<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!-- p { margin-top: 0px; margin-bottom: 0px; }--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>I'm trying to create an iptables firewall rule to allow UDP encapsulated ESP packets to enter my server. <br>
</p>
<p><br>
</p>
<p>In my config, client is NAT'd and server has a real IP.<br>
</p>
<p><br>
</p>
<p>During the session setup, both sides detect that there is NAT and move to a conversation between port 4500 at both ends.<br>
</p>
<p><br>
</p>
<p>The session establishes correctly, but then it looks like the actual UDP encapsulated payload (ESP? checking I have this correctly) moves to a UDP stream between two random ports which gets blocked by my iptables firewall.<br>
</p>
<p><br>
</p>
<p>The DPD continues to be on port 4500 and keeps working.<br>
</p>
<p><br>
</p>
<p>I do have leftfirewall=yes on the server side, but it doesn't seem to set up a rule to deal with this.<br>
</p>
<p><br>
</p>
<p>We also run a PaloAlto firewall and the packets just show up as unidentified UDP to it as well which cause it to get dropped.<br>
</p>
<p><br>
</p>
<p>I'd like to avoid allowing all UDP into the server if possible.<br>
</p>
<div id="Signature">
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
<br>
</div>
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
Any suggestions?<br>
</div>
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
<br>
</div>
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
For what it's worth, a normal IPSEC session works perfectly provided neither end uses NAT.<br>
</div>
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
<br>
</div>
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
Thanks,<br>
</div>
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
Dave<br>
</div>
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
</div>
</div>
</body>
</html>