I'm trying to detail IP/IPsec package flow, partly to understand what is possible, and what is not, and partly since it helps debugging a VPN connection problem. Please comment / correct, I'm especially interested in when NAT and packet rules apply in this flow. Also, it would be nice if this description could be enhanced with tcp/udp port numbers.
Setup is:
LAN --- ASL ---- RW
LAN: 192.168.5.0/24
ASL: 192.168.1.1 (int), 70.100.200.300 (ext)
RW : 80.100.200.300
Format of the following lines are
"Where SRC-IP DST-IP"
RW 80.100.200.300 192.168.5.5
Program tries to connect to remote host (LAN)
RW 80.100.200.300 70.100.200.300
VPN client picks up the package since the destination IP is defined in a VPN tunnel. The VPN client changes the DST address to have it go to the remote VPN gateway.
ASL 80.100.200.300 70.100.200.300
VPN gateway picks up the IPsec package.
ASL 80.100.200.300 192.168.5.5
VPN gateway changes DST to LAN address defined in data-part of IP package.
ASL 80.100.200.300 192.168.5.5
Package is fed through packet rules, and if allowed it is forwarded to the intranet.
LAN 80.100.200.300 192.168.5.5
Destination picks up package, process it and returns a new package. The local service must allow access from 80.100.200.300 (e.g. hosts allow in smb.conf etc ...)
LAN 192.168.5.5 80.100.200.300
Normal IP package returned from host 192.168.5.5, It's default gateway is 192.168.1.1, i.e. the IPsec VPN gateway.
ASL 192.168.5.5 80.100.200.300
ASL firewall picks up package. If a SRC NAT rule is defined for 192.168.5.5 it is replaced by another address and the IP package will not match the VPN tunnel, thus SRC NAT is not allowed for 192.168.5.5 if dest address is 80.100.200.300. Package is fed through packet rule filters, and if allowed, the VPN gateway software picks up package, encrypts it and forward it to the Roadwarrior.
ASL 70.100.200.300 80.100.200.300
Original IP package is embedded in a new IPsec package.
RW 70.100.200.300 80.100.200.300
Since this package is received through IPsec it is known to be part of a VPN tunnel, and it is unpacked.
RW 192.168.5.5 80.100.200.300
Success.
Looking forward to hearing from you,
Michael
This thread was automatically locked due to age.
