2

Just discovered that apple dropped pptp support in the newest MacOSes, so configured ikev2 ipsec access instead. Clients are happy, everything is simple and good except one thing - ipsec clients cannot access any services running on the same host the connects to. Of course it can be easily done using direct iptables config, but I use firehol for years and have a large config and no time to rewrite it back to iptables rules. And I have no idea how to specify ipsec access on the interface.

Details:

Suppose, I have eth1 wan interface for the internet access and internal eth0 interface for the lan and my firehol config looks like:

interface eth1 inet
    protection strong
    policy reject

    server ESP accept
    server AH accept
interface eth0 lan 
    policy accept
    client all accept
    server all accept
router inet2lan inface eth1 outface eth0
    client all accept
router lan2inet inface eth0 outface eth1
    route all accept
    masquerade

So far so good, I can connect to the server via ipsec and my packets nated to the lan well. But, the problem is, that I cannot connect to any services running directly on the server. As I understand, it happens because ikev2 is not real vpn but just a secure connection to the eth1 interface, so all policies for eth1 applied to any esp/ah connection. I checked it disabling all eth1 rules:

interface eth1 inet 
    policy accept
    client all accept
    server all accept

And found that really, in this case everything is working fine and all local services are accessible as well as lan.

So, my question is, how to separate configurations and to make something like:

interface eth1 inet server ESP AH
    policy accept
    client all accept
    server all accept
interface eth1 inet server not ESP AH
    protection strong
    policy reject

    server ESP accept
    server AH accept

It's just a sample, it's not working really, but maybe there's a way to configure such an access? Cannot find it anywhere, maybe I seek something wrong? As I understand, I just need to force firehol to perform something like:

iptables -I INPUT  --match policy --pol ipsec --dir in  --proto esp  -s 172.16.0.0/16 -j ACCEPT
iptables -I OUTPUT --match policy --pol ipsec --dir out  --proto esp  -d 172.16.0.0/16 -j ACCEPT

assuming remote host is in the 172.16/16. But have no idea how. Please help.

Thank you

6
  • Use internal IP addresses on your tunnel, or use IPsec in transport mode. – Michael Hampton Mar 7 '18 at 21:59
  • Sure I do use internal IP. But firehol blocks the access. What do you mean by "transport mode"? – BbIKTOP Mar 7 '18 at 22:03
  • Hmm. Well, I don't know if macOS will do transport mode anyway. And firehol is ancient and has hardly been maintained for years. So I'm not sure how or if it can do that. – Michael Hampton Mar 7 '18 at 23:33
  • Please tell me more about transport mode - how could it help? I don't understand. The problem is, that I need to allow these packets to pass my firewall, and I can't. And packets incapsulation woudn't change it anyway, isn't it? I edited the original post to be more specific. Why, last firehol version has been released Sep 17, 2017 so it's at least as ancient as linux itself )))) And firehol bugtracker is active and scripts work just fine including load balancing scripts that I use. Why do you think it's hardly maintained? Maybe I really need to think about switching back to plain iptables? – BbIKTOP Mar 7 '18 at 23:41
  • Transport mode doesn't set up a tunnel at all; it just encrypts any data between two endpoints, which continue to use their original IP addresses instead of tunnelled addresses. – Michael Hampton Mar 7 '18 at 23:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.