[Users] iptables SNAT interfering with IKE?

All,

My configuration highlights are as follows...

	OS: Redhat 7.3, kernel=2.4.18-3, iptables=1.2.5-3
	freeswan: 1.98b, x509patch-0.9.14, NAT-Traversal-0.4

I have two locations running dedicated firewalls with the above. These machines act as SNAT proxies for the users behind them. They also provide a full time VPN tunnel between the two sites, and provide "road warrior" VPN support. My SNAT iptables entry looks like this...

        -A POSTROUTING -o eth0 -j SNAT --to <My IP Address>

Everything works fine until a user behind one of my firewalls uses a local IPsec client. Specifically, road warriors are forgetting to turn off their local clients and creating their own tunnel to the remote gateway. When the remote gateway tries to rekey it's "permanent" connection, it finds itself talking to the local user's client and the connection fails. When the local gateway attempts to rekey the connection it is sending requests from the wrong port.

I believe that iptables is giving away port 500 to enable IPsec passthrough. Unfortunately this breaks my permanent VPN tunnel. I would still like to allow local users to use IPSec so, I don't want to block outgoing requests to UDP port 500.

Suggestions?

Thanks in advance,

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek

Bill Cornatzer
Network Administrator
Digital 5, Inc.