[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: VPN client cannot connect through OpenBSD router/firewall

On Mon, 17 Jan 2005 18:02:47 -0600, J Moore <[email protected]> wrote:
> On Mon, Jan 17, 2005 at 10:38:05PM +0100, the unit calling itself Laurent Cheylus wrote:
> > To use VPN IPsec client with a NAT gateway like yours, VPN client must
> > use NAT-Traversal (ESP packets encapsulation in UDP packets on port
> > 4500). And the IPsec gateway of your wife at work must also support
> > NAT-Traversal.
Laurent, that is not true.  I have used VPN clients (isakmpd behind a
NATing firewall, Windows XP ipsec, SSH Sentinel and SafeNet
SoftRemote) behind OpenBSD firewalls and have never had a problem
going through my OpenBSD firewall/NAT.  You must pass out esp traffic.
> I have the same problem. My VPN client is Cisco VPN Client ver 4.6.00.
> I gather that pf can't pass some VPN traffic, and that getting it
> through pf will require some isakmpd setup?
I _did_ have problems getting the Cisco VPN client connecting through
the firewall, but at the time, I believe it was prior to the NAT
"static-port" directive.  My solution in the old days to get the Cisco
VPN client working through my OpenBSD firewall was to put an rdr and a
pass rule redirecting port 500 udp traffic back to the VPN client.
I _THINK_ that with the static-port rule, your Cisco VPN client will
make connections initiated on port 500 rather than having NAT select
some random high numbered port.  Then, the Cisco VPN server can
successfully connect back through port 500 and establish the
nat on $ext_if from $int_if:network to any -> ($ext_if) static-port
> Thanks,
> Jay