[Shorewall-users] Opportunistic encryption

Tom Eastep
Wed, 30 Oct 2002 16:49:09 -0000

Homer Parker wrote:
> On Wed, 30 Oct 2002 06:21:35 -0800 Tom Eastep <teastep@shorewall.net>
> wrote....
>
>
>
>>To eliminate the above messages, you could simply add a static rule such
>>as:
>>
>>ACCEPT	fw	vpn	udp	53
>>
>>Where ''vpn'' is the zone used for the remote
client/network.
>
>
> 	That fixed that error.... Brought in a whole slew of new ones ;) These
> are from klips, so I''ll chase them through FreeS/WAN first ;) But,
I did
> come up with a couple I don''t remember seeing before:
>
> Oct 30 10:36:45 linux kernel: Shorewall:all2all:REJECT:IN= OUT=eth1
> SRC=64.216.105.3 DST=128.63.2.52 LEN=52 TOS=0x00 PREC=0x00 TTL=255
> ID=13040 PROTO=ICMP TYPE=0 CODE=0 ID=43520 SEQ=24
> Oct 30 10:36:48 linux kernel: NET: 12 messages suppressed.
> Oct 30 10:36:48 linux kernel: klips_error:ipsec_tunnel_start_xmit:
> ip_send() failed, err=1
> Oct 30 10:36:48 linux kernel: Shorewall:all2all:REJECT:IN= OUT=eth1
> SRC=64.216.105.3 DST=128.63.2.52 LEN=52 TOS=0x00 PREC=0x00 TTL=255
> ID=13041 PROTO=ICMP TYPE=0 CODE=0 ID=43520 SEQ=24
>
> 	Looks to me like pings to see if the root servers are alive?
>

Those are echo replies which are normally allowed because they are related
to a tracked echo request. Note that the source of these packets is your
firewall and they are being sent on eth1 -- Is that your external
interface? And is 128.63.2.52 the remote IPSEC gateway?

-Tom
--
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@shorewall.net