IPsec Firewall: Difference between revisions

← Older edit

IPsec Firewall (view source)

Revision as of 23:59, 17 August 2018

1,405 bytes added , 17 August 2018

→‎top: clean up

Reedy

editor

699

edits

Revision as of 19:48, 30 July 2015 (view source) AA-Andrew (talk \| contribs) mNo edit summary ← Older edit		Latest revision as of 23:59, 17 August 2018 (view source) Reedy (talk \| contribs) (→‎top: clean up)
(6 intermediate revisions by 2 users not shown)
<indicator name="Tunnels">[[File:Menu-IPsec.svg\|link=:Category:~~FireBrick_IPsec~~FireBrick IPsec\|30px\|Back up to the FireBrick IPsec Tunnels Category Page]]</indicator> If there is no NAT involved, you need: UDP port 500 for the IKE control channel IP protocol ESP (50) for the data channel. Example: <syntaxhighlight lang=xml> <rule-set name="IPsec" source-interface="pppoe" target-interface="self" no-match-action="continue" comment="Non-NATed IPsec connections from PPP to the Brick"> <rule name="IKE" target-port="500" protocol="17" action="accept" comment="Internet Key Exchange"/> <rule name="ESP" protocol="50" action="accept" comment="Encapsulating Security Payload - encryption protocol"/> </rule-set> </syntaxhighlight> However, more likely if your devices are out on the road: If NAT has been detected, or you force IKE to believe NAT is present (see below) you need: UDP port 4500 ~~only~~ (~~no need for protocol ESP~~IKE). (no need for protocol ESP). You may need UDP port 500 too, to allow the initial contact to be made - though as soon as NAT is detected (or it has been forced) IKE switches to 4500. UDP 4500 for IKE The config force-NAT option [Note the capitalisation ] can be used to force IKE to treat the connection as if it was NATed. This is in the top-level ipsec-ike config item and you need "Show all" on the UI. Example: [[Category:FireBrick_IPsec\|Firewall]]▼ <syntaxhighlight lang=xml> <rule-set name="IPsec" source-interface="pppoe" target-interface="self" no-match-action="continue" comment="Allow NATed IPsec connections from PPP to the Brick"> <rule name="IKE" target-port="500 4500" protocol="17" action="accept" comment="Internet Key Exchange"/> </rule-set> </syntaxhighlight> You can join the two rules to create a set that will work for NAT and Non-NAT: Example: <syntaxhighlight lang=xml> <rule-set name="IPsec" source-interface="pppoe" target-interface="self" no-match-action="continue" comment="Allow NATed and Non-NATed IPsec connections from PPP to the Brick"> <rule name="IKE" target-port="500 4500" protocol="17" action="accept" comment="Internet Key Exchange"/> <rule name="ESP" protocol="50" action="accept" comment="Encapsulating Security Payload - encryption protocol"/> </rule-set> </syntaxhighlight> ▲[[Category:~~FireBrick_IPsec~~FireBrick IPsec\|Firewall]]