/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */
Howdy, I searched through the faq and archives and could not find anything
related directly to this issue. If someone could give me a hint it would be
greatly appreciated. My issue is with a conflict between an ipchains MASQ
set up for my internal network and FreeS/WAN wishing to forward un-masq'd
packets. I guess I better explain a bit better:
Internal Network: 192.168.12.0/24= eth0
External Interface: 24.107.1.23/16= eth1
All internal users are subject to:
ipchains -A forward -s 192.168.12.0/24 -d 0.0.0.0/24 -j MASQ
After this is appended to the rule set all works great to the
internet. But I must then run an IPSec tunnel to 172.16.0.0/12 with my
source being a 192.168.12.0/24 host in the encrypted packet. When the tunnel
is started nothing works to the destination till I disable the MASQ entry.
after this the tunnel works but now I cannot get to the internet...
regardless it appears the IPSec client grabs the packet after the ipchains
rules are in place (I have not tried this option using the output queue...
yet). (see this in tcpdump and /var/logs/messages) FreeS/WAN does have an
firewall option that activates a ipfwadm script but this is not the
firewalling/ filtering stuff I am using.
So it appears that I do not want to MASQ packets destined to 172.16.0.0/12.
Is there a way I can do this. Port level MASQ is not an option at this
point as I need access to quite a few tcp and udp ports on the other end. I
don't know if I can create a port rule with IP type 50 packets but it might
be a thought?
Any help someone can give me would be appreciated. I am pretty new to all
this but feel I am pretty close.
TIA!
Kevin W. Fuller
ASA WAN Group
Phone: 847-806-8786
Pager: 888-463-4079
E-mail: [EMAIL PROTECTED]
"Micro$oft, reverse engineered from geniuses."
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
