7

Dealing with Firewalls

This chapter explains the issues surrounding firewalls—devices that filter network traffic based on a set of policies. These devices can often interfere with the operation of your IPsec network, and careful consideration needs to be taken when setting them up. The following key topics will be covered:

•Where to place firewalls when using IPsec

•Configuring firewalls to permit IPsec traffic

•Firewalling on the IPsec device itself

•Managing Network Address Translation (NAT)

This chapter will not explain how firewalls work and a rudimentary knowledge of them is assumed.

Where to Firewall?

A firewall is in practice considered to be any network device, usually with two or more interfaces, that can filter network traffic. This includes everything from your home DSL/cable modem router (Linksys, D-Link, and Netgear being popular brands) up to enterprise-class commercial firewalls from vendors such as Checkpoint, Cisco, and Watchguard. Any machine running Linux, *BSD or Mac OS X also comes with firewall software, and many third-party firewall products are available for Microsoft Windows.

A firewall's primary purpose is to select which packets are allowed access to a certain host or network. Careful consideration must be taken when configuring your firewalls to permit IPsec traffic to pass within your networks. This chapter explains how to properly (and securely!) configure your firewalls to allow your VPN to function. Linux commands are given as examples for firewall rules, since many people want to combine the firewall and IPsec functionality onto a single machine, in this case a Linux machine with Openswan and the iptables command.

We will first discuss how to firewall IPsec traffic without NAT and then discuss tips and tricks for dealing with NAT devices. Dealing with devices that perform NAT is often the hardest part of setting up firewalls. These devices change all packets (including IPsec ones) as they are forwarded through the device, and can often complicate or mangle packets with the result that they fail the cryptographic and integrity tests performed by the receiving IPsec endpoint and are dropped.