I'm using IPSEC in a tunnel mode.

How to make an iptables rule that will match only packets which arrived via IPSEC tunnel (i.e. after IPSEC decrypted them - not the IPSEC packets when they arrive and before decryption).

The point is to have a certain port which will be accessible only via IPSEC and inaccessible to the rest of the world.

1 Answer 1


You need to use the policy module, and specify the ipsec policy, to match this traffic. The following rule, for example, allows all inbound traffic to tcp port 12345. Don't forget that rule order is important in iptables, and that you may need to allow the return-half packets as well, depending on your current OUTPUT restrictions.

iptables -A INPUT -m policy --pol ipsec --dir in -p tcp --dport 12345 -j ACCEPT
  • Finally I tested it, and indeed it works for me. Thanks.
    – Sandman4
    Jan 9, 2013 at 10:48
  • Glad you got your problem fixed!
    – MadHatter
    Jan 9, 2013 at 11:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.