Please note, I'm not talking about TCP or UDP traffic. Rather IP traffic with the protocol ids of 50 and 51.

The point of this being that I can then pass IPsec traffic thru to the internal machine where it would act as the VPN terminator.

2 Answers 2


The same way as any other forward:

root@lightning:~# iptables -t nat -A PREROUTING -p 50 -j DNAT --to
root@lightning:~# iptables -t nat -A PREROUTING -p 51 -j DNAT --to
root@lightning:~# iptables -t nat -L PREROUTING -v -n
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DNAT       esp  --  *      *              to:
    0     0 DNAT       ah   --  *      *              to:
  • I'm not sure if that's sufficient. I found this mad-hacking.net/documentation/linux/networking/ipsec/… but it's for a site to site VPN. I'm trying to do this for a roadwarrior config. So I figure I probably need some additional FORWARD,INPUT,OUTPUT rules but it's probably not the best idea to try to figure this out at 6am. Any suggestions you have for fleshing this out is appreciated.
    – jnman
    Jan 19, 2013 at 12:23
  • 1
    For a roadwarrior config, using openvpn instead of ipsec will be infinitely easier. Jan 19, 2013 at 13:08

Another option is to set the endpoint as the "DMZ host" in DD-WRT. This will pass and masquerade all traffic, including your exotic protocols.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.