In my ipsec.conf I use the updown script functionality of pluto, i.e. in my conn default I put
leftupdown=/usr/local/bin/updown.sh
and then that script is responsible for setting netfilter rules for that ip while the tunnel is up, i.e.
#!/bin/bash
if [ "$PLUTO_VERB" == "up-client" ] || [ "$PLUTO_VERB" == "up-host" ] ; then
iptables -N $PLUTO_CONNECTION;
iptables -A $PLUTO_CONNECTION -p tcp --dport 22 -j ACCEPT;
iptables -A $PLUTO_CONNECTION -p tcp --dport 23 -j ACCEPT;
iptables -A $PLUTO_CONNECTION -p tcp --dport 80 -j ACCEPT;
iptables -A $PLUTO_CONNECTION -p tcp --dport 443 -j ACCEPT;
iptables -A $PLUTO_CONNECTION -p tcp --dport 3389 -j ACCEPT;
iptables -A $PLUTO_CONNECTION -p tcp --dport 5900 -j ACCEPT;
iptables -A $PLUTO_CONNECTION -p icmp --icmp-type echo-reply -j ACCEPT;
iptables -A $PLUTO_CONNECTION -p icmp --icmp-type echo-request -j ACCEPT;
iptables -A $PLUTO_CONNECTION -j ACCEPT
iptables -I INPUT -s $PLUTO_PEER -j $PLUTO_CONNECTION;
iptables -I FORWARD -s $PLUTO_PEER -j $PLUTO_CONNECTION;
exit 0;
elif [ "$PLUTO_VERB" == "down-client" ] || [ "$PLUTO_VERB" == "down-host" ] ; then
iptables -D INPUT -s $PLUTO_PEER -j $PLUTO_CONNECTION;
iptables -D FORWARD -s $PLUTO_PEER -j $PLUTO_CONNECTION;
iptables -F $PLUTO_CONNECTION;
iptables -X $PLUTO_CONNECTION;
exit 0;
fi
exit 0;
obviously if you needed different rules per tunnel you could just move the updown into the individual conn and define a seperate script per connection with different rules. all of the $PLUTO_... stuff is set in the ENV while the connection is being built... obviously for me, my FORWARD chain is a default drop, so I am just inserting at the top and allowing what I want for the duration of the tunnel.
Hope that helps.
Lane
Devaraj Das wrote:
Hi, I wanted to know whether there is a working solution for the issue that was discussed sometime back: http://www.spinics.net/lists/netfilter/msg22099.html In short is there any solution to enable blocking selective ports in a machine running Linux 2.6.0 + in-kernel ipsec. I would be very helpful if I can get a working solution or some information on a possible solution. Thanks, Devaraj.
