[Shorewall-users] Opportunistic encryption

Homer Parker
Wed, 30 Oct 2002 16:23:46 -0000

--UaVKN:=.6O.R.C0z
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Wed, 30 Oct 2002 07:56:39 -0600 "Cowles, Steve"
<Steve@SteveCowles.com>
wrote....

> > -----Original Message-----
> > From: Homer Parker
> > Subject: [Shorewall-users] Opportunistic encryption
> >
> >
> > Has anyone messed with opportunistic encryption in
> > FreeS/WAN? As soon as I run ipsec start, I get the following errors:
> >
> > Oct 29 23:51:20 linux kernel: Shorewall:all2all:REJECT:IN= OUT=ipsec0
> > SRC=64.216.105.3 DST=192.203.230.10 LEN=84 TOS=0x00 PREC=0x00
> > TTL=64 ID=0 DF PROTO=UDP SPT=33012 DPT=53 LEN=64
> > Oct 29 23:51:20 linux kernel: Shorewall:all2all:REJECT:IN= OUT=ipsec0
> > SRC=64.216.105.3 DST=208.191.32.1 LEN=70 TOS=0x00 PREC=0x00 TTL=64
> > ID=13340 DF PROTO=UDP SPT=33087 DPT=53 LEN=5
> >
>
> I messed around with OE/IPSEC months ago, but behind my firewall. My
> goal was just to determine the security impact of implementing OE within
> IPSEC. I remember getting OE to work, but having to add a TSIG/TXT
> record to my DNS zones (which could then be queried using dig) kinda
> bothered me from a security perspective.

	Got that... It''s just the public part of your key, so I don''t
see that as
an issue security wise..

> Anyway, based on my limited understanding of IPSEC/OE -- consider using
> the ipsec _updown script to add the appropriate shorewall rules to allow
> DNS queries to/from the ipsec client.

	I''ll look into that... Thanks!

---
Homer Parker

http://www.homershut.net
telnet://bbs.homershut.net

This e-mail message is 100% Microsoft free!

WARNING: THIS ACCOUNT BELONGS TO A RABID
ANTI-SPAMMER NET-NAZI DOT-COMMUNIST.

   /"\
   \ /     ASCII Ribbon Campaign
    X      Against HTML Mail
   / \

--UaVKN:=.6O.R.C0z
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE9wAeVrgrN227HZ+8RAofcAJ0QyqEkJyhbmAkw41WnsX4/74QN+QCeKV3G
Gl888CCFn66TS0rmHreCx1w=Eyuu
-----END PGP SIGNATURE-----

--UaVKN:=.6O.R.C0z--