables -A INPUT -i eth0 -j my-fw

That is, I need also to open up ping to make ping work. But if I open up icmp, I cannot prevent pings from hosts that's outside my IPSec tunnels. This defeats my purpose.

So if my purpose is to allow "anything" within the tunnel and disallow/drop anything outside the IPSec tunnels, how should I setup the iptables rules?

Eric

Last edited by ecvoyager; 01-07-2010 at 06:16 PM.
 
Old 01-09-2010, 05:08 PM   #2
nimnull22
Senior Member
 
Registered: Jul 2009
Distribution: OpenSuse 11.1, Fedora 14, Ubuntu 12.04/12.10, FreeBSD 9.0
Posts: 1,571

Rep: Reputation: 92
Please read documentation for iptables.
Code:
AH match options
Match:	--ahspi
Kernel:	2.5 and 2.6
Example:	iptables -A INPUT -p 51 -m ah --ahspi 500
Explanation:	This matches the AH Security Parameter Index (SPI) number of the AH
packets. Please note that you must specify the protocol as well, since AH runs on a
different protocol than the standard TCP, UDP or ICMP protocols. The SPI number is used in
conjunction with the source and destination address and the secret keys to create a
security association (SA). The SA uniquely identifies each and every one of the IPSEC
tunnels to all hosts. The SPI is used to uniquely distinguish each IPSEC tunnel connected
between the same two peers. Using the --ahspi match, we can match a packet based on
the SPI of the packets. This match can match a whole range of SPI values by using a : sign,
such as 500:520, which will match the whole range of SPI's.

ESP match options
Match:	--espspi
Kernel:	2.5 and 2.6
Example:	iptables -A INPUT -p 50 -m esp --espspi 500
Explanation:	The ESP counterpart Security Parameter Index (SPI) is used exactly the
same way as the AH variant. The match looks exactly the same, with the esp/ah difference.
Of course, this match can match a whole range of SPI numbers as well as the AH variant of
the SPI match, such as --espspi 200:250 which matches the whole range of SPI's.

Last edited by nimnull22; 01-09-2010 at 05:10 PM.
 
Old 01-11-2010, 01:42 PM   #3
ecvoyager
LQ Newbie
 
Registered: May 2009
Posts: 2

Original Poster
Rep: Reputation: 0
My problem is not in the IPSec part of the packets. My firewall can let that pass. Here is a tcpdump output for "one" ping through the tunnel:

11:33:27.250840 IP 192.168.1.1 > 192.168.1.2: ESP(spi=0xca2bb69b,seq=0x1b), length 132
11:33:27.252285 IP 192.168.1.2 > 192.168.1.1: ESP(spi=0xc2e92c6a,seq=0x1b), length 132
11:33:27.252285 IP 192.168.1.2 > 192.168.1.1: ICMP echo reply, id 53521, seq 27, length 64

Note the 3rd packet is an icmp ping. So tcpdump see 2 esp packets plus one icmp, I guess the icmp packet is after the kernel de-capsulate the icmp from the IPSec payload and then refeed it into the iptables INPUT queue. How do I differentiate this icmp from a normal icmp?

Eric

Quote:
Originally Posted by nimnull22 View Post
Please read documentation for iptables.
Code:
AH match options
Match:	--ahspi
Kernel:	2.5 and 2.6
Example:	iptables -A INPUT -p 51 -m ah --ahspi 500
Explanation:	This matches the AH Security Parameter Index (SPI) number of the AH
packets. Please note that you must specify the protocol as well, since AH runs on a
different protocol than the standard TCP, UDP or ICMP protocols. The SPI number is used in
conjunction with the source and destination address and the secret keys to create a
security association (SA). The SA uniquely identifies each and every one of the IPSEC
tunnels to all hosts. The SPI is used to uniquely distinguish each IPSEC tunnel connected
between the same two peers. Using the --ahspi match, we can match a packet based on
the SPI of the packets. This match can match a whole range of SPI values by using a : sign,
such as 500:520, which will match the whole range of SPI's.

ESP match options
Match:	--espspi
Kernel:	2.5 and 2.6
Example:	iptables -A INPUT -p 50 -m esp --espspi 500
Explanation:	The ESP counterpart Security Parameter Index (SPI) is used exactly the
same way as the AH variant. The match looks exactly the same, with the esp/ah difference.
Of course, this match can match a whole range of SPI numbers as well as the AH variant of
the SPI match, such as --espspi 200:250 which matches the whole range of SPI's.
 
Old 01-11-2010, 08:39 PM   #4
nimnull22
Senior Member
 
Registered: Jul 2009
Distribution: OpenSuse 11.1, Fedora 14, Ubuntu 12.04/12.10, FreeBSD 9.0
Posts: 1,571

Rep: Reputation: 92
Are you sure that tcpdump works after packets were extracted from IPSec flow?
And why you think that ICMP was inserted into IPSec?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
IPsec one to many ike tunnel config Damoek AIX 0 05-16-2009 10:07 AM
Problem with iptables and policy based IPSec tunnel. rustyscott Linux - Networking 1 01-13-2009 11:13 PM
IPsec fails to open tunnel KaMakani Linux - Networking 0 10-12-2005 11:54 PM
IPSEC Tunnel behind NAT pssst_yeah_you Linux - Networking 0 06-23-2004 04:54 PM
2.6 IPSEC Tunnel mode gateway mhiggins Linux - Networking 1 02-28-2004 01:50 PM


All times are GMT -5. The time now is 02:49 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration