8:54 a.m.
I'm retired firestarter, I picked it up recently as it was orphaned
but as we are moving towards PolicyKit and there's no upstream to
assist with the port and after a discussion we had here on the list I
decided it was time to retire it.
Now, with that being said, I have some users on the firestarter-users
mailing list that have some features they would like to request and I
wanted to pose a couple questions here in respect to their requests
and find out if others feel that these requests are feasible and/or
are even in the scope of system-config-firewall.
1) Cisco VPN
I don't use this myself but I was told it just needs these rules, so I
don't see a big issue here:
$IPT -A FORWARD -i $IF -o $INIF -p udp --dport 500 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $IF -o $INIF -p tcp --dport 500 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $IF -o $INIF -p 50 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $INIF -o $IF -p 50 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
2) Auto setup of "Internet Sharing", so autoconfig of dhcpd and
providing a bridge between WAN and LAN. This is one that I'm not
entirely sure there is really in the scope of system-config-firewall
and might need to be its own utility.
Those are really the only two that have been reported to me, just
looking for advisement from the group before I go off and start trying
to hack something together.
Thanks,
-Adam
--
http://maxamillion.googlepages.com
---------------------------------------------------------
() ascii ribbon campaign - against html e-mail
/\ www.asciiribbon.org - against proprietary attachments
4:05 p.m.
On 06/12/2009 04:54 PM, Adam Miller wrote:
I'm retired firestarter, I picked it up recently as it was
orphaned
but as we are moving towards PolicyKit and there's no upstream to
assist with the port and after a discussion we had here on the list I
decided it was time to retire it.
Now, with that being said, I have some users on the firestarter-users
mailing list that have some features they would like to request and I
wanted to pose a couple questions here in respect to their requests
and find out if others feel that these requests are feasible and/or
are even in the scope of system-config-firewall.
1) Cisco VPN
I don't use this myself but I was told it just needs these rules, so I
don't see a big issue here:
$IPT -A FORWARD -i $IF -o $INIF -p udp --dport 500 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $IF -o $INIF -p tcp --dport 500 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $IF -o $INIF -p 50 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $INIF -o $IF -p 50 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
This is more or less standard IPSEC. port 500/udp is used for IKE and
proto 50 is esp. I have not seen 500/tcp ever to be used, but I think
that Cisco's client can use it. openswan for sure does not use tcp.
Only problem is that cisco's vpn client can use _any_ port for
communication, it depends solely on the way the VPN concentrator is
configured. In the company I work for, the client is configured to use a
high port, and we can switch between tcp and udp at will. What I want to
say here is that blindly adding port 500 "because we know it's used"
might lead to unpleasant surprises (as in "we added the rule but the
client does not work")
2) Auto setup of "Internet Sharing", so autoconfig of dhcpd
and
providing a bridge between WAN and LAN. This is one that I'm not
entirely sure there is really in the scope of system-config-firewall
and might need to be its own utility.
not sure what to say here. A tool to do that would be nice, but I do not
think that s-c-f is _that_ tool either
8:09 p.m.
Adam Miller wrote:
1) Cisco VPN
I don't use this myself but I was told it just needs these rules, so I
don't see a big issue here:
$IPT -A FORWARD -i $IF -o $INIF -p udp --dport 500 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $IF -o $INIF -p tcp --dport 500 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $IF -o $INIF -p 50 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $INIF -o $IF -p 50 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
Hmm... $DAYJOB uses Cisco VPN, and the only rule I seem to have for it is:
-A INPUT -i cipsec0 -m state --state RELATED,ESTABLISHED -j ACCEPT
(...and similar in FORWARD, as this box is a gateway router)
Either vpnc auto-manages the needed rules, or open port 500 isn't
universally required.
2) Auto setup of "Internet Sharing", so autoconfig of dhcpd
and
providing a bridge between WAN and LAN. This is one that I'm not
entirely sure there is really in the scope of system-config-firewall
and might need to be its own utility.
Maybe. As above, I've done it by hand and it's not trivial (not hard,
but requires more than one thing set up). You can pick defaults for many
things, but to set up forwarding you need:
- forwarding on in kernel (/etc/sysctl.conf)
- iptables rules
- configure dnsmasq (else fiddling with updating dns servers via dhcp is
a pain)
- configure dhcpd (or use dnsmasq)
- somehow ask user or guess what is external, internal interfaces
(Don't forget to bind dnsmasqd/dhcpd to the lan interface, please!)
And it should ideally let you configure (in advanced mode):
- specify net/subnet and ranges for dhcp
- static hosts for dhcp
- forwarded ports other machines in the LAN
FWIW, 'doze apparently has point-and-click internet connection sharing,
so this would be a good thing to address.
Say, how come s-c-f isn't merged into NM yet? ;-)
--
Matthew
Please do not quote my e-mail address unobfuscated in message bodies.
--
"The spiraling shape will make you go insane!" -- They Might Be Giants
8:20 a.m.
Hi.
On Fri, 12 Jun 2009 08:54:00 -0500, Adam Miller wrote
1) Cisco VPN
I don't use this myself but I was told it just needs these rules, so I
don't see a big issue here:
$IPT -A FORWARD -i $IF -o $INIF -p udp --dport 500 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $IF -o $INIF -p tcp --dport 500 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $IF -o $INIF -p 50 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $INIF -o $IF -p 50 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
Are these for a VPN server or a VPN client?
Clients start the ISAKPM connection outbound on destination port 500,
and the answers can be tracked by simple UDP connection tracking, so
you really should not have to explicitly permit incoming traffic
on port 500.
As for the IPSec part, every recent (for quite large values of recent)
Cisco client can do UDP tunneling for the IPSec packets, wrapping ESP
(that's your protocol 50 up there) in UDP (usually port 4500), giving
you both stateful tracking and NAT traversion.
5460
days inactive
5468
days old
3 comments
4 participants
participants (4)
-
Adam Miller -
Manuel Wolfshant -
Matthew Woehlke -
Ralf Ertzinger