iptables – Matching Packets Arrived via IPSEC Tunnel

ipseciptableslinux

I'm using IPSEC in a tunnel mode.

How to make an iptables rule that will match only packets which arrived via IPSEC tunnel (i.e. after IPSEC decrypted them – not the IPSEC packets when they arrive and before decryption).

The point is to have a certain port which will be accessible only via IPSEC and inaccessible to the rest of the world.

Best Answer

You need to use the policy module, and specify the ipsec policy, to match this traffic. The following rule, for example, allows all inbound traffic to tcp port 12345. Don't forget that rule order is important in iptables, and that you may need to allow the return-half packets as well, depending on your current OUTPUT restrictions.

iptables -A INPUT -m policy --pol ipsec --dir in -p tcp --dport 12345 -j ACCEPT

Related Solutions

Iptables – Allow only IPSEC outgoing traffic to a port (using IPTABLE?)

Thanks for the suggestions. It turned out to be related to how IPSEC VPN works on iOS (apple) devices.

On iOS devices, on turning the ipsec VPN ON, rule is added automatically in route table to send the IPSEC server/peer traffic directly to gateway to avoid looping (packet getting encrypted again) and rest of the traffic are sent to ipsec tunnel first to get encrypted and then onto ipsec server.

And in my case IPSEC server and the target server(where traffic is targeted) happens to be the same machine (resolves to same IP address), so when the traffic is sent to the target server (port XXXX), instead of its getting encrypted in IPSEC tunnel, it was sent directly to the server due to the special rule without getting encapsulated in ipsec packet. So when these packets arrived on server, it didn't get recognised as ipsec packets and that was the issue.

Since I couldn't avoid iOS client sending the traffic to port XXXX (though without ipsec encapsulation), I had to find a way to let only that device to have access to port XXXX and not to the whole world. So what I ended up doing was to have my own ipsec updown script on ipsec server that adds a INPUT chain rule dynamically to allow traffic from the established client's IP address to port XXXX on vpn connect and remove the rule on vpn disconnect. This way only the VPN connected clients will have access to port XXXX.

Iptables – No ping on IPSec tunnel with Strongswan

Solved by adding this iptables rule:

sudo iptables -t nat -I POSTROUTING 1 -j ACCEPT -s 10.0.0.0/24 -m policy --dir out --pol ipsec

See here for more details: Strongswan vpn tunnel connected but the traffic is not routed through it

Best Answer

Related Solutions

Iptables – Allow only IPSEC outgoing traffic to a port (using IPTABLE?)

Iptables – No ping on IPSec tunnel with Strongswan

Related Topic