Next Previous Contents

## 3. Configuring the Linux firewall

## 3.1 Example network

For the Private-IP configuration examples in this document we will use this sample network:

>     Internet-------- 200.200.200.*   ppp0 or  200.200.200.200 eth1
>                                      Dual-Homed Linux Firewall
>                 .--- 10.0.0.1        eth0
>                 |
>                 |--- 10.0.0.2        VPN client or server
>                 |

For the registered-IP configuration examples in this document we will use this sample network:

>     Internet-------- 200.200.200.200 eth1
>                                      Dual-Homed Linux Firewall
>                 .--- 222.0.0.1       eth0
>                 |
>                 |--- 222.0.0.2       VPN client or server
>                 |

The VPN server that the example clients connect to will be `199.0.0.1`

The VPN clients that the connect to the example server will be `199.0.0.2` and `199.0.0.3`

## 3.2 Determining what needs to be done on the firewall

If your VPN client or server has a registered internet IP address you do not need to masquerade or modify your kernel - the stock kernel will successfully route all VPN traffic. You can skip directly to the registered-IP setup sections below.

If your VPN client or server has a Private-Network IP address as described in RFC1918 you will need to patch your kernel (unless your kernel is 2.0.37 or higher in the 2.0.x series).

If you are setting up a masqueraded VPN server, you will also have to obtain and install the following two packages:

- To redirect the inbound TCP/UDP traffic (the 1723/tcp PPTP control channel or the 500/udp ISAKMP channel), you need the appropriate `ipportfw` port-forwarding kernel patch and configuration tool from http://www.ox.compsoc.org.uk/~steve/portforwarding.html. Port forwarding has been incorporated into the 2.2.x kernel. See `man ipmasqadm` for configuration details. If `ipmasqadm` is not included with your distribution it can be obtained at http://juanjox.kernelnotes.org/.

- To redirect the initial inbound tunnel traffic (GRE for PPTP and ESP for IPsec), you need the `ipfwd` generic-IP redirector from http://www.pdos.lcs.mit.edu/~cananian/Projects/IPfwd/.

You do not need port forwarding or ipfwd if you are masquerading only clients.

## 3.3 Patching and configuring the 2.0.x kernel for VPN Masquerade support

1. Install the kernel source (preferably version 2.0.37), which you can obtain from http://www.kernel.org/ or a mirror. The sources should be automatically extracted into a directory named `/usr/src/linux`.

2. Configure and test standard IP Masquerading (see the IP Masquerade HOWTO). Doing this will familiarize you with recompiling your kernel and introduce you to IP Masquerading in general.

3. Back up your kernel sources.

4. Obtain the kernel patch if necessary.

   If your kernel version is 2.0.36 or lower, obtain the 2.0.x VPN Masquerade kernel patch from the VPN Masquerade home page in the "Resources" section above.

   If your kernel version is 2.0.37 or higher in the 2.0.x series, you do not need to apply any patches. The VPN Masquerade code is included in the kernel. Skip the discussion of patching the kernel.

   For the purposes of this document we'll assume you've saved the appropriate patch in `/usr/src/ip_masq_vpn.patch.gz`.

5. Apply the VPN Masquerade patch to your kernel if necessary:

   - Change to the kernel source directory:

     > `cd /usr/src/linux`

   - Apply the patch:

     > `zcat ../ip_masq_vpn.patch.gz | patch -l -p0 > vpn-patch.log 2>&1`

     > Note that the options are "dash lowercase L, dash lowercase P zero". You may get odd results if you change the order of the arguments, as patch seems to be sensitive to the order they appear on the command line.

   - Check the `vpn-patch.log` file to see if any hunks failed. If you get failed hunks, then you probably either omitted the options or ran the patch program from the wrong directory. Restore your kernel from the backup and try again.

6. If you are masquerading a VPN server, obtain and install the `ipportfw` patch from the site given above.

   There is a known conflict between the VPN Masquerade patch and two other networking patches: the IP Firewall Chains patch and the ipportfw patch. They are all trying to add options at the same location in `net/ipv4/Config.in`, and the changes made by one patch alter the context that the other patches are looking for.

   If you're applying the VPN Masquerade patch and the IP Firewall Chains or ipportfw patches to your 2.0.x kernel, you will have to manually edit `net/ipv4/Config.in` and add the block of configuration options from the patch file that fails to work. Looking at the patch file should show you where in `net/ipv4/Config.in` the new options should be added.

   The syntax of patch files is simple. For each block of changes to make, there are two sections: the first shows the "before" state, with an indication of lines to be changed or deleted; the second shows the "after" state, with an indication of the lines that have been changed or added. Use the first section to find where to add the lines, and add the lines that are indicated in the second section.

   This should not be a problem once those patches are updated for 2.0.37+

7. Configure your kernel and select the following options - say YES to the following:

   > `

   >       * Prompt for development and/or incomplete code/drivers
   >         CONFIG_EXPERIMENTAL
   >         - You must enable this to see the VPN Masq options.

   >       * Networking support
   >         CONFIG_NET

   >       * Network firewalls
   >         CONFIG_FIREWALL

   >       * TCP/IP networking
   >         CONFIG_INET

   >       * IP: forwarding/gatewaying
   >         CONFIG_IP_FORWARD

   >       * IP: firewalling
   >         CONFIG_IP_FIREWALL

   >       * IP: masquerading (EXPERIMENTAL)
   >         CONFIG_IP_MASQUERADE
   >         - This is required.

   >       * IP: PPTP masq support (EXPERIMENTAL)
   >         CONFIG_IP_MASQUERADE_PPTP
   >         - Enables PPTP data channel masquerading, if you are
   >           masquerading a PPTP client or server.

   >       * IP: PPTP Call ID masq support (EXPERIMENTAL)
   >         CONFIG_IP_MASQUERADE_PPTP_MULTICLIENT
   >         - Enables PPTP Call ID masquerading; only necessary if
   >           you will be masquerading more than one client trying
   >           to connect to the same remote server. DO NOT enable
   >           this option if you will be masquerading a PPTP server.

   >       * IP: IPsec ESP & ISAKMP masq support (EXPERIMENTAL)
   >         CONFIG_IP_MASQUERADE_IPSEC
   >         - Enables IPsec masquerade, if you are masquerading an
   >           IPsec host.

   >       * IP: IPSEC masq table lifetime (minutes)
   >         - See your network administrator to determine what the
   >           "rekey interval" or "key lifetime" is set to. The
   >           default lifetime of masq table entries is thirty
   >           minutes.  If your rekey interval is greater than
   >           thirty minutes, then you should increase the lifetime
   >           to a value slightly greater than the rekey interval.

   >       * IP: always defragment
   >         CONFIG_IP_ALWAYS_DEFRAG
   >         - Highly recommended for a firewall.

   > `

   NOTE: These are just the settings you need for masquerading. Select whatever other options you need for your specific setup.

8. Recompile the kernel and install it for testing. Don't replace a known working kernel with your new kernel until you have proven it works.

To determine whether the running kernel includes VPN Masquerade support, run the following command:

>     grep -i masq /proc/ksyms

...and look for the following entries:

- IPsec masquerade: `ip_masq_out_get_isakmp`, `ip_masq_in_get_isakmp`, `ip_fw_masq_esp` and `ip_fw_demasq_esp`
- PPTP masquerade: `ip_fw_masq_gre` and `ip_fw_demasq_gre`
- PPTP Call-ID masquerade: `ip_masq_pptp`

If you don't see these entries, VPN Masquerade support is probably not available. If you get complaints about `/proc/ksyms` not being available or `/proc` not being available, make sure that you have enabled the `/proc` filesystem in your kernel configuration.

See the Kernel HOWTO for more details on configuring and recompiling your kernel.

If you are using IPsec masquerade and your system is generating General Protection errors (see `/var/log/messages`) or is locking up, see the VPN Masquerade home page for an update. This patch is for 2.0.38, but should work on earlier kernels. It has been submitted to Alan Cox for inclusion in the 2.0.39 kernel.

## 3.4 Patching and configuring the 2.2.x kernel for VPN Masquerade support

1. Install the kernel source (preferably version 2.2.17 or later), which you can obtain from http://www.kernel.org/ or a mirror. The sources should be automatically extracted into a directory named `/usr/src/linux`.

2. Configure and test standard IP Masquerading (see the IP Masquerade HOWTO). Doing this will familiarize you with recompiling your kernel and introduce you to IP Masquerading in general.

3. Back up your kernel sources.

4. Obtain the kernel patch from the VPN Masquerade home page in the "Resources" section above.

   For the purposes of this document we'll assume you've saved the appropriate patch in `/usr/src/ip_masq_vpn.patch.gz`.

5. Apply the VPN Masquerade patch to your kernel if necessary:

   - Change to the source directory:

     > `cd /usr/src`

   - Apply the patch:

     > `zcat ip_masq_vpn.patch.gz | patch -l -p0 > vpn-patch.log 2>&1`

     > Note that the options are "dash lowercase L, dash lowercase P zero". You may get odd results if you change the order of the arguments, as patch seems to be sensitive to the order they appear on the command line.

     > Also note that the directory you run the patch command in is different for the 2.2.x kernel patch

   - Check the `vpn-patch.log` file to see if any hunks failed. If you get failed hunks, then you probably either omitted the options or ran the patch program from the wrong directory. Restore your kernel from the backup and try again.

6. If you are masquerading a VPN server you do not need the `ipportfw` patch as port forwarding is now built-in. See the `ipmasqadm` man page for more details. If `ipmasqadm` is not included with your distribution it can be obtained at http://juanjox.kernelnotes.org/.

7. Configure your kernel and select the following options - say YES to the following:

   > `

   >       * Prompt for development and/or incomplete code/drivers
   >         CONFIG_EXPERIMENTAL
   >         - You must enable this to see the VPN Masq options.

   >       * Networking support
   >         CONFIG_NET

   >       * Network firewalls
   >         CONFIG_FIREWALL

   >       * TCP/IP networking
   >         CONFIG_INET

   >       * IP: firewalling
   >         CONFIG_IP_FIREWALL

   >       * IP: always defragment
   >         CONFIG_IP_ALWAYS_DEFRAG
   >         - Required for masquerading. This may or may not
   >           be in your kernel config. If not, you should
   >           run this in your startup scripts:
   >             echo 1 > /proc/sys/net/ipv4/ip_always_defrag

   >       * IP: masquerading (EXPERIMENTAL)
   >         CONFIG_IP_MASQUERADE
   >         - This is required.

   >       * IP: masquerading special modules support
   >         CONFIG_IP_MASQUERADE_MOD
   >         - This is required.

   >       * IP: ipportfw masq support (EXPERIMENTAL)
   >         CONFIG_IP_MASQUERADE_IPPORTFW
   >         - Enable this if you will be masquerading a VPN server.

   >       * IP: PPTP masq support
   >         CONFIG_IP_MASQUERADE_PPTP
   >         - Enables PPTP data channel masquerading, if you are
   >           masquerading a PPTP client or server. This is now
   >           available as a module.
   >           Note that you no longer need to specify Call-ID masquerade.

   >       * IP: IPsec ESP & ISAKMP masq support (EXPERIMENTAL)
   >         CONFIG_IP_MASQUERADE_IPSEC
   >         - Enables IPsec masquerade, if you are masquerading an
   >           IPsec host. This is now available as a module.

   >       * IP: IPsec masq table lifetime (minutes)
   >         - See your network administrator to determine what the
   >           "rekey interval" or "key lifetime" is set to. The default
   >           lifetime of masq table entries is thirty minutes. If
   >           your rekey interval is greater than thirty minutes,
   >           then you should increase the lifetime to a value
   >           slightly greater than the rekey interval.

   >       * IP: Enable parallel sessions (possible security risk - see help)
   >         CONFIG_IP_MASQUERADE_IPSEC_PAROK
   >         - See the IPsec masquerade technical notes and special
   >           security considerations section of the HOWTO for
   >           security considerations to be aware of when
   >           masquerading IPsec traffic. If you are only
   >           masquerading one IPsec client this setting has no
   >           effect.

   > `

   Say NO to the following:

   > `

   >       * IP: GRE tunnels over IP
   >         CONFIG_NET_IPGRE
   >         - This, confusingly, has *NOTHING* to do with PPTP.
   >           It enables support for GRE tunnels as used by Cisco
   >           routers. The fact that you see this option does not
   >           imply that PPTP support is available. You still need
   >           to apply the VPN Masquerade patch if the PPTP options
   >           listed above do not appear when you are configuring
   >           your kernel. DO NOT enable this unless you are setting
   >           up a GRE tunnel to a Cisco router.

   > `

   NOTE: These are just the settings you need for masquerading. Select whatever other options you need for your specific setup.

8. Recompile the kernel and install it for testing. Don't replace a known working kernel with your new kernel until you have proven it works.

To determine whether the running kernel includes VPN Masquerade support, run the following command:

>     grep -i masq /proc/ksyms

...and look for the following entries:

- IPsec masquerade: `ip_masq_esp` and `ip_demasq_esp`
- PPTP masquerade: `ip_masq_pptp_tcp` and `ip_demasq_pptp_tcp`

Or run:

>     lsmod

...and look for the following entries:

- IPsec masquerade: `ip_masq_ipsec`
- PPTP masquerade: `ip_masq_pptp`

If you don't see these entries, VPN Masquerade support is probably not available - did you remember to `modprobe ip_masq_pptp.o` or `modprobe ip_masq_ipsec.o` if you compiled them as modules? If VPN masquerade stops working after you reboot, did you remember to add the `modprobe` commands into your `/etc/rc.d/rc.local` startup script?

If you get complaints about `/proc/ksyms` not being available or `/proc` not being available, make sure that you have enabled the `/proc` filesystem in your kernel configuration.

See the Kernel HOWTO for more details on configuring and recompiling your kernel.

## 3.5 ipfwadm setup for a Private-IP VPN Client or Server

The firewall must now be configured to masquerade the outbound VPN traffic. You may wish to visit http://www.wolfenet.com/~jhardin/ipfwadm.html to take a look at a GUI wrapper around the ipfwadm command that automates a lot of security-related packet filtering setup.

The minimum firewall rules are:

>     # Set the default forwarding policy to DENY:
>     ipfwadm -F -p deny
>     # Allow local-network traffic
>     ipfwadm -I -a accept    -S 10.0.0.0/8 -D 0.0.0.0/0  -W eth0
>     ipfwadm -O -a accept    -S 0.0.0.0/0  -D 10.0.0.0/8 -W eth0
>     # Masquerade traffic for internet addresses and allow internet traffic
>     ipfwadm -F -a accept -m -S 10.0.0.0/8 -D 0.0.0.0/0  -W ppp0
>     ipfwadm -O -a accept    -S 0.0.0.0/0  -D 0.0.0.0/0  -W ppp0
>     ipfwadm -I -a accept    -S 0.0.0.0/0  -D 0.0.0.0/0  -W ppp0

> or, if you have a permanent connection,

>     ipfwadm -F -a accept -m -S 10.0.0.0/8 -D 0.0.0.0/0  -W eth1
>     ipfwadm -O -a accept    -S 0.0.0.0/0  -D 0.0.0.0/0  -W eth1
>     ipfwadm -I -a accept    -S 0.0.0.0/0  -D 0.0.0.0/0  -W eth1

This is a completely open setup, though. It will masquerade any traffic from any host on the local network destined for any host on the internet, and provides no security at all.

A tight firewall setup would only allow traffic between the client and the server, and would block everything else:

>     # Set the default policy to DENY:
>     ipfwadm -I -p deny
>     ipfwadm -O -p deny
>     ipfwadm -F -p deny
>     # Allow local-network traffic
>     ipfwadm -I -a accept -S 10.0.0.0/8 -D 0.0.0.0/0  -W eth0
>     ipfwadm -O -a accept -S 0.0.0.0/0  -D 10.0.0.0/8 -W eth0
>     # Masquerade only VPN traffic between the VPN client and the VPN server
>     ipfwadm -F -a accept -m -P udp -S 10.0.0.2/32 500 -D 199.0.0.1/32 500  -W ppp0
>     ipfwadm -F -a accept -m -P tcp -S 10.0.0.2/32     -D 199.0.0.1/32 1723 -W ppp0
>     ipfwadm -F -a deny      -P tcp -S 10.0.0.2/32     -D 199.0.0.1/32      -W ppp0
>     ipfwadm -F -a deny      -P udp -S 10.0.0.2/32     -D 199.0.0.1/32      -W ppp0
>     ipfwadm -F -a accept -m -P all -S 10.0.0.2/32     -D 199.0.0.1/32      -W ppp0
>     ipfwadm -O -a accept    -P udp -S 200.200.200.0/24 500 -D 199.0.0.1/32 500  -W ppp0
>     ipfwadm -O -a accept    -P tcp -S 200.200.200.0/24     -D 199.0.0.1/32 1723 -W ppp0
>     ipfwadm -O -a deny      -P tcp -S 200.200.200.0/24     -D 199.0.0.1/32      -W ppp0
>     ipfwadm -O -a deny      -P udp -S 200.200.200.0/24     -D 199.0.0.1/32      -W ppp0
>     ipfwadm -O -a accept    -P all -S 200.200.200.0/24     -D 199.0.0.1/32      -W ppp0
>     ipfwadm -I -a accept    -P udp -S 199.0.0.1/32 500     -D 200.200.200.0/24 500 -W ppp0
>     ipfwadm -I -a accept    -P tcp -S 199.0.0.1/32 1723    -D 200.200.200.0/24     -W ppp0
>     ipfwadm -I -a deny      -P tcp -S 199.0.0.1/32         -D 200.200.200.0/24     -W ppp0
>     ipfwadm -I -a deny      -P udp -S 199.0.0.1/32         -D 200.200.200.0/24     -W ppp0
>     ipfwadm -I -a accept    -P all -S 199.0.0.1/32         -D 200.200.200.0/24     -W ppp0

> or, if you have a permanent connection,

>     ipfwadm -F -a accept -m -P udp -S 10.0.0.2/32 500 -D 199.0.0.1/32 500  -W eth1
>     ipfwadm -F -a accept -m -P tcp -S 10.0.0.2/32     -D 199.0.0.1/32 1723 -W eth1
>     ipfwadm -F -a deny      -P tcp -S 10.0.0.2/32     -D 199.0.0.1/32      -W eth1
>     ipfwadm -F -a deny      -P udp -S 10.0.0.2/32     -D 199.0.0.1/32      -W eth1
>     ipfwadm -F -a accept -m -P all -S 10.0.0.2/32     -D 199.0.0.1/32      -W eth1
>     ipfwadm -O -a accept    -P udp -S 200.200.200.200/32 500 -D 199.0.0.1/32 500  -W eth1
>     ipfwadm -O -a accept    -P tcp -S 200.200.200.200/32     -D 199.0.0.1/32 1723 -W eth1
>     ipfwadm -O -a deny      -P tcp -S 200.200.200.200/32     -D 199.0.0.1/32      -W eth1
>     ipfwadm -O -a deny      -P udp -S 200.200.200.200/32     -D 199.0.0.1/32      -W eth1
>     ipfwadm -O -a accept    -P all -S 200.200.200.200/32     -D 199.0.0.1/32      -W eth1
>     ipfwadm -I -a accept    -P udp -S 199.0.0.1/32 500  -D 200.200.200.200/32 500 -W eth1
>     ipfwadm -I -a accept    -P tcp -S 199.0.0.1/32 1723 -D 200.200.200.200/32     -W eth1
>     ipfwadm -I -a deny      -P tcp -S 199.0.0.1/32      -D 200.200.200.200/32     -W eth1
>     ipfwadm -I -a deny      -P udp -S 199.0.0.1/32      -D 200.200.200.200/32     -W eth1
>     ipfwadm -I -a accept    -P all -S 199.0.0.1/32      -D 200.200.200.200/32     -W eth1

Note: these rules only allow VPN traffic and block everything else. You will have to add rules for any other traffic you wish to permit, such as DNS, HTTP, POP, IMAP, etc.

## 3.6 ipchains setup for a Private-IP VPN Client or Server

The minimum ipchains firewall rules are:

>     # Set the default forwarding policy to DENY:
>     ipchains -P forward DENY
>     # Allow local-network traffic
>     ipchains -A input   -j ACCEPT -s 10.0.0.0/8 -d 0.0.0.0/0  -i eth0
>     ipchains -A output  -j ACCEPT -s 0.0.0.0/0  -d 10.0.0.0/8 -i eth0
>     # Masquerade traffic for internet addresses and allow internet traffic
>     ipchains -A forward -j MASQ   -s 10.0.0.0/8 -d 0.0.0.0/0  -i ppp0
>     ipchains -A output  -j ACCEPT -s 0.0.0.0/0  -d 0.0.0.0/0  -i ppp0
>     ipchains -A input   -j ACCEPT -s 0.0.0.0/0  -d 0.0.0.0/0  -i ppp0

> or, if you have a permanent connection,

>     ipchains -A forward -j MASQ   -s 10.0.0.0/8 -d 0.0.0.0/0  -i eth1
>     ipchains -A output  -j ACCEPT -s 0.0.0.0/0  -d 0.0.0.0/0  -i eth1
>     ipchains -A input   -j ACCEPT -s 0.0.0.0/0  -d 0.0.0.0/0  -i eth1

This is a completely open setup, though. It will masquerade any traffic from any host on the local network destined for any host on the internet, and provides no security at all.

A tight firewall setup would only allow traffic between the client and the server, and would block everything else:

>     # Set the default policy to DENY:
>     ipchains -P input   DENY
>     ipchains -P output  DENY
>     ipchains -P forward DENY
>     # Allow local-network traffic
>     ipchains -A input  -j ACCEPT -s 10.0.0.0/8 -d 0.0.0.0/0  -i eth0
>     ipchains -A output -j ACCEPT -s 0.0.0.0/0  -d 10.0.0.0/8 -i eth0
>     # Masquerade only VPN traffic between the VPN client and the VPN server
>     # IPsec
>     ipchains -A forward -j MASQ   -p udp -s 10.0.0.2/32 500      -d 199.0.0.1/32 500     -i ppp0
>     ipchains -A output  -j ACCEPT -p udp -s 200.200.200.0/24 500 -d 199.0.0.1/32 500     -i ppp0
>     ipchains -A input   -j ACCEPT -p udp -s 199.0.0.1/32 500     -d 200.200.200.0/24 500 -i ppp0
>     ipchains -A forward -j MASQ   -p 50  -s 10.0.0.2/32          -d 199.0.0.1/32         -i ppp0
>     ipchains -A output  -j ACCEPT -p 50  -s 200.200.200.0/24     -d 199.0.0.1/32         -i ppp0
>     ipchains -A input   -j ACCEPT -p 50  -s 199.0.0.1/32         -d 200.200.200.0/24     -i ppp0
>     # PPTP
>     ipchains -A forward -j MASQ   -p tcp -s 10.0.0.2/32       -d 199.0.0.1/32 1723 -i ppp0
>     ipchains -A output  -j ACCEPT -p tcp -s 200.200.200.0/24  -d 199.0.0.1/32 1723 -i ppp0
>     ipchains -A input   -j ACCEPT -p tcp -s 199.0.0.1/32 1723 -d 200.200.200.0/24  -i ppp0
>     ipchains -A forward -j MASQ   -p 47  -s 10.0.0.2/32       -d 199.0.0.1/32      -i ppp0
>     ipchains -A output  -j ACCEPT -p 47  -s 200.200.200.0/24  -d 199.0.0.1/32      -i ppp0
>     ipchains -A input   -j ACCEPT -p 47  -s 199.0.0.1/32      -d 200.200.200.0/24  -i ppp0

> or, if you have a permanent connection,

>     # IPsec
>     ipchains -A forward -j MASQ   -p udp -s 10.0.0.2/32 500        -d 199.0.0.1/32 500       -i eth1
>     ipchains -A output  -j ACCEPT -p udp -s 200.200.200.200/32 500 -d 199.0.0.1/32 500       -i eth1
>     ipchains -A input   -j ACCEPT -p udp -s 199.0.0.1/32 500       -d 200.200.200.200/32 500 -i eth1
>     ipchains -A forward -j MASQ   -p 50  -s 10.0.0.2/32            -d 199.0.0.1/32           -i eth1
>     ipchains -A output  -j ACCEPT -p 50  -s 200.200.200.200/32     -d 199.0.0.1/32           -i eth1
>     ipchains -A input   -j ACCEPT -p 50  -s 199.0.0.1/32           -d 200.200.200.200/32     -i eth1
>     # PPTP
>     ipchains -A forward -j MASQ   -p tcp -s 10.0.0.2/32        -d 199.0.0.1/32 1723  -i eth1
>     ipchains -A output  -j ACCEPT -p tcp -s 200.200.200.200/32 -d 199.0.0.1/32 1723  -i eth1
>     ipchains -A input   -j ACCEPT -p tcp -s 199.0.0.1/32 1723  -d 200.200.200.200/32 -i eth1
>     ipchains -A forward -j MASQ   -p 47  -s 10.0.0.2/32        -d 199.0.0.1/32       -i eth1
>     ipchains -A output  -j ACCEPT -p 47  -s 200.200.200.200/32 -d 199.0.0.1/32       -i eth1
>     ipchains -A input   -j ACCEPT -p 47  -s 199.0.0.1/32       -d 200.200.200.200/32 -i eth1

Note: these rules only allow VPN traffic. You will have to add rules for any other traffic you wish to permit, such as DNS, HTTP, POP, IMAP, etc.

Also note how there rules are much neater and easier to make sense of than the equivalent ipfwadm rules. This is because ipchains allows specification of all IP protocols, not just TCP, UDP, ICMP or ALL.

## 3.7 A note about dynamic IP addressing

If your firewall is assigned a dynamic IP address by your ISP (dialup accounts are this way, as are some cable internet services), then you should add the following to the startup script `/etc/rc.d/rc.local`:

>     echo 7 > /proc/sys/net/ipv4/ip_dynaddr

This enables dynamic IP address following, which means that should your connection drop and be reestablished, any active sessions will be updated to the new IP address rather than using the old IP address. This does not mean that the session will continue across the interruption, rather that it will be closed down quickly.

If you do not do this, then there may be a "dead period" after you redial and before old masq table entries expire where you're being masqueraded with the wrong IP address, which will prevent your establishing a connection.

This is particularly helpful if you are using a demand-dial daemon such as `diald` to manage your dialup connection.

See `/usr/src/linux/Documentation/networking/ip_dynaddr.txt` for more details.

## 3.8 Additional setup for a Private-IP VPN Server

If you are setting up VPN masquerade for a Private-IP VPN server (that is, you wish to provide for inbound connections as well as outbound connections), you also need to install two packet-forwarding utilities. One (`ipportfw`) forwards inbound TCP or UDP traffic addressed to a specific port on the firewall system to a system on the local network behind the firewall. This is used to redirect the initial inbound 1723/tcp PPTP control channel or 500/udp ISAKMP traffic to the VPN server. The other (`ipfwd`) is a more generic forwarding utility that allows you to do this for any IP protocol. It is used to forward the initial inbound 47/ip (GRE) or 50/ip (ESP) data channel traffic to the VPN server.

Outbound responses to the inbound 1723/tcp or 500/udp traffic are masqueraded using the normal IP-Masquerade facilities in the Linux kernel. The outbound 47/ip or 50/ip traffic is masqueraded using the VPN-Masquerade kernel patch you installed earlier.

Once these utilities are installed, you must configure them to forward the traffic to the VPN server.

- Configuring `ipportfw` under 2.0.x kernels

  The following commands will set up `ipportfw` to forward the initial inbound 500/udp traffic to the IPsec server:

  >     # Static-IP ipportfw setup for IPsec
  >     # Clear the ipportfw forwarding table
  >     /sbin/ipportfw -C
  >     # Forward traffic addressed to the firewall's 500/udp port
  >     # to the IPsec server's 500/udp port
  >     /sbin/ipportfw -A -u 200.200.200.200/500 -R 10.0.0.2/500

  The following commands will set up `ipportfw` to forward the initial inbound 1723/tcp traffic to the PPTP server:

  >     # Static-IP ipportfw setup for PPTP
  >     # Clear the ipportfw forwarding table
  >     /sbin/ipportfw -C
  >     # Forward traffic addressed to the firewall's 1723/tcp port
  >     # to the PPTP server's 1723/tcp port
  >     /sbin/ipportfw -A -t 200.200.200.200/1723 -R 10.0.0.2/1723

  Note that the ipportfw command line requires the internet IP address of the firewall, and you cannot specify the interface (e.g. `ppp0`) as you can with ipfwadm. This means that for a dynamic-IP connection (such as a typical dialup PPP connection) you have to run these commands every time you connect to the internet and are assigned a new IP address. You can do this quite easily - simply add the following to your `/etc/ppp/ip-up` or `/etc/ppp/ip-up.local` script:

  >     # Dynamic-IP ipportfw setup for IPsec
  >     # Clear the ipportfw forwarding table
  >     /sbin/ipportfw -C
  >     # Forward traffic addressed to the firewall's 500/udp port
  >     # to the IPsec server's 500/udp port
  >     /sbin/ipportfw -A -u ${4}/500 -R 10.0.0.2/500

  or:

  >     # Dynamic-IP ipportfw setup for PPTP
  >     # Clear the ipportfw forwarding table
  >     /sbin/ipportfw -C
  >     # Forward traffic addressed to the firewall's 1723/tcp port
  >     # to the PPTP server's 1723/tcp port
  >     /sbin/ipportfw -A -t ${4}/1723 -R 10.0.0.2/1723

  See http://www.wolfenet.com/~jhardin/ipfwadm/invocation.html for more information on firewalling with a dynamic IP.

- Configuring `ipfwd` under both 2.0.x and 2.2.x kernels

  The following command will set up `ipfwd` to forward the initial inbound 50/ip traffic to the IPsec server:

  >     /sbin/ipfwd --masq 10.0.0.2 50 &

  The following command will set up `ipfwd` to forward the initial inbound 47/ip traffic to the PPTP server:

  >     /sbin/ipfwd --masq 10.0.0.2 47 &

  It should only be run once, from your `/etc/rc.d/rc.local` script.

The techniques described here can be generalized to allow masquerading of most any type of server - HTTP, FTP, SMTP, and so forth. Servers that are purely TCP- or UDP-based will not require `ipfwd`.

If you are masquerading a PPTP server you also need to make sure that you have not enabled PPTP Call ID masquerade in the kernel. Enabling PPTP Call ID masquerade builds in some assumptions that you're masquerading only PPTP clients, so enabling it will prevent proper masquerade of the PPTP server traffic. This also means that with the 2.0.x version of the patch you cannot simultaneously masquerade a PPTP server and PPTP clients.

## 3.9 ipfwadm setup for a Registered-IP VPN Server

Setting up a registered-IP VPN server behind a Linux firewall is a simple matter of making sure the appropriate routing and packet-filter commands are in place. Masquerading is not required.

Unfortunately the 2.0.x-series kernels will not let us specify IP protocol 47 or 50 directly, so this firewall is less secure than it could be. If this is a problem for you, then install the IP Firewall Chains kernel patch or move to the 2.1.x or 2.2.x series kernel, where you can filter by IP protocol.

The firewall rules will look something like this:

>     # This section should follow your other firewall rules.

>     # Specify the acceptable clients explicitly for tighter security.
>     # Allow the IPsec ISAKMP traffic in and out.
>     ipfwadm -I -a accept -W eth1 -V 200.200.200.200 -P udp -S 199.0.0.2/32 500 -D 222.0.0.2/32 500
>     ipfwadm -O -a accept -W eth1 -V 200.200.200.200 -P udp -D 199.0.0.2/32 500 -S 222.0.0.2/32 500
>     ipfwadm -I -a accept -W eth1 -V 200.200.200.200 -P udp -S 199.0.0.3/32 500 -D 222.0.0.2/32 500
>     ipfwadm -O -a accept -W eth1 -V 200.200.200.200 -P udp -D 199.0.0.3/32 500 -S 222.0.0.2/32 500
>     # Allow the PPTP control channel in and out.
>     ipfwadm -I -a accept -W eth1 -V 200.200.200.200 -P tcp -S 199.0.0.2/32 -D 222.0.0.2/32 1723
>     ipfwadm -O -a accept -W eth1 -V 200.200.200.200 -P tcp -D 199.0.0.2/32 -S 222.0.0.2/32 1723
>     ipfwadm -I -a accept -W eth1 -V 200.200.200.200 -P tcp -S 199.0.0.3/32 -D 222.0.0.2/32 1723
>     ipfwadm -O -a accept -W eth1 -V 200.200.200.200 -P tcp -D 199.0.0.3/32 -S 222.0.0.2/32 1723

>     # Block all other TCP and UDP traffic from the internet.
>     # This is essentially a "default deny TCP/UDP" that
>     # only applies to the internet interface.
>     ipfwadm -I -a deny -W eth1 -V 200.200.200.200 -P tcp
>     ipfwadm -I -a deny -W eth1 -V 200.200.200.200 -P udp

>     # Specify the acceptable clients explicitly for tighter security.
>     # Note that this is too open since we're forced to
>     # specify "-P all" rather than "-P 47" or "-P 50"...
>     # Allow the PPTP data channel and IPsec ESP traffic in and out.
>     ipfwadm -I -a accept -W eth1 -V 200.200.200.200 -P all -S 199.0.0.2/32 -D 222.0.0.2/32
>     ipfwadm -0 -a accept -W eth1 -V 200.200.200.200 -P all -D 199.0.0.2/32 -S 222.0.0.2/32
>     ipfwadm -I -a accept -W eth1 -V 200.200.200.200 -P all -S 199.0.0.3/32 -D 222.0.0.2/32
>     ipfwadm -O -a accept -W eth1 -V 200.200.200.200 -P all -D 199.0.0.3/32 -S 222.0.0.2/32

>     # Block all other traffic from the internet.
>     # This is essentially a "default deny" that
>     # only applies to the internet interface.
>     ipfwadm -I -a deny -W eth1 -V 200.200.200.200

If you are installing firewall rules on forwarding and/or rules on the inner interface, you will have do do something similar. The above example only covers VPN traffic; you will have to merge it into your existing firewall setup to allow any other traffic you need.

## 3.10 ipfwadm setup for a Registered-IP VPN Client

Setting up a registered-IP VPN client behind a Linux firewall is similar to setting up a registered-IP VPN server.

The firewall rules will look something like this:

>     # Allow the IPsec ISAKMP traffic out and in.
>     ipfwadm -O -a accept -W eth1 -V 200.200.200.200 -P udp -S 222.0.0.2/32 500 -D 199.0.0.1/32 500
>     ipfwadm -I -a accept -W eth1 -V 200.200.200.200 -P udp -D 222.0.0.2/32 500 -S 199.0.0.1/32 500
>     # Allow the PPTP control channel out and in.
>     ipfwadm -O -a accept -W eth1 -V 200.200.200.200 -P tcp -S 222.0.0.2/32 -D 199.0.0.1/32 1723
>     ipfwadm -I -a accept -W eth1 -V 200.200.200.200 -P tcp -D 222.0.0.2/32 -S 199.0.0.1/32 1723

>     # Block all other TCP and UDP traffic from the internet.
>     # This is essentially a "default deny TCP/UDP" that
>     # only applies to the internet interface.
>     ipfwadm -I -a deny -W eth1 -V 200.200.200.200 -P tcp
>     ipfwadm -I -a deny -W eth1 -V 200.200.200.200 -P udp

>     # Note that this is too open since we're forced to
>     # specify "-P all" rather than "-P 47" or "-P 50"...
>     # Allow the PPTP data channel and IPsec ESP traffic out and in
>     ipfwadm -O -a accept -W eth1 -V 200.200.200.200 -P all -S 222.0.0.2/32 -D 199.0.0.1/32
>     ipfwadm -I -a accept -W eth1 -V 200.200.200.200 -P all -D 222.0.0.2/32 -S 199.0.0.1/32

>     # Block all other traffic from the internet.
>     # This is essentially a "default deny" that
>     # only applies to the internet interface.
>     ipfwadm -I -a deny -W eth1 -V 200.200.200.200

## 3.11 ipchains setup for a Registered-IP VPN Server

Setting up a registered-IP VPN server behind a Linux firewall is a simple matter of making sure the appropriate routing and packet-filter commands are in place. Masquerading is not required.

The firewall rules will look something like this:

>     # Specify the acceptable clients explicitly for tighter security.
>     # Allow the IPsec ISAKMP traffic in and out.
>     ipchains -A input  -j ACCEPT -p udp -s 199.0.0.2/32 500 -d 222.0.0.2/32 500 -i eth1
>     ipchains -A output -j ACCEPT -p udp -d 199.0.0.2/32 500 -s 222.0.0.2/32 500 -i eth1
>     ipchains -A input  -j ACCEPT -p udp -s 199.0.0.3/32 500 -d 222.0.0.2/32 500 -i eth1
>     ipchains -A output -j ACCEPT -p udp -d 199.0.0.3/32 500 -s 222.0.0.2/32 500 -i eth1
>     # Allow the IPsec ESP traffic in and out.
>     ipchains -A input  -j ACCEPT -p 50  -s 199.0.0.2/32     -d 222.0.0.2/32     -i eth1
>     ipchains -A output -j ACCEPT -p 50  -d 199.0.0.2/32     -s 222.0.0.2/32     -i eth1
>     ipchains -A input  -j ACCEPT -p 50  -s 199.0.0.3/32     -d 222.0.0.2/32     -i eth1
>     ipchains -A output -j ACCEPT -p 50  -d 199.0.0.3/32     -s 222.0.0.2/32     -i eth1
>     # Allow the PPTP control channel in and out.
>     ipchains -A input  -j ACCEPT -p tcp -s 199.0.0.2/32 -d 222.0.0.2/32 1723 -i eth1
>     ipchains -A output -j ACCEPT -p tcp -d 199.0.0.2/32 -s 222.0.0.2/32 1723 -i eth1
>     ipchains -A input  -j ACCEPT -p tcp -s 199.0.0.3/32 -d 222.0.0.2/32 1723 -i eth1
>     ipchains -A output -j ACCEPT -p tcp -d 199.0.0.3/32 -s 222.0.0.2/32 1723 -i eth1
>     # Allow the PPTP tunnel in and out.
>     ipchains -A input  -j ACCEPT -p 47  -s 199.0.0.2/32 -d 222.0.0.2/32      -i eth1
>     ipchains -A output -j ACCEPT -p 47  -d 199.0.0.2/32 -s 222.0.0.2/32      -i eth1
>     ipchains -A input  -j ACCEPT -p 47  -s 199.0.0.3/32 -d 222.0.0.2/32      -i eth1
>     ipchains -A output -j ACCEPT -p 47  -d 199.0.0.3/32 -s 222.0.0.2/32      -i eth1

If you are installing firewall rules on forwarding and/or rules on the inner interface, you will have do do something similar. The above example only covers VPN traffic; you will have to merge it into your existing firewall setup to allow any other traffic you need.

## 3.12 ipchains setup for a Registered-IP VPN Client

Setting up a registered-IP VPN client behind a Linux firewall is similar to setting up a registered-IP VPN server.

The firewall rules will look something like this:

>     # Allow the IPsec ISAKMP traffic out and in.
>     ipchains -A output -j ACCEPT -p udp -s 222.0.0.2/32 500 -d 199.0.0.1/32 500 -i eth1
>     ipchains -A input  -j ACCEPT -p udp -d 222.0.0.2/32 500 -s 199.0.0.1/32 500 -i eth1
>     # Allow the IPsec ESP traffic out and in.
>     ipchains -A output -j ACCEPT -p 50  -s 222.0.0.2/32     -d 199.0.0.1/32     -i eth1
>     ipchains -A input  -j ACCEPT -p 50  -d 222.0.0.2/32     -s 199.0.0.1/32     -i eth1
>     # Allow the PPTP control channel out and in.
>     ipchains -A output -j ACCEPT -p tcp -s 222.0.0.2/32 -d 199.0.0.1/32 1723 -i eth1
>     ipchains -A input  -j ACCEPT -p tcp -d 222.0.0.2/32 -s 199.0.0.1/32 1723 -i eth1
>     # Allow the PPTP tunnel out and in.
>     ipchains -A output -j ACCEPT -p 47  -s 222.0.0.2/32 -d 199.0.0.1/32      -i eth1
>     ipchains -A input  -j ACCEPT -p 47  -d 222.0.0.2/32 -s 199.0.0.1/32      -i eth1

## 3.13 VPN Masq and LRP

The Linux Router Project at http://www.linuxrouter.org/ provides a Linux-based firewall-on-a-floppy kit. With a '386 PC, two network cards, and a diskette drive, you can set up a full-featured masquerading firewall. No hard disk is needed.

VPN Masquerade is supposed to be included in LRP version 2.2.9 - to verify it is available, see if `ip_masq_ipsec` or `ip_masq_pptp` are listed in the loadable modules in `Package Settings -> Modules`, or grep `/proc/ksyms` as described above. If you want to add VPN masquerade to an earlier version of LRP then somebody on the LRP mailing list may be able to provide a diskette image for you, or you can roll your own kernel using the instructions available on the LRP home page.

The firewall rules would be added to the startup script file in `Network Settings -> Direct Network Setup`.

## 3.14 VPN Masq on a system running FreeS/WAN or PoPToP

If you are going to be using the firewall as an IPsec gateway with FreeS/WAN, you must not enable IPsec masquerade. If you are going to be using the firewall as a PPTP server with PoPToP, or a PPTP client using the Linux PPTP client software, you must not enable PPTP masquerade.

VPN masquerade and a VPN client or server using the same protocols cannot at this time coexist on the same computer.

Your firewall can, however, be a FreeS/WAN IPsec VPN gateway while masquerading PPTP traffic, or vice-versa.

Next Previous Contents