<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<meta name="Generator" content="Zarafa WebApp v7.1.7-42779">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>RE: [Openswan Users] Firewall rules for openswan behind NAT</title>
</head>
<body>
<font face="tahoma" size="2">In IPv4, ICMP is a "nice to have". Wi<font size="2">thout it, you may be <font size="2">getting less informative error messages ("timeout" instead of "network unreachable" for instance).</font></font><br></font><font face="tahoma" size="2"><br><font size="2">In IPv6, IC<font size="2">MPv6 is absolutely essential; without it, clients can't even get an <font size="2">IP address<font size="2"> or find their default gateway.</font></font></font></font><br></font><p>Kevin Keane</p><p>The NetTech</p><p>760-721-8339</p><p>http://www.4nettech.com</p><p>Our values: Privacy, Liberty, Justice</p><p>See https://www.4nettech.com/corp/the-nettech-values.html</p><p><br></p><blockquote style="border-left: 2px solid #325FBA; padding-left: 5px; margin-left: 5px; margin-right: 0px;">-----Original message-----<br><strong>From:</strong> Fred Weston <fred.weston@lpga.com><br><strong>Sent:</strong> Wednesday 13th November 2013 9:06<br><strong>To:</strong> Leto <letoams@gmail.com><br><strong>Cc:</strong> users@lists.openswan.org<br><strong>Subject:</strong> Re: [Openswan Users] Firewall rules for openswan behind NAT<br><br>
<!-- begin sanitized html -->
<style>
<--
@font-face
{font-family:Calibri}
@font-face
{font-family:Tahoma}
@font-face
{font-family:Verdana}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif"}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif"}
span.BalloonTextChar
{font-family:"Tahoma","sans-serif"}
p.msochpdefault, li.msochpdefault, div.msochpdefault
{margin-right:0in;
margin-left:0in;
font-size:12.0pt;
font-family:"Calibri","sans-serif"}
span.emailstyle17
{font-family:"Calibri","sans-serif";
color:windowtext}
span.balloontextchar0
{font-family:"Tahoma","sans-serif"}
span.EmailStyle22
{font-family:"Calibri","sans-serif";
color:#1F497D}
.MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.WordSection1
{}
-->
</style>
<div class="bodyclass">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Let me clarify – when I reference ports/protocols that I’m allowing inbound, I’m allowing it from the opposite host and not specifying a source port.</span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="color:#1F497D">Is ICMP required for functionality or only for ease of troubleshooting? Typically I only allow it if I need it for some reason.</span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="color:#1F497D">Thanks,</span></p>
<p class="MsoNormal"><span style="color:#1F497D">FW</span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<div>
<div style="border:none; border-top:solid #B5C4DF 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt; font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt; font-family:"Tahoma","sans-serif""> Leto [mailto:letoams@gmail.com]
<br>
<b>Sent:</b> Wednesday, November 13, 2013 11:27 AM<br>
<b>To:</b> Fred Weston<br>
<b>Cc:</b> users@lists.openswan.org<br>
<b>Subject:</b> Re: [Openswan Users] Firewall rules for openswan behind NAT</span></p>
</div>
</div>
<p class="MsoNormal"> </p>
<div>
<p class="MsoNormal"><br>
<br>
sent from a tiny device </p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
On 2013-11-13, at 10:44, Fred Weston <<a href="mailto:fred.weston@lpga.com" target="_blank" title="This external link will open in a new window">fred.weston@lpga.com</a>> wrote:</p>
</div>
<blockquote style="margin-top:5.0pt; margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal">Hello All,</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I’m using OpenSwan with AWS to link two private VPC networks in different regions.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I’m having trouble getting my firewall ACLs right. Everything works if I permit all traffic to the OpenSwan boxes, however when I try to get more restrictive and permit only the necessary ports things stop working.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">One side has all traffic permitted inbound for the time being and I’m making ACL changes trying to restrict traffic to certain ports/protocols on the other side.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Both endpoints are behind 1:1 NAT. Everything is permitted outbound on both sides.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">From reading online, I understand that the following ports and protocols should be all I need:</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">UDP 500</p>
<p class="MsoNormal">UDP 4500</p>
<p class="MsoNormal">IP Protocol 50</p>
<p class="MsoNormal">IP Protocol 51</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I tried the above and had no luck. As soon as I change from permitting all inbound to permitting only the above list the tunnel comes down.</p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt; font-family:"Times New Roman","serif""> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt; font-family:"Times New Roman","serif"">You should really allow icmp.</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt; font-family:"Times New Roman","serif""> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt; font-family:"Times New Roman","serif"">Note that you need to accept from a random high port to dest udp 4500, not just 4500 <-> 4500. Same for 500</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt; font-family:"Times New Roman","serif""> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt; font-family:"Times New Roman","serif""> </span></p>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt; font-family:"Times New Roman","serif""><br>
<br>
</span></p>
<div>
<div>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I also tried permitting tcp/1721 and tcp/1723 and IP Protocol 47.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I am using AWS ‘security groups’ to control filtering and according to the docs (and my observations) security groups are stateful, so I am not sure why this isn’t working.
</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Can anyone offer any suggestions?</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Thanks,</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><b><span style="font-family:"Verdana","sans-serif"">Fred Weston</span></b></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt; font-family:"Times New Roman","serif"">The information transmitted in this message (including any attachments) is intended only for the use of the individual(s) and/or entity(ies) to which it is addressed
and may contain confidential business information which should not be disclosed. If you are not the intended recipient, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this email in error,
please notify the sender and immediately destroy and delete this email from your system without disseminating it. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late
or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message. Any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those
of the LPGA and/or its affiliates. No employee is authorized to conclude any binding agreement on behalf of LPGA and/or its affiliates with another party by e-mail. All agreements shall be contained in a separate writing executed by an authorized LPGA signatory.
Thank You. </span></p>
</div>
<blockquote style="margin-top:5.0pt; margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span style="font-size:12.0pt; font-family:"Times New Roman","serif"">_______________________________________________<br>
<a href="mailto:Users@lists.openswan.org" target="_blank" title="This external link will open in a new window">Users@lists.openswan.org</a><br>
<a href="https://lists.openswan.org/mailman/listinfo/users" target="_blank" title="This external link will open in a new window">https://lists.openswan.org/mailman/listinfo/users</a><br>
Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" target="_blank" title="This external link will open in a new window">
https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>
Building and Integrating Virtual Private Networks with Openswan:<br>
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank" title="This external link will open in a new window">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a></span></p>
</div>
</blockquote>
</div>
The information transmitted in this message (including any attachments) is intended only for the use of the individual(s) and/or entity(ies) to which it is addressed and may contain confidential business information which should not be disclosed. If you are
not the intended recipient, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this email in error, please notify the sender and immediately destroy and delete this email from your system
without disseminating it. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for
any errors or omissions in the contents of this message. Any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of the LPGA and/or its affiliates. No employee is authorized to conclude any binding
agreement on behalf of LPGA and/or its affiliates with another party by e-mail. All agreements shall be contained in a separate writing executed by an authorized LPGA signatory. Thank You.
</div>
<pre>_______________________________________________<br>
Users@lists.openswan.org<br>
https://lists.openswan.org/mailman/listinfo/users<br>
Micropayments: https://flattr.com/thing/38387/IPsec-for-Linux-made-easy<br>
Building and Integrating Virtual Private Networks with Openswan:<br>
http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155<br>
</pre>
<!-- end sanitized html -->
</blockquote>
</body>
</html>