VPN using ESP protocol, problems with firewall

Hi again,
I've been trying to enable VPN access from my laptop on my home network
through my RH7.2 Router/Firewall without much success.
I'm use a Cisco VPN application on the Win2K laptop that has settings
for transparent tunneling using either UDP (default), or TCP. The
documentation for this application says that it will not work with a
stateful firewall, hence I'm using IPCHAINS.

There are two phases to using the VPN. 1) loggin in, and 2) accessing
services from the remote site like mail etc. I am able to successfully
log in to the remote site. Using ethereal, I am able to see a two-way
communication via UDP during this setup phase.

When I open my mail application, everything grinds to a halt. Ethereal
tells me that my laptop is sending numerous packets that are being
blocked by my IPCHAINS firewall. I.e, the packets appear on the local
network side of the firewall, but not on the 'outside' interface.

Ethereal says that the protocol for these packets is "ESP", and the
protocol number is 0x32. In my firewall, I have tried to allow these
packets through. I think the following rules should allow traffic from
the remote VPN machine to pass through my firewall.

$IPC -A input -i $EXTIF -p 50 -s {addr.of.remote.VPN} -j ACCEPT
$IPC -A output -i $INTIF -p 50 -s {addr.of.remote.VPN} -j ACCEPT

There are similar rules for outbound traffic from my laptop to the
remote server.

$IPC -A input -i $INTIF -p 50 -d {addr.of.remote.VPN} -j ACCEPT
$IPC -A output -i $EXTIF -p 50 -d {addr.of.remote.VPN} -j ACCEPT

There doesn't appear to be a standard UDP port number associated with
these packets.

A couple of questions.
1)If I look in the /etc/protocols file, it tells me that protocol 50
(0x32) is called "IPv6-Crypt" yet ethereal says that these packets are
"ESP". I tried putting "-p ESP" in the chains rules above and got
errors saying that there was no such protocol. The /etc/protocols file
contains no listing for ESP. That was why I tried to use the protocol
number. Are ESP and IPv6-Crypt the same thing? (I'm not using IPv6)

2) Does anyone see anything wrong with the rules I've listed above?

Any help would greatly appreciated

Thanks
Jon Rook

On Thu, 14 Aug 2003, Jon Rook wrote:

> Hi again,
> I've been trying to enable VPN access from my laptop on my home network
> through my RH7.2 Router/Firewall without much success.
> I'm use a Cisco VPN application on the Win2K laptop that has settings
> for transparent tunneling using either UDP (default), or TCP. The
> documentation for this application says that it will not work with a
> stateful firewall, hence I'm using IPCHAINS.

You appear to be using an IPSEC VPN which is neither a UDP VPN nor a TCP
VPN. Unless you have the appropriate configuration for IPSEC MASQ, it
won't work (assuming your router/firewall is a NAT/MASQ firewall). At one
time, this required a kernel patch -- I don't know if it was ever
incorporated into the standard kernel.

You can write a mixture of stateful and non-stateful rules with IPTABLES.
There is no need to use IPCHAINS.

>
> There are two phases to using the VPN. 1) loggin in, and 2) accessing
> services from the remote site like mail etc. I am able to successfully
> log in to the remote site. Using ethereal, I am able to see a two-way
> communication via UDP during this setup phase.
>
> When I open my mail application, everything grinds to a halt. Ethereal
> tells me that my laptop is sending numerous packets that are being
> blocked by my IPCHAINS firewall. I.e, the packets appear on the local
> network side of the firewall, but not on the 'outside' interface.
>
> Ethereal says that the protocol for these packets is "ESP", and the
> protocol number is 0x32. In my firewall, I have tried to allow these
> packets through. I think the following rules should allow traffic from
> the remote VPN machine to pass through my firewall.
>
> $IPC -A input -i $EXTIF -p 50 -s {addr.of.remote.VPN} -j ACCEPT
> $IPC -A output -i $INTIF -p 50 -s {addr.of.remote.VPN} -j ACCEPT
>

You need to enable Protocol 51 as well.


> There are similar rules for outbound traffic from my laptop to the
> remote server.
>
> $IPC -A input -i $INTIF -p 50 -d {addr.of.remote.VPN} -j ACCEPT
> $IPC -A output -i $EXTIF -p 50 -d {addr.of.remote.VPN} -j ACCEPT

You need to enable Protocol 51 as well.
>