Hi All!

I am having trouble setting up my VPN with IPSec BUT i do have a strange set up ... here it is..

Internal Network - Watchguard - Linux - Internet - Host

Basically what happens is this, the watchguard box authenticates the VPN log ins and my linux box acts as a second firewall and a router. Using NAT

I have got it to work as far as the watchguard firebox authenticates the user via the linux firewall forwarding all the relevant data to it BUT when the watchguard sends a reply back to the client it isnt getting there. I think its my linux box which is blocking the data getting to the client.

Does anyone know of rules that will allow the data back out??

ps. The data ports the watchguard needs are ...
udp 500
ip 50 (ESP)
ip51 (AH)

I dont think your going to be able to run this like you want. Since NATting manipulates the packet headers, the IPSEC wont work right. You have two choices here:

1) Move your vpn server to the linux box. You can run Freeswan (IPSEC for linux) on the linux box and do something else with Watchguard.

2) Trade places with the Linux box and Watchguard. Have Watchguard sitting on the internet with Linux behind it.

IPSEC needs to be implemented on the Linux Firewall/router or after it. If NAT gets a hold of an IPSEC packet it will basically render it useless.