[Firehol-support] Trouble with masquerading and ipsec

[Les Stott]

Les Stott wrote:
> Costa Tsaousis wrote:
>   
>> Les Stott wrote:
>>     
>>> Hi,
>>>
>>> I have two networks, say 192.168.1.0 (location 1) and 192.168.2.0 
>>> (location 2).
>>>
>>> Location 1 is a linux box running firehol.
>>>
>>> Location 2 is a cyberguard hardware firewall.
>>>
>>> Im using openswan-2.1.5-2 on top of centos5 with firehol 1.256.
>>>
>>> I can get an ipsec tunnel running between the devices no problem.
>>>
>>>  From Location 2, behind the cyberguard i can ping any address behind 
>>> location 1.
>>> i.e. 192.168.2.1 can ping 192.168.1.99
>>>
>>> However from Location 1 i cannot ping location 2.
>>>
>>> At location 1 i am masquerading traffic so that internal pc's can 
>>> browse the internet.
>>>
>>> I have to turn masquerading off in order for location 1 to be able to 
>>> ping location 2. But this breaks all location 1 devices and they 
>>> cannot access the internet.
>>>
>>> How can i get around this?
>>>
>>> Relevant rules from firehol.conf below.....
>>>
>>> location1=192.168.1.0/24
>>> location2=192.168.2.0/24
>>>
>>>
>>> interface "ppp+" internet
>>>         protection strong
>>>         server isakmp accept
>>>         server ESP accept
>>>         server ident reject with tcp-reset
>>>         client all accept
>>>
>>> #IPSEC Routed Connections
>>> router localout src "$location1" dst "$location2"
>>>         route all accept
>>> router remotein src "$location2" dst "$location1"
>>>         route all accept
>>>
>>> router pcsout inface "ppp+" outface "eth0"
>>>         masquerade reverse
>>>         client http accept
>>>         client https accept
>>>         client ftp accept
>>>         client rdp accept
>>>
>>> TIA
>>>
>>> Regards,
>>>
>>> Les
>>>   
>>>       
>> Les,
>>
>> try removing the masquerade statement from the router and adding this 
>> at the top of the firewall (just bellow the definitions of location1 
>> and location2):
>>
>> masquerade ppp+ src "${location1}" dst not "${location2}"
>>
>> This will masquerade traffic only when destination is not location2.
>>
>> Costa
>>
>>     
> Thanks for the tip, i'll try that later tonight as im doing it on a live 
> site, i'll report back how that goes.
>
>   
Brilliant!!!!

Works a treat.

Thanks Costa,

Les