<html><body bgcolor="#ffffff"><font face="Verdana" size="1">Strongswan,<br><br>How do I block client-to-client traffic in strongswan v4.6.4?<font size="1"> </font></font><font face="Verdana" size="1"><font face="Verdana" size="1"><font size="1"><font size="1"><font size="1"><font size="1"><font size="1">I want to completely isolate the VPN clients from each other.</font></font></font></font></font></font></font><br><br><font face="Verdana" size="1"><font face="Verdana" size="1"><font size="1"><font size="1">My</font> impleme<font size="1">ntation is simple. </font></font>The closest example is http://strongswan.org/uml/testresults4/pfkey/rw-cert/index.html</font><br><br>When <font size="1">client </font>VPN tunnels are connected to 'moon', roadwarrior 'carol' (in
random hotel#1) and roadwarrior 'dave' (in random hotel#2) can access
each other on their VPN tunnel assigned non-routable IPs! For<font size="1"> example, if 'carol' is running a web server that bind<font size="1">s to her VPN assigned non-routable, 'dave' can<font size="1"> port scan and access 'carol<font size="1">' web server<font size="1">.</font></font></font></font></font></font><br><br>How
do I block traffic between all VPN clients (eg: 'carol' and 'dave')?
I've tried iptables INPUT, FORWARD, and OUTPUT<font size="1"> </font>but have been unable to
block the client-to-client traffic<font size="1">. The<font size="1"> VPN client ACCEPT rules are added *above* <font size="1">the REJECT rule I added.</font> </font></font><br><br>I've spent a great deal of effort getting 4.6.4 working and my attempts with 5.x have failed, so please don't ask me to upgrade.<br><br>The
server configs are inline below. VPN clients get a 10.1.0.0/16 address
and can access each other when connected to the strongswan server.<br><br>thanks,<br>Chris<br><br><font size="1"># /etc/sysconfig/iptables FORWARD rules<br>-A FORWARD -m policy --dir in --pol ipsec -j ACCEPT<br>-A FORWARD -i ppp+ -p all -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT<br>-A FORWARD -s 10.1.0.0/16 -d 10.1.0.0/16 -j REJECT<br>-A FORWARD -p tcp -j ACCEPT<br>-A FORWARD -p udp -j ACCEPT<br>-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT<br><br># This is what the rules look like before any VPN clients connect<br># note the REJECT line position<br>$ iptables –L<br>Chain FORWARD (policy ACCEPT)<br>target prot opt source destination<br>ACCEPT all -- anywhere anywhere policy match dir in pol ipsec<br>ACCEPT all -- anywhere anywhere state NEW,RELATED,ESTABLISHED<br>REJECT all -- 10.1.0.0/16 10.1.0.0/16 reject-with icmp-port-unreachable<br>ACCEPT tcp -- anywhere anywhere<br>ACCEPT udp -- anywhere anywhere<br>ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED<br><br># live iptables after 10.1.0.6 and 10.1.0.7 connect.<br># note VPN client ACCEPT rules are added *above* the reject<br># Firewall policies are processed top down, so the REJECT line does absolutely nothing.<br>$ iptables –L<br>*snip*<br>Chain FORWARD (policy ACCEPT)<br>target prot opt source destination<br>ACCEPT all -- 10.1.0.7 anywhere policy match dir in pol ipsec reqid 16660 proto esp<br>ACCEPT all -- anywhere 10.1.0.7 policy match dir out pol ipsec reqid 16660 proto esp<br>ACCEPT all -- 10.1.0.6 anywhere policy match dir in pol ipsec reqid 16652 proto esp<br>ACCEPT all -- anywhere 10.1.0.6 policy match dir out pol ipsec reqid 16652 proto esp<br>ACCEPT all -- anywhere anywhere policy match dir in pol ipsec<br>ACCEPT all -- anywhere anywhere state NEW,RELATED,ESTABLISHED<br>REJECT all -- 10.1.0.0/16 10.1.0.0/16 reject-with icmp-port-unreachable<br>ACCEPT tcp -- anywhere anywhere<br>ACCEPT udp -- anywhere anywhere<br>ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED<br>*snip*<br></font><br><font face="Verdana" size="1">[root@e20-Strongswan etc]# cat strongswan.conf<br># strongswan.conf - strongSwan configuration file<br><br>charon {<br><br> # number of worker threads in charon<br> threads = 32<br><br> # send strongswan vendor ID?<br> # send_vendor_id = yes<br><br> plugins {<br><br> sql {<br> # loglevel to log into sql database<br> loglevel = -1<br><br> # URI to the database<br> # database = sqlite:///path/to/file.db<br> # database = mysql://user:password@localhost/database<br> }<br> }<br><br> # ...<br>}<br><br>pluto {<br> dns1 = 10.1.0.253<br>}<br><br>libstrongswan {<br><br> # set to no, the DH exponent size is optimized<br> # dh_exponent_ansi_x9_42 = no<br>}<br><br><br>[root@e20-Strongswan etc]# cat ipsec.conf<br>config setup<br> plutodebug=control<br> plutostart=yes<br> plutostderrlog=/var/log/pluto.log<br> nat_traversal=yes<br> uniqueids=yes<br> crlcheckinterval=60<br> cachecrls=yes<br> strictcrlpolicy=yes<br><br>ca $default<br> auto=add<br><br>conn ios<br> type=tunnel<br> keyexchange=ikev1<br> authby=xauthrsasig<br> xauth=server<br> left=%defaultroute<br> leftsubnet=0.0.0.0/0<br> leftcert=serverCert.pem<br> leftfirewall=yes<br> right=%any<br> rightsourceip=10.1.0.0/16<br> pfs=no<br> auto=add<br><br></font><div><font face="Verdana" size="2"></font></div>
</body></html>