Ok, i've done some reconfiguration and testing.
1. I don't know how to make ipcomp work.
- Suggeted tunnels line doesn't work, as I have to allow traffic from
net, not from vpn zone
- if I use
ipip net <router address>
it still doesn't work, as it translates to rule "ACCEPT 4" (4 is proto
field) in "net-fw" chain, which is called with "ipsec pol none" option in
"eth0_in" chain
And while syslog shows it in REJECTED, proto 4, tshark shows it as ESP, so
I believe packets still don't hit the chain!
So I second my question - could I in any way remove "ipsec pol none" OR use
some combined tunnel mode "ipsec and ipip" or better yet could you add
proto 4 to proto list when compiling ipsec tunnel?
2. With ipcomp turned off, things work smoothly, thank you very much.
Could I suggest add some strongswan configuration options to shorewall
ipsec documentation, as it goes by default in debian systems?
i.e. I use:
compress = no # to disable ipcomp
leftfirewall = no # to leave shorewall manage the iptables
If you'd like to add the strongswan article, i could provide working
configs for strongswan and shorewall
And the ipcomp question stills open.
Thank you!
2016-12-03 23:03 GMT+03:00 John Depp <[email protected]>:
> Thanks alot! I'll give it a try in a day or two - with ipsecnat and
> compression turned off also.
> ------------------------------
> От: Tuomo Soini <[email protected]>
> Отправлено: 03.12.2016 14:01
> Кому: John Depp <[email protected]>
> Копия: Shorewall Users <[email protected]>
> Тема: Re: [Shorewall-users] shorewall and Strongswan -
> possibleincompatibility?
>
> On Wed, 30 Nov 2016 13:30:46 +0300
> John Depp <[email protected]> wrote:
>
> > Sorry for delay
> > I'm pretty sure those proto 4 IPIP is ESP packets - I was using ping
> > for testing and was capturing them with tshark, and they were marked
> > ESP there.
>
> ipcomp causes that. If you want to allow that, you need to add
> following to tunnels:
>
> ipip vpn 0.0.0.0/0
>
> Of course if your IPsec zone is vpn.
>
> But I'd like to warn that many latish crypto security problems are
> related to compression with encryption so I'd suggest disabling ipcomp.
>
> Also note that usually tunnel type ipsecnat is what you want instead of
> tunnel type ipsec.
>
> --
> Tuomo Soini <[email protected]>
> Foobar Linux services
> +358 40 5240030
> Foobar Oy <http://foobar.fi/>
>
------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
