PF Blocking VPN Traffic

[plexter]

Hello all,

I am having difficulty allowing VPN traffic to pass through my firewall.

I have tried various combination's with the below being my latest.

pass on $ext_if proto esp from any to any
pass on $ext_if proto udp from any to any port {isakmp, ipsec-nat-t}
pass on $int_if proto esp from any to any
pass on $int_if proto udp from any to any port {isakmp, ipsec-nat-t}

Basically all I am trying to do is allow any traffic that is connected to my VPN (not setup on PF machine) to pass through my firewall (PF).

Hope someone can assist.

Thanks!

[J65nko]

You can assist your self by using a block log all default policy and then use tcpdump on the pflog0 device to see which packets are being blocked .

# tcpdump -eni pflog0

tcpdump will show detailed info about the protocol and/or ports being blocked. You then use this info to adjust your pf.conf.

[DutchDaemon]

Doesn't a VPN need protocol gre as well?

[J65nko]

A VPN could be built with gre and PPTP, but this is not generally done when you use ESP, one of the IPSEC protocols.

Way back in 2004 on bsdforums.org I assisted Dachozenone with a pf.conf for a VPN using ESP.
http://74.125.77.132/bsd?q=cache:tsI...&hl=en&strip=1

The secret is to allow enc0 traffic and UDP port 500.

[plexter]

Hello J65nko

I have realized my error (I think)

Since I am not actually hosting the VPN on the OpenBSD box the traffic coming to it is not actually "VPN" but standard traffic at that point. I added a rule to permit the IP address block for the VPN users and traffic flowed.

I am curious if this is the best way to do this. IF someone where somehow able to "spoof" the source IP of the VPN traffic would they be permitted in then?

My network looks something like this:

[firewall w/ VPN] <--> [OpenBSD FW] <-> rest of network

Thanks

[J65nko]

If your firewall VPN uses certificates or public key authentication and tightly filters the non-VPN traffic I don't think you have to worry about that.

[plexter]

hmm... alright well I presume it is filtering correctly via rules and also NAT is enabled.

Thank you for your help.