-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 11/28/2016 01:38 AM, John Depp wrote: > Hello everyone! I'm using Debian, Shorewall and Stongswan on my > linux routers. It seems Shorewall don't allow input of ESP packets, > formed by ipsec initiated by Strongswan. > > I have the following line tunnels: > > #TYPE ZONE GATEWAY GATEWAY_ZONE ipsec > net xx.xx.xx.51 > > it compiles to the following iptables rules: > > ... Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target > prot opt in out source destination 107 28045 eth0_in all > -- eth0 * 0.0.0.0/0 <http://0.0.0.0/0> > 0.0.0.0/0 <http://0.0.0.0/0> ... Chain eth0_in (1 references) pkts > bytes target prot opt in out source destination > ... 101 27583 net-fw all -- * * 0.0.0.0/0 > <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0> > policy match dir in pol none ... Chain net-fw (1 references) pkts > bytes target prot opt in out source destination > 12 2213 ACCEPT all -- * * 0.0.0.0/0 > <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0> > ctstate RELATED,ESTABLISHED 0 0 ACCEPT esp -- * * > xx.xx.xx.51 0.0.0.0/0 <http://0.0.0.0/0> 0 0 ACCEPT udp -- > * * xx.xx.xx.51 0.0.0.0/0 <http://0.0.0.0/0> > udp dpt:500 ctstate NEW,UNTRACKED > > And the packets never hit the net-fw chain, rejected by policy: Nov > 28 12:24:47 gw kernel: [9640691.231945] > Shorewall:INPUT:REJECT:IN=eth0 OUT= MAC=00: SRC=xx.xx.xx.51 > DST=<router> LEN=86 TOS=0x00 PREC=0x00 TTL=62 ID=61247 PROTO=4 > > In the case I use the "leftfirewall=yes" option in Strongswan > config, which inserts it's native iptables rules, it inserts the > following: Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes > target prot opt in out source destination ... 0 0 > ACCEPT 4 -- eth0 * xx.xx.xx.51 <router> > policy match dir in pol ipsec reqid 2 proto 50 > > So I assume there should be no "policy match dir in pol none" > option in eth0_in chain to correctly process ipsec packets. > Similarly, if I add some rules like ACCEPT net:xx.xx.xx.0/16 > $FW ah ACCEPT net:xx.xx.xx.0/16 $FW > esp packets never hit those rules too as they are compiled into > net-fw chain. > > So, is there any option to turn off "policy match dir in pol none" > option in eth0_in chain or am I completely mistaken of the issue? >
Do you have nested tunnels here? Normally, ESP packets would not themselves require 'pol ipsec'. - -Tom - -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJYPGRTAAoJEJbms/JCOk0QkPwP+gMPp9wvgI+k2Uju679BES09 gz8r5yPXPgvyrrSAlS60w6rLAmhOabcbQt36avodjUWf7CpR+RQPscd9K2dmhqRm pkUzOfKBqqjkxFSpQnVkju6nJz1oJENa4SAZapjVGYG1czGyDa+FTSaIXkL4+IbH trEkNQLXdQkLyANXEnH36J5k2HUsgRjg6kKqOMh048c6cAJC8u46NbO1Fl/X6DUs cJTT/E17W66AiyLohjBpCPednqmizLj0ScfHKAysvlRWgdV9/rEMyzWs3B0ZLKqz oBOuHJBz/qdKtur19fqvffp8gGPEYtX3z9xdu7AmLjvTO89PIdrractc/y5fkB8j xq4kIo1JzWs0pbsBEcQXMruW+RY49dGQzSmJDgkBllyjba5h50+nVD2tA8DgnfYV 1eG09Kss/5nc7qHfwCem3cWwnpykdK7s0P/WLuLHVV3r/EzIOlyt/LBM7iRUkJiZ gwXqoe9nZ+5zNueN4Y8ykLZHXDvzT7XTtHWLmnCQy30XkqXTRajc0eW4m5rN+zng ooBoYbJJiPKWeQIyNVlCj0PjNx9cbvqXct6fBvY8aJVyu3dbVi7NvHeRrj6VI8j6 0Kc3aXropAhYODsBkpIJFC0oJvJJS8yfHHB40g8arJ9bH0sc655slOYYB/elRwdV idTWROgT/q0ls2FUSY1C =uQj2 -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
