Hi
I have the following problem. I have SAs that use firewall marks. So only
packets that have that mark get encoded and decoded.
I managed to set the mark for packets that shall be encoded but I cannot get
the other side working.
I have incoming packets that need to be decrypted and I need to set the
correct mark for those.
I CAN actually set the mark using the following command:
iptables -t mangle -A PREROUTING --proto esp -j MARK --set-mark 1
BUT that rule matches ALL incoming esp packets. Yet I will have multiple SAs
and I need to set different marks.
I tried to use select by reqid or by spi, but as soon as I try that, the
rule does not match anything any more.
Can someone help me to get that iptables command right?
Best regards,
Steffen
root@vpn-b:~# setkey -D
10.5.0.2 10.5.0.1
esp mode=tunnel spi=3296784692(0xc480f134) reqid=1(0x00000001)
E: aes-cbc c5eb72ab 906d5717 67e405f5 cfe73f7a
A: hmac-sha1 6935290e e51f0965 06577876 0d6237d6 45a0083d
seq=0x00000000 replay=32 flags=0x00000000 state=mature
created: May 15 22:23:06 2012 current: May 15 22:24:43 2012
diff: 97(s) hard: 1200(s) soft: 907(s)
last: May 15 22:23:19 2012 hard: 0(s) soft: 0(s)
current: 7140(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 85 hard: 0 soft: 0
sadb_seq=1 pid=8282 refcnt=0
10.5.0.1 10.5.0.2
esp mode=tunnel spi=3470192236(0xced6ee6c) reqid=1(0x00000001)
E: aes-cbc e6fad1a5 ff31325b b4856748 c8997ea1
A: hmac-sha1 e401cc9d 59668c9f 866d7e86 b5a38d2c 1dcb2f2d
seq=0x00000000 replay=32 flags=0x00000000 state=mature
created: May 15 22:23:06 2012 current: May 15 22:24:43 2012
diff: 97(s) hard: 1200(s) soft: 888(s)
last: May 15 22:23:19 2012 hard: 0(s) soft: 0(s)
current: 7140(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 85 hard: 0 soft: 0
sadb_seq=0 pid=8282 refcnt=0
root@vpn-b:~# ip -s xfrm policy
src 10.1.1.0/24 dst 10.2.1.0/24 uid 0
dir fwd action allow index 1218 priority 1859 share any flag
(0x00000000)
lifetime config:
limit: soft (INF)(bytes), hard (INF)(bytes)
limit: soft (INF)(packets), hard (INF)(packets)
expire add: soft 0(sec), hard 0(sec)
expire use: soft 0(sec), hard 0(sec)
lifetime current:
0(bytes), 0(packets)
add 2012-05-15 22:08:11 use 2012-05-15 22:18:27
mark 1/0xffffffff
tmpl src 10.5.0.1 dst 10.5.0.2
proto esp spi 0x00000000(0) reqid 1(0x00000001) mode tunnel
level required share any
enc-mask ffffffff auth-mask ffffffff comp-mask ffffffff
src 10.1.1.0/24 dst 10.2.1.0/24 uid 0
dir in action allow index 1208 priority 1859 share any flag
(0x00000000)
lifetime config:
limit: soft (INF)(bytes), hard (INF)(bytes)
limit: soft (INF)(packets), hard (INF)(packets)
expire add: soft 0(sec), hard 0(sec)
expire use: soft 0(sec), hard 0(sec)
lifetime current:
0(bytes), 0(packets)
add 2012-05-15 22:08:11 use -
mark 1/0xffffffff
tmpl src 10.5.0.1 dst 10.5.0.2
proto esp spi 0x00000000(0) reqid 1(0x00000001) mode tunnel
level required share any
enc-mask ffffffff auth-mask ffffffff comp-mask ffffffff
src 10.2.1.0/24 dst 10.1.1.0/24 uid 0
dir out action allow index 1201 priority 1859 share any flag
(0x00000000)
lifetime config:
limit: soft (INF)(bytes), hard (INF)(bytes)
limit: soft (INF)(packets), hard (INF)(packets)
expire add: soft 0(sec), hard 0(sec)
expire use: soft 0(sec), hard 0(sec)
lifetime current:
0(bytes), 0(packets)
add 2012-05-15 22:08:11 use 2012-05-15 22:18:27
mark 1/0xffffffff
tmpl src 10.5.0.2 dst 10.5.0.1
proto esp spi 0x00000000(0) reqid 1(0x00000001) mode tunnel
level required share any
enc-mask ffffffff auth-mask ffffffff comp-mask ffffffff
Attachment:
smime.p7s
Description: S/MIME cryptographic signature
