Very Computer

by **Ch3w3** » Sun, 02 Feb 2003 05:29:24

I have posted about this before, but have had little success. I also
realize there are a few previous posts that are similar, however none of
them really address my situation.

Configuration:
I am running a Cisco VPN client for Windows, with Transparent Tunnelling
enabled, IPSec over TCP port 10000.
My firewall is OpenBSD 3.2.
I have NAT enabled within PF (so the VPN client is being NAT'd).

What I have tried:
I have experimented with redirecting TCP/UDP port 10000 and 500 to the
host that is running the VPN client. I have tried both with "keep state"
and without, scrubbing and no scrubbing. Nothing works - the VPN client
will connect and authenticate, and I can even reach other hosts on the
VPN, but it drops out after a few minutes or after I send a certain
amount of traffic over the VPN.

Possibly useful information:
The client works just fine behind a Linux machine running iptables with
SNAT.
I noticed in my pflog that some packets are being blocked on their way
out because they have a non-routable address (10.whatever). This
surprises me, as the VPN client is obviously not generating packets
whose outermost IP header has a non-routable address (OK not obviously
but I have verified) - so how is PF seeing this? More importantly, if I
allow PF to route 10.x addresses, the client still does not function.

Thanks for the help.

by **erik** » Sun, 02 Feb 2003 06:35:51

> I have posted about this before, but have had little success. I also
> realize there are a few previous posts that are similar, however none of
> them really address my situation.

> Configuration:
> I am running a Cisco VPN client for Windows, with Transparent Tunnelling
> enabled, IPSec over TCP port 10000.
> My firewall is OpenBSD 3.2.
> I have NAT enabled within PF (so the VPN client is being NAT'd).

> What I have tried:
> I have experimented with redirecting TCP/UDP port 10000 and 500 to the
> host that is running the VPN client. I have tried both with "keep state"
> and without, scrubbing and no scrubbing. Nothing works - the VPN client
> will connect and authenticate, and I can even reach other hosts on the
> VPN, but it drops out after a few minutes or after I send a certain
> amount of traffic over the VPN.

> Possibly useful information:
> The client works just fine behind a Linux machine running iptables with
> SNAT.
> I noticed in my pflog that some packets are being blocked on their way
> out because they have a non-routable address (10.whatever). This
> surprises me, as the VPN client is obviously not generating packets
> whose outermost IP header has a non-routable address (OK not obviously
> but I have verified) - so how is PF seeing this? More importantly, if I
> allow PF to route 10.x addresses, the client still does not function.

> Thanks for the help.

So, _which_ packets are being blocked? My guess is that you do not permit
esp to pass the firewall. Open up 500/udp and proto esp. That should work.

EJ
--
Remove the obvious part (including the dot) for my email address

by **Ch3w3** » Sun, 02 Feb 2003 10:13:35

Actually, I did already try specifically letting esp and ah through - I
just forgot to mention it. Oops.

The thing is, that shouldn't make a difference because the VPN client is
tunneling the IPSec through TCP so PF _should_ just see a plain old IP
packet with the address of the VPN server. In order for PF to see that
I'm using IPSec, it would have to unwrap the first TCP/IP layer of the
packet and "look inside", which it has no reason or authority to do.

I don't know specifically which packets are being blocked. On the client
side, right before the connection drops, the client will start dropping
tons of packets. On the PF side, I noticed those entries in pflog, but
that's it. I haven't been able to correlate them to any particular instance.

>>I have posted about this before, but have had little success. I also
>>realize there are a few previous posts that are similar, however none of
>>them really address my situation.

>>Configuration:
>>I am running a Cisco VPN client for Windows, with Transparent Tunnelling
>>enabled, IPSec over TCP port 10000.
>>My firewall is OpenBSD 3.2.
>>I have NAT enabled within PF (so the VPN client is being NAT'd).

>>What I have tried:
>>I have experimented with redirecting TCP/UDP port 10000 and 500 to the
>>host that is running the VPN client. I have tried both with "keep state"
>>and without, scrubbing and no scrubbing. Nothing works - the VPN client
>>will connect and authenticate, and I can even reach other hosts on the
>>VPN, but it drops out after a few minutes or after I send a certain
>>amount of traffic over the VPN.

>>Possibly useful information:
>>The client works just fine behind a Linux machine running iptables with
>>SNAT.
>>I noticed in my pflog that some packets are being blocked on their way
>>out because they have a non-routable address (10.whatever). This
>>surprises me, as the VPN client is obviously not generating packets
>>whose outermost IP header has a non-routable address (OK not obviously
>>but I have verified) - so how is PF seeing this? More importantly, if I
>>allow PF to route 10.x addresses, the client still does not function.

>>Thanks for the help.

> So, _which_ packets are being blocked? My guess is that you do not permit
> esp to pass the firewall. Open up 500/udp and proto esp. That should work.

> EJ

Very Computer

Cisco VPN client through PF

Cisco VPN client through PF

Cisco VPN client through PF

Cisco VPN client through PF