0

I established an IPsec VPN tunnel between two Juniper SRX routers across NAT, with the NAT being performed by the firewall (a Linux server). When attempting to configure the firewall rules to allow IPsec VPN traffic to pass through, I discovered that while IKE negotiation completes successfully with UDP ports 500 and 4500 allowed, VPN traffic communication does not function unless rules are added to allow ESP.

Here are the rules I applied on the firewall, but only IKE negotiation was completed:

iptables -F
iptables -P FORWARD DROP

# Inbound
iptables -I FORWARD -s <External IP address> -d <Internal IP address> -p udp --sport 500 -j ACCEPT
iptables -I FORWARD -s <External IP address> -d <Internal IP address> -p udp --sport 4500 -j ACCEPT

# Outbound
iptables -I FORWARD -s <Internal IP address> -d <External IP address> -p udp --sport 500 -j ACCEPT
iptables -I FORWARD -s <Internal IP address> -d <External IP address> -p udp --sport 4500 -j ACCEPT

And the following two rules should also be set in order to successfully transmit data through the VPN tunnel:

iptables -I FORWARD -s <External IP address> -d <Internal IP address> -p 50 -j ACCEPT
iptables -I FORWARD -s <Internal IP address> -d <External IP address> -p 50 -j ACCEPT

Since the ESP data is encapsulated by the UDP header (provided here are VPN communication packets captured on my firewall), why would the firewall block tunnel traffic without allowing ESP in rules? In my expectation, when the firewall sees that a packet contains a UDP port 4500 header, it should accept the packet accordingly.

Improve this question
4
  • Is there any proof the Juniper boxes actually use NAT-T? Are the ESP packets actually UDP encapsulated?
    – ecdsa
    Commented Mar 22 at 10:14
  • @ecdsa I read the introduction from the book Juniper SRX Series. In Chapter 10, it states: 'NAT-T encapsulates the original ESP traffic in an additional UDP packet. When the VPN gateway receives the UDP traffic, it simply decapsulates the ESP packet from the UDP layer. NAT-T uses UDP port 4500 by default. On the SRX, NAT-T support is enabled by default.'
    – phoebe61g
    Commented Mar 22 at 10:56
  • @ecdsa I captured the VPN traffic on my firewall and observed that the packets were indeed ESP over UDP port 4500 (I've provided a screenshot of Wireshark in my question). Therefore, I believe that NAT-T is operating smoothly on my system.
    – phoebe61g
    Commented Mar 22 at 10:59
  • If that's the case, then the ESP rule is not needed as the firewall will not see protocol 50 (ESP) in the IP headers of forwarded traffic, only protocol 17 (UDP).
    – ecdsa
    Commented Mar 25 at 7:14

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .