hello world!
i need to modify the dport of a locally generated packet.
i want an ipsec tunnel between my router here (dynamic ip) and a box
behind a cisco pix firewall (static ip). the problem is that the pix is
an ipsec endpoint as well so forwarding port 500 on the pix is a bad
idea. the nat traversal option only encapsulates esp packets so i have
to make ike work by myself.
the idea is to change the dport from 500 to some other port, say 2000.
as far as i can tell openswan does not support that, so i was/am hoping
i can use iptables to change the dport on packets leaving my box with
destination X.X.X.X.
iptables -A OUTPUT -t nat -p tcp -d X.X.X.X --dport 500 -J DNAT
--to-destination X.X.X.X:2000
doesn't do the trick. in fact locally generated outbound ike packets
don't seem to care about OUTPUT on table nat. the postrouting chain does
not support target DNAT so i'm about to believe i can't do it.
this mailing list is sort of my last hope. if i can't find help here i
might have to start cross compiling :-(
thanks in advance
martin
