Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Please note, I'm not talking about TCP or UDP traffic. Rather IP traffic with the protocol ids of 50 and 51.

The point of this being that I can then pass IPsec traffic thru to the internal machine where it would act as the VPN terminator.

share|improve this question

The same way as any other forward:

root@lightning:~# iptables -t nat -A PREROUTING -p 50 -j DNAT --to
root@lightning:~# iptables -t nat -A PREROUTING -p 51 -j DNAT --to
root@lightning:~# iptables -t nat -L PREROUTING -v -n
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DNAT       esp  --  *      *              to:
    0     0 DNAT       ah   --  *      *              to:
share|improve this answer
I'm not sure if that's sufficient. I found this… but it's for a site to site VPN. I'm trying to do this for a roadwarrior config. So I figure I probably need some additional FORWARD,INPUT,OUTPUT rules but it's probably not the best idea to try to figure this out at 6am. Any suggestions you have for fleshing this out is appreciated. – jnman Jan 19 '13 at 12:23
For a roadwarrior config, using openvpn instead of ipsec will be infinitely easier. – Dennis Kaarsemaker Jan 19 '13 at 13:08

Another option is to set the endpoint as the "DMZ host" in DD-WRT. This will pass and masquerade all traffic, including your exotic protocols.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.