Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Please note, I'm not talking about TCP or UDP traffic. Rather IP traffic with the protocol ids of 50 and 51.

The point of this being that I can then pass IPsec traffic thru to the internal machine where it would act as the VPN terminator.

share|improve this question
add comment

2 Answers

The same way as any other forward:

root@lightning:~# iptables -t nat -A PREROUTING -p 50 -j DNAT --to 1.2.3.4
root@lightning:~# iptables -t nat -A PREROUTING -p 51 -j DNAT --to 1.2.3.4
root@lightning:~# iptables -t nat -L PREROUTING -v -n
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DNAT       esp  --  *      *       0.0.0.0/0            0.0.0.0/0            to:1.2.3.4
    0     0 DNAT       ah   --  *      *       0.0.0.0/0            0.0.0.0/0            to:1.2.3.4
share|improve this answer
    
I'm not sure if that's sufficient. I found this mad-hacking.net/documentation/linux/networking/ipsec/… but it's for a site to site VPN. I'm trying to do this for a roadwarrior config. So I figure I probably need some additional FORWARD,INPUT,OUTPUT rules but it's probably not the best idea to try to figure this out at 6am. Any suggestions you have for fleshing this out is appreciated. –  jnman Jan 19 '13 at 12:23
1  
For a roadwarrior config, using openvpn instead of ipsec will be infinitely easier. –  Dennis Kaarsemaker Jan 19 '13 at 13:08
add comment

Another option is to set the endpoint as the "DMZ host" in DD-WRT. This will pass and masquerade all traffic, including your exotic protocols.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.