<html>
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Hello,</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I’ve been working on setting up a roadwarrior
connection. If I basically allow everything through IPTables, I can get
the tunnel up with no problem, however, when I bring up the ruleset that
actually includes some firewalling (included below), I can’t connect, and
don’t even see any error messages in auth.log or syslog. >From my
understanding, I’ve opened up the required ports, however that’s
obviously not the case. Can anyone point me in the right direction?</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Thank-you,</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>John Friesen</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'># Generated by iptables-save v1.2.2 on Tue Nov 20 07:03:37
2001</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>*mangle</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>:PREROUTING ACCEPT [589744:443331401]</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>:OUTPUT ACCEPT [36335:5003329]</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>COMMIT</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'># Completed on Tue Nov 20 07:03:37 2001</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'># Generated by iptables-save v1.2.2 on Tue Nov 20 07:03:37
2001</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>*filter</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>:INPUT DROP [4:248]</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>:FORWARD ACCEPT [546958:431886558]</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>:OUTPUT ACCEPT [36335:5003329]</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-A INPUT -i lo -j ACCEPT</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-A INPUT -i eth0 -j ACCEPT</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-A INPUT -i eth1 -s 207.6.134.150 -d 0/0 -j ACCEPT</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-A INPUT -i eth1 -p tcp -m tcp --destination-port 50 -m
state --state NEW,RELATED,ESTABLISHED</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-A INPUT -i eth1 -p tcp -m tcp --destination-port 51 -m
state --state NEW,RELATED,ESTABLISHED</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-A INPUT -i eth1 -p udp -m udp --destination-port 50 -m
state --state NEW,RELATED,ESTABLISHED</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-A INPUT -i eth1 -p udp -m udp --destination-port 51 -m
state --state NEW,RELATED,ESTABLISHED</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-A INPUT -i eth1 -p udp -m udp --destination-port 500 -m
state --state NEW,RELATED,ESTABLISHED</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-A INPUT -i eth1 -p udp -m udp --destination-port 4500 -m
state --state NEW,RELATED,ESTABLISHED</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-A INPUT -i eth1 -p tcp -m tcp --destination-port 22 -m
state --state NEW,RELATED,ESTABLISHED -j ACCEPT</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-A INPUT -i eth1 -p tcp -m tcp --destination-port 10000 -m
state --state NEW,RELATED,ESTABLISHED -j ACCEPT</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-A INPUT -i eth1 -p tcp -m tcp --destination-port 47809 -m
state --state NEW,RELATED,ESTABLISHED -j ACCEPT</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j
ACCEPT</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-A INPUT -i eth1 -p udp -j REJECT --reject-with
icmp-port-unreachable</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-A INPUT -i eth1 -p tcp -j REJECT --reject-with tcp-reset</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>COMMIT</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'># Completed on Tue Nov 20 07:03:37 2001</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'># Generated by iptables-save v1.2.2 on Tue Nov 20 07:03:37
2001</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>*nat</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>:PREROUTING ACCEPT [10748:545301]</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>:POSTROUTING ACCEPT [2549:154045]</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>:OUTPUT ACCEPT [2361:146221]</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-A POSTROUTING -s 192.168.100.0/24 -d 192.168.100.1 -o eth0
-j ACCEPT</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-A POSTROUTING -s 192.168.100.0/24 -d 10.0.1.0/24 -o eth0 -j
ACCEPT</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-A POSTROUTING -s 192.168.100.0/24 -o eth1 -j MASQUERADE</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>COMMIT</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'># Completed on Tue Nov 20 07:03:37 2001</span></font></p>
</div>
</body>
</html>