This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

2 physical eth-devices on same Ethernet allowed?

I'm using the following network device configuration on the outside interfaces:

eth0: unencrypted Internet traffic
eth1: all IPsec Internet traffic for site-to-site VPNs

Both devices are connected on the same Ethernet switch.

The reason for this: I want to have dedicated traffic analysis for all IPsec traffic and a simple and safe reject rule for all RFC1918 private networks coming in or sending out wrongly via eth0. I additional want to have an own IP address for the IPsec gateway and as IPsec cannot be used on a device alias, this seems to be the only solution.

Is this configuration technically allowed? I'm wondering, as sometimes a "tcpdump -i eth0" shows response packets from requests going out over eth1 IPsec.

This thread was automatically locked due to age.

Parents

0 BAlfson over 15 years ago

Isenberg, the issue is the same physical network (Ethernet).

I want to have dedicated traffic analysis for all IPsec traffic

If you could expand on that description, perhaps we could make more suggestions.

a simple and safe reject rule for all RFC1918 private networks coming in or sending out wrongly via eth0.

In defining the IPsec VPN you define the subnets that are routed through the tunnel, and in defining the packet filter rules, you select the traffic allowed out.  It's not possible for any other traffic to pass, so I'm confused by this comment.

eth0: unencrypted Internet traffic is on subnet x.y.8.100/25
eth1: all IPsec Internet traffic for site-to-site VPNs is on subnet x.y.14.200/28

I'm confused also that you seem to have two such different subnets that might not have the same gateway ot the same ISP.  If that's the case, then we should be talking about Uplink Balancing and Multipath rules.

I will remove eth1 and switch the IPsec gateway address to eth0.

If you want that traffic to come from another IP, put the additional IP on eth0 (let's call it "IPsec Traffic"), then create a NAT rule:
External (Address) -> IPsec -> Any : SNAT from External [IPsec Traffic]  (Address) {leave 'Source Service' empty!}

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BAlfson over 15 years ago

Isenberg, the issue is the same physical network (Ethernet).

I want to have dedicated traffic analysis for all IPsec traffic

If you could expand on that description, perhaps we could make more suggestions.

a simple and safe reject rule for all RFC1918 private networks coming in or sending out wrongly via eth0.

In defining the IPsec VPN you define the subnets that are routed through the tunnel, and in defining the packet filter rules, you select the traffic allowed out.  It's not possible for any other traffic to pass, so I'm confused by this comment.

eth0: unencrypted Internet traffic is on subnet x.y.8.100/25
eth1: all IPsec Internet traffic for site-to-site VPNs is on subnet x.y.14.200/28

I'm confused also that you seem to have two such different subnets that might not have the same gateway ot the same ISP.  If that's the case, then we should be talking about Uplink Balancing and Multipath rules.

I will remove eth1 and switch the IPsec gateway address to eth0.

If you want that traffic to come from another IP, put the additional IP on eth0 (let's call it "IPsec Traffic"), then create a NAT rule:
External (Address) -> IPsec -> Any : SNAT from External [IPsec Traffic]  (Address) {leave 'Source Service' empty!}

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data