[Shorewall-users] Opportunistic encryption

Cowles, Steve
Wed, 30 Oct 2002 13:56:39 -0000

> -----Original Message-----
> From: Homer Parker
> Subject: [Shorewall-users] Opportunistic encryption
>
>
> Has anyone messed with opportunistic encryption in
> FreeS/WAN? As soon as I run ipsec start, I get the following errors:
>
> Oct 29 23:51:20 linux kernel: Shorewall:all2all:REJECT:IN= OUT=ipsec0
> SRC=64.216.105.3 DST=192.203.230.10 LEN=84 TOS=0x00 PREC=0x00
> TTL=64 ID=0 DF PROTO=UDP SPT=33012 DPT=53 LEN=64
> Oct 29 23:51:20 linux kernel: Shorewall:all2all:REJECT:IN= OUT=ipsec0
> SRC=64.216.105.3 DST=208.191.32.1 LEN=70 TOS=0x00 PREC=0x00 TTL=64
> ID=13340 DF PROTO=UDP SPT=33087 DPT=53 LEN=5
>

I messed around with OE/IPSEC months ago, but behind my firewall. My goal
was just to determine the security impact of implementing OE within IPSEC. I
remember getting OE to work, but having to add a TSIG/TXT record to my DNS
zones (which could then be queried using dig) kinda bothered me from a
security perspective.

Anyway, based on my limited understanding of IPSEC/OE -- consider using the
ipsec _updown script to add the appropriate shorewall rules to allow DNS
queries to/from the ipsec client.

Steve Cowles