[Shorewall-users] Opportunistic encryption

Tom Eastep
Wed, 30 Oct 2002 14:21:35 -0000

Cowles, Steve wrote:
>>-----Original Message-----
>>From: Homer Parker
>>Subject: [Shorewall-users] Opportunistic encryption
>>
>>
>>Has anyone messed with opportunistic encryption in
>>FreeS/WAN? As soon as I run ipsec start, I get the following errors:
>>
>>Oct 29 23:51:20 linux kernel: Shorewall:all2all:REJECT:IN= OUT=ipsec0
>>SRC=64.216.105.3 DST=192.203.230.10 LEN=84 TOS=0x00 PREC=0x00
>>TTL=64 ID=0 DF PROTO=UDP SPT=33012 DPT=53 LEN=64
>>Oct 29 23:51:20 linux kernel: Shorewall:all2all:REJECT:IN= OUT=ipsec0
>>SRC=64.216.105.3 DST=208.191.32.1 LEN=70 TOS=0x00 PREC=0x00 TTL=64
>>ID=13340 DF PROTO=UDP SPT=33087 DPT=53 LEN=5
>>
>
>
> I messed around with OE/IPSEC months ago, but behind my firewall. My goal
> was just to determine the security impact of implementing OE within IPSEC.
I
> remember getting OE to work, but having to add a TSIG/TXT record to my DNS
> zones (which could then be queried using dig) kinda bothered me from a
> security perspective.
>
> Anyway, based on my limited understanding of IPSEC/OE -- consider using the
> ipsec _updown script to add the appropriate shorewall rules to allow DNS
> queries to/from the ipsec client.
>

To eliminate the above messages, you could simply add a static rule such as:

ACCEPT	fw	vpn	udp	53

Where ''vpn'' is the zone used for the remote client/network.

-Tom
--
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@shorewall.net