urgent: RELENG_5 ipfw/nat/IPSEC Problem..

[Vince Hoffman]

On Wed, 19 Oct 2005, Holm Tiffe wrote:

> Hi,
>
> I have a currently big problem with the following setup:
>
> A FreeBSD Box, running 5_STABLE is  connected wirh one interface to the
> public, with the other to an nated' subnet with private address space.
> I need to allow at least one host from inside the private network access
> to an outside Cisco VPN concentrator. I've learned in the meantime, that
> allowing udp connections from inside to the outside net and vis versa is'nt
> doing the job.
> (I've struggeled in the meantime over tcpdump, that is showing isakmp
> packets leaving the external interface, but they dont't really do this..)
>
> What exactly I have to do get this working?
>

What I found I needed to do to connect to the work Cisco VPN through my 
FreeBSD NAT firewall was to tell it not to NAT the source port of the 
isakmp packets, as isakmps need to have source and destination port 500.
using pf the command is (taken from man pf.conf)

# Map outgoing packets' source port to an assigned proxy port instead of
# an arbitrary port.
# In this case, proxy outgoing isakmp with port 500 on the gateway.
nat on $ext_if inet proto udp from any port = isakmp to any -> ($ext_if) \
            port 500

Not sure about the same for ipfw/natd but i'm sure its doable.


Vince


> The FreeBSD Box is out of reach (around 50km from here), I can't access the
> hosts on the inside network and I dont't have access to the cisco
> concentrator, so I can't test different setups ..
>
> Can please anyone help?
>
> Regards,
>
> Holm
>
> ps: please Cc me, I've currently not subscribed to this list.
> -- 
> L&P::Kommunikation GbR          Holm Tiffe  * Administration, Development
> FreibergNet.de Internet Systems                     phone +49 3731 419010
> Bereich Server & Technik                             fax +49 3731 4196026
> D-09599 Freiberg * Am St. Niclas Schacht 13     http://www.freibergnet.de
>
> _______________________________________________
> freebsd-net at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe at freebsd.org"
>