Just discovered that apple dropped pptp support in the newest MacOSes, so configured ikev2 ipsec access instead. Clients are happy, everything is simple and good except one thing - ipsec clients cannot access any services running on the same host the connects to. Of course it can be easily done using direct iptables config, but I use firehol for years and have a large config and no time to rewrite it back to iptables rules. And I have no idea how to specify ipsec access on the interface.
Suppose, I have eth1 wan interface for the internet access and internal eth0 interface for the lan and my firehol config looks like:
interface eth1 inet protection strong policy reject server ESP accept server AH accept interface eth0 lan policy accept client all accept server all accept router inet2lan inface eth1 outface eth0 client all accept router lan2inet inface eth0 outface eth1 route all accept masquerade
So far so good, I can connect to the server via ipsec and my packets nated to the lan well. But, the problem is, that I cannot connect to any services running directly on the server. As I understand, it happens because ikev2 is not real vpn but just a secure connection to the eth1 interface, so all policies for eth1 applied to any esp/ah connection. I checked it disabling all eth1 rules:
interface eth1 inet policy accept client all accept server all accept
And found that really, in this case everything is working fine and all local services are accessible as well as lan.
So, my question is, how to separate configurations and to make something like:
interface eth1 inet server ESP AH policy accept client all accept server all accept interface eth1 inet server not ESP AH protection strong policy reject server ESP accept server AH accept
It's just a sample, it's not working really, but maybe there's a way to configure such an access? Cannot find it anywhere, maybe I seek something wrong? As I understand, I just need to force firehol to perform something like:
iptables -I INPUT --match policy --pol ipsec --dir in --proto esp -s 172.16.0.0/16 -j ACCEPT iptables -I OUTPUT --match policy --pol ipsec --dir out --proto esp -d 172.16.0.0/16 -j ACCEPT
assuming remote host is in the 172.16/16. But have no idea how. Please help.