[Shorewall-users] Opportunistic encryption

Homer Parker
Wed, 30 Oct 2002 16:49:49 -0000

--=.TwRx7/U5Z5sQ(u
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Wed, 30 Oct 2002 08:49:09 -0800 Tom Eastep <teastep@shorewall.net>
wrote....

>
>
> Homer Parker wrote:
> > On Wed, 30 Oct 2002 06:21:35 -0800 Tom Eastep
<teastep@shorewall.net>
> > wrote....
> >
> >
> >
> >>To eliminate the above messages, you could simply add a static rule
> >such>as:
> >>
> >>ACCEPT	fw	vpn	udp	53
> >>
> >>Where ''vpn'' is the zone used for the remote
client/network.
> >
> >
> > 	That fixed that error.... Brought in a whole slew of new ones ;)
> > 	These
> > are from klips, so I''ll chase them through FreeS/WAN first ;)
But, I
> > did come up with a couple I don''t remember seeing before:
> >
> > Oct 30 10:36:45 linux kernel: Shorewall:all2all:REJECT:IN= OUT=eth1
> > SRC=64.216.105.3 DST=128.63.2.52 LEN=52 TOS=0x00 PREC=0x00 TTL=255
> > ID=13040 PROTO=ICMP TYPE=0 CODE=0 ID=43520 SEQ=24
> > Oct 30 10:36:48 linux kernel: NET: 12 messages suppressed.
> > Oct 30 10:36:48 linux kernel: klips_error:ipsec_tunnel_start_xmit:
> > ip_send() failed, err=1
> > Oct 30 10:36:48 linux kernel: Shorewall:all2all:REJECT:IN= OUT=eth1
> > SRC=64.216.105.3 DST=128.63.2.52 LEN=52 TOS=0x00 PREC=0x00 TTL=255
> > ID=13041 PROTO=ICMP TYPE=0 CODE=0 ID=43520 SEQ=24
> >
> > 	Looks to me like pings to see if the root servers are alive?
> >
>
> Those are echo replies which are normally allowed because they are
> related to a tracked echo request. Note that the source of these packets
> is your firewall and they are being sent on eth1 -- Is that your
> external interface? And is 128.63.2.52 the remote IPSEC gateway?

	eth1 is the external (PCMCIA wireless, takes a while to initialize)...
128.63.2.52 is  h-root.skitter.caida.org, a root server for DNS...
Opportunistic encryption is a tunnel on the fly.. If the other end
supports it, we have an encrypted link, if not, plain old TCP/IP link...
So, anything can be the other end of the link, and all destination points
are tried... Also, I could go nowhere while I had ipsec running... See
google find in next post for more info...


---
Homer Parker

http://www.homershut.net
telnet://bbs.homershut.net

This e-mail message is 100% Microsoft free!

WARNING: THIS ACCOUNT BELONGS TO A RABID
ANTI-SPAMMER NET-NAZI DOT-COMMUNIST.

   /"\
   \ /     ASCII Ribbon Campaign
    X      Against HTML Mail
   / \

--=.TwRx7/U5Z5sQ(u
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE9wA2wrgrN227HZ+8RAklEAKCZIXUMzhdfQFHSOIYWVOZFxvq42ACeJWCx
L7RV4VE4qKkRS82pTVOC2M4=Fz7V
-----END PGP SIGNATURE-----

--=.TwRx7/U5Z5sQ(u--