Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to require IPSEC on a port range ? I want to require IPSEC for all incoming connections except a few public ports like 80 and 443, but don't want to restrict outgoing connections.

My SPD rules would look like:

spdadd 0.0.0.0/0 0.0.0.0/0[80] tcp -P in none;
spdadd 0.0.0.0/0 0.0.0.0/0[443] tcp -P in none;
spdadd 0.0.0.0/0 0.0.0.0/0[0....32767] tcp -P in esp/require/transport;

In setkey manpage I see IP ranges, but no mention of port ranges.

(The idea is to use IPSEC as a sort of VPN to protect internal communications between multiple servers. Instead of configuring permissions basing on source IPs, or configuring specific ports, I want to demand IPSEC on anything which is not meant to be public - I feel it's less error-prone this way.)

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Yes, while you can indeed specify a IP range, there's no way to specify a port range. This means that you need to enter a rule for each port, or more simply you can use a script for that e.g.:

perl -e 'print "spdadd 0.0.0.0/0 0.0.0.0/0[$_] tcp -P in esp/require/transport;\n" for (1..32767)' >run.sh

I assume that those servers are not located in the same datacenter. This actually can cause serious efficiency problems, unless there's a fast connection between those servers and/or you choose a fast encryption algorithm for IPSEC.

Performance comparison of IPsec and TLS Based VPNs

share|improve this answer
    
Why there's an efficiency problem with IPSEC, and why it related to servers location ? I thought IPSEC should be roughly as fast as any other encryption solutions, say OpenVPN or SSH or TLS or whatever. –  Sandman4 Nov 5 '12 at 12:10
    
Thanks for answering. I wonder why they didn't implement port ranges... Don't feel good with adding 32k separate rules. I think I will use iptables to require ipsec on a certain ports (iptables may have rules based on ipsec status). –  Sandman4 Nov 5 '12 at 12:14
    
Well, if there're latency/bandwidth issues using any kind of VPN (IPSEC/OpenVPN) will make things much worse. See this link for performance comparison of IPsec and TLS Based VPNs: iceta.sk/proceedings/iceta2011_truchly.pdf –  FINESEC Nov 5 '12 at 12:37
    
1. Thanks a lot for the link. 2. I think all the slowness they report originates from CPU/RAM only and is completely unrelated to the connection latency/bandwidth. –  Sandman4 Nov 5 '12 at 13:09
    
Yes, CPU/RAM is probably the main factor of efficieny issues. For any VPN software there's always a traffic overhead though - VPN connection consumes more bandwidth than non-encrypted connection. As for the latency issues I can tell you from my own experience that there're some serious issues when using VPN on high latency connection. –  FINESEC Nov 5 '12 at 13:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.