Administrace komentářů

Riesim nasledujuci problem s forwardom IPsecu. Siet tvori server(eth0 xxx.xxx.xxx.xxx, wlan0 10.10.10.1) a laptop (wlan0 10.10.10.2). Spojene je to cez wifi prostrednictvom IPsec tools + racoon + x509 certifikaty. Spojenie je OK. Prihlasenie je mozne len s platnym certifikatom.
Problem nastane ak na serveri spustim forwarding a SNAT z wlan0 do eth0 - itranetu. Server uz nevyzaduje sifrovane spojenie a overovanie podla certifikatov. Tj moze sa pripojit kazdy.... . Setkey pritom defaultne vytvara poziadavok na autentifikaciu.

ipsec-tools.conf -laptop
#!/usr/sbin/setkey -f
flush;
spdflush;

spdadd 10.10.10.2 10.10.10.1 any -P out ipsec
    esp/transport//require;
                      
spdadd 10.10.10.1 10.10.10.2 any -P in ipsec
    esp/transport//require;

racoon.conf - laptop
path certificate "/etc/racoon/certs";

remote 10.10.10.1
{
	exchange_mode main;
	my_identifier asn1dn;
	peers_identifier_ asn1dn;
	verify_cert on;
	
	certificate_type x509 "laptop.public" "laptop.private";
	
	peers_certfile x509 "server.public";
	proposal {
		encryption_algorithm 3des;
		hash_algorithm sha1;
		authentication_method rsasig;
		dh_group 2;
		}
}
sainfo anonymous
{
	lifetime time 30min;
	encryption_algorithm 3des;
	authentication_algorithm hmac_md5;
	compression_algorithm deflate;
}

setkey -DP - laptop
10.10.10.1[any] 10.10.10.2[any] any
        in ipsec
        esp/transport//require
        created: Sep 18 18:59:32 2005  lastused:
        lifetime: 0(s) validtime: 0(s)
        spid=120 seq=2 pid=3115
        refcnt=1
10.10.10.2[any] 10.10.10.1[any] any
        out ipsec
        esp/transport//require
        created: Sep 18 18:59:32 2005  lastused:
        lifetime: 0(s) validtime: 0(s)
        spid=113 seq=1 pid=3115
        refcnt=1
10.10.10.1[any] 10.10.10.2[any] any
        fwd ipsec
        esp/transport//require
        created: Sep 18 18:59:32 2005  lastused:
        lifetime: 0(s) validtime: 0(s)
        spid=130 seq=0 pid=3115
        refcnt=1

Ipsec-tools.conf , racoon.conf a setkey -DP pre server su rovnake (ip adresy, certifikaty su prehodene ). Iptables zrejme urobia forwarding a SNAT pred tym ako IPsec overi spojenie. Ako by sa dalo nastavit aby to robili az po overeni? Alebo mam niekde v konfiguracii chybu?