IPtables And VPN Masq

[Diego_18]

Hi , i have an RH 7.1 Working With an adsl connection , as a NAT gateway without a firewall , but when the users of the GW try to acces to a VPN from the company just only one User can acces to the VPN connection , and the others users Can??t.... somebody knows Why is this Happend?
Thanks a lot !!!
Diego

[Mark Bainter]

Hrm. Most likely this is due to your using NAT. Can you paste up your iptables rules that you have?

[Mark Bainter]

Also, what kind of vpn is it? Commercial? If so which? Does it use IPSEC or PPTP?

[Admin32]

There are issues with VPN and NAT. Depending on your VPN configuration, it might fail.


We have a VPN connection here in the office(Greece) to the US and in order to allow users to access the vpn, they run through the Linux gateway where NAT -MASQ is performmed and then the packets are routed to the VPN hardware interface. The important detail here is that all traffic which is for the VPN MUST pass through the NAT-MASQ device before it hits any vpn hardware/software client.

If you try to route vpn packets through the NAT-MASQ gateway - after they have been encrypted by your VPN client, then they will fail because NAT-MASQ makes changes to the Source IP address of the packet and recalculates the IP cheader checksum, inother words the vpn packet is modifed and fails its crc once its received on the other end.

[Steven E. Protter]

Here is a basic iptables configuration.

The last line is commented, it can be uncommented to make the two interface machine a router,firewall enabling internet access to users of your internal network via SNAT

You will have to open port 1723 to add vpn to this configuration.

P

[Steven E. Protter]

I'm sorry, I also have two further recommendations.

Do the 7.3 upgrade, its the last release and is extremely stable.

There is a very good book that helps with a lot of these issues.

Red Hat Linux 7.3 bible. Though there are some typos in the examples, its still a very useful book.

It has saved my tush a number of times.

P