Thread: iptables & VPN client

hi,

i'm trying set iptables rules on desktop machine acting ipsec/l2tp vpn client. able prevent outbound traffic not fall of following categories:

• dhcp packets (to allow connection ip network)
• isakmp packets allow set-up of ipsec connection
• esp packets transport data

internet searches bring lots of hits gateway machine allow type of traffic route through it, not enforce when firewall on source machine.

have tried following iptables rules:

code:

iptables -a output -p udp --sport 67:68 --dport 67:68 -j accept  iptables -a output -p udp --sport 500 --dport 500 -j accept  iptables -a output -p esp -j accept  iptables -a output -j drop

these rules allow dhcp , isakmp packets through, , in fact ike completes , ipsec connection gets created (checked via wireshark @ remote end). esp packets dropped.

experimentation few different rules, appears iptables dropping packets attempting leave, presumably because entering ip stack whatever @ source, becoming esp packets traverse ipsec layer.

there way achieve goal, or trying not possible iptables?

gratefully received.

Forum The Ubuntu Forum Community Ubuntu Specialised Support Security [all variants] iptables & VPN client

Ubuntu