On Wed, 19 Oct 2005, Holm Tiffe wrote:
Hi,
I have a currently big problem with the following setup:
A FreeBSD Box, running 5_STABLE is connected wirh one interface to the
public, with the other to an nated' subnet with private address space.
I need to allow at least one host from inside the private network access
to an outside Cisco VPN concentrator. I've learned in the meantime, that
allowing udp connections from inside to the outside net and vis versa is'nt
doing the job.
(I've struggeled in the meantime over tcpdump, that is showing isakmp
packets leaving the external interface, but they dont't really do this..)
What exactly I have to do get this working?
What I found I needed to do to connect to the work Cisco VPN through my
FreeBSD NAT firewall was to tell it not to NAT the source port of the
isakmp packets, as isakmps need to have source and destination port 500.
using pf the command is (taken from man pf.conf)
# Map outgoing packets' source port to an assigned proxy port instead of
# an arbitrary port.
# In this case, proxy outgoing isakmp with port 500 on the gateway.
nat on $ext_if inet proto udp from any port = isakmp to any -> ($ext_if) \
port 500
Not sure about the same for ipfw/natd but i'm sure its doable.
Vince
The FreeBSD Box is out of reach (around 50km from here), I can't access the
hosts on the inside network and I dont't have access to the cisco
concentrator, so I can't test different setups ..
Can please anyone help?
Regards,
Holm
ps: please Cc me, I've currently not subscribed to this list.
--
L&P::Kommunikation GbR Holm Tiffe * Administration, Development
FreibergNet.de Internet Systems phone +49 3731 419010
Bereich Server & Technik fax +49 3731 4196026
D-09599 Freiberg * Am St. Niclas Schacht 13 http://www.freibergnet.de
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
