Iptables, nat, and IPSec
lopsch at lopsch.com
Wed Apr 6 19:03:12 CEST 2005
dave beach schrieb:
> > It´s an IPSec problem. I don´t want to go into detail but you probably
> should try NAT-Traversal.
> > For the theory http://www.ipsec-howto.org/x180.html
> Okay, I've read the reference. If I understand correctly, I need to use a
> NAT methodology that implements "NAT Traversal" (the reference is a little
> vague on this; in fairness, it does say "There are no RFCs at the moment").
> It might be therefore fair to say that the Linksys implementation includes
> NAT Traversal, enabling it to handle multiple IPSec passthrough connections.
> Which leads me to what I suppose was the original question, now slightly
> modified: does iptables support NAT Traversal?
from the webpage:
"What does NAT traversal do to help? NAT-traversal again encapsulates
the ESP packets in UDP packets. These can easily be handled by a NAT
device since they provide ports."
So you have to activate on your clients the NAT-T "feature" and be sure
the other side supports it too.
And to answer your question, yes every NAT device should be able to
handle multiple IPSec NAT-Ted connections because they are wrapped
within UDP packets and so every connection can be tracked. Essentially
is that both sides which use IPSec are aware of NAT-T and it is
More information about the netfilter