IPsec Firewall: Difference between revisions

← Older edit

IPsec Firewall (view source)

Revision as of 23:59, 17 August 2018

1,477 bytes added , 17 August 2018

→‎top: clean up

Reedy

editor

699

edits

Revision as of 14:51, 26 June 2015 (view source) AA-Andrew (talk \| contribs) mNo edit summary ← Older edit		Latest revision as of 23:59, 17 August 2018 (view source) Reedy (talk \| contribs) (→‎top: clean up)
(12 intermediate revisions by 2 users not shown)
<indicator name="~~FireBrick~~ Tunnels">[[File:~~FBimgtunnel~~Menu-IPsec.svg\|link=:Category:~~FireBrick_Tunnels~~FireBrick IPsec\|30px\|Back up to the FireBrick IPsec Tunnels Category Page]]</indicator> If there is no NAT involved, you need ~~UDP port 500 for the IKE control channel, and IP protocol ESP for the data channel.~~: UDP port 500 for the IKE control channel IP protocol ESP (50) for the data channel. Example: If NAT has been detected, or you force IKE to believe NAT is present (see below) you need UDP port 4500 only (no need for protocol ESP). You may need UDP port 500 too, to allow the initial contact to be made - though as soon as NAT is detected (or it has been forced) IKE switches to 4500.▼ <syntaxhighlight lang=xml> <rule-set name="IPsec" source-interface="pppoe" target-interface="self" no-match-action="continue" comment="Non-NATed IPsec connections from PPP to the Brick"> <rule name="IKE" target-port="500" protocol="17" action="accept" comment="Internet Key Exchange"/> <rule name="ESP" protocol="50" action="accept" comment="Encapsulating Security Payload - encryption protocol"/> </rule-set> </syntaxhighlight> However, more likely if your devices are out on the road: If NAT has been detected, or you force IKE to believe NAT is present (see below) you need: UDP port 4500 (IKE) (no need for protocol ESP). ▲~~If NAT has been detected, or you force IKE to believe NAT is present (see below) you need UDP port 4500 only (no need for protocol ESP).~~ *You may need UDP port 500 too, to allow the initial contact to be made - though as soon as NAT is detected (or it has been forced) IKE switches to 4500. The config force-NAT option [Note the capitalisation ] can be used to force IKE to treat the connection as if it was NATed. This is in the top-level ipsec-ike config item and you need "Show all" on the UI. Example: <syntaxhighlight lang=xml> <rule-set name="IPsec" source-interface="pppoe" target-interface="self" no-match-action="continue" comment="Allow NATed IPsec connections from PPP to the Brick"> <rule name="IKE" target-port="500 4500" protocol="17" action="accept" comment="Internet Key Exchange"/> </rule-set> </syntaxhighlight> You can join the two rules to create a set that will work for NAT and Non-NAT: Example: <syntaxhighlight lang=xml> <rule-set name="IPsec" source-interface="pppoe" target-interface="self" no-match-action="continue" comment="Allow NATed and Non-NATed IPsec connections from PPP to the Brick"> <rule name="IKE" target-port="500 4500" protocol="17" action="accept" comment="Internet Key Exchange"/> <rule name="ESP" protocol="50" action="accept" comment="Encapsulating Security Payload - encryption protocol"/> </rule-set> </syntaxhighlight> [[Category:FireBrick IPsec\|Firewall]]