06-30-2001
NAT Breaks IPSEC (VPNs)
NAT (Network Address Translation) is not compatible with most VPN technologies. If the VPN is IPSEC based this is certainly the case. Cryptographic systems that use IPSEC (or similar techology) insure the integrity of the IP packet by running cryptographic checksum (kinda) algorithm against the packet. If the packet has changed, it will be dropped.
NAT changes the IP address in the head. This is a violation of the integrity checking mechanism of IPSEC. This is a big problem with NAT. You should consider turning off NAT if you want a clean, not kludgy VPN solution.
If you are not sure of this reply, please post the details of what cryptographic protocols are being used in the VPN tunnel. I can help you if you provide the details on how the tunnel is operating.
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
Hello all,
Can someone instruct me on how to change the listening port for ftp ( or any tcp service) from 21 to another port number? Thanks in advance..
-AJ (3 Replies)
Discussion started by: jacobsa
3 Replies
2. UNIX for Dummies Questions & Answers
Just starting to work with unix, wondering if there is any good on-line documentation explaining TCP/UDP ports, how to use them, etc...
Thanks.... (1 Reply)
Discussion started by: eugene_mayo
1 Replies
3. IP Networking
Just wondering if anyone knows of any good on-line documentation on TCP/UDP Ports. Basically i want to know how to check if they are in use, learn how to close them, etc...
Thanks... (5 Replies)
Discussion started by: eugene_mayo
5 Replies
4. UNIX for Advanced & Expert Users
What is the maximum number of TCP ports that can be consumed at any one time? How can I determine what the number is or increase it?
I was under the impression that with our system (UnixWare 7.1.1) 1024 was the maximum under our current Kernel tuning parms, but I think that is really just... (4 Replies)
Discussion started by: dlkox
4 Replies
5. Windows & DOS: Issues & Discussions
In using a music file sharing program (WinMx), I am told that I
cannot make a primary connection (fastest downloads) because I do not
have a TCP and UDP port. I am running Windows Me.What do I do? Thanks. (6 Replies)
Discussion started by: dookster5
6 Replies
6. UNIX for Advanced & Expert Users
hi,
I'm currently running with an issue whereby we are experiencing very poor access speeds to our Informix database. Connections or requests to the DB are taking in excess of 2/3/4 minutes during peek periods during the day. This has only just started to happen but so far we have been unable to... (0 Replies)
Discussion started by: fastyan
0 Replies
7. UNIX for Dummies Questions & Answers
I'm not sure if this is the right place for this post, but I'd be grateful if somebody could please help me. I'm trying to open ports 999, 1982 and 1983 but am not having much luck. I used
iptables -A INPUT -i eth0 -p tcp --sport 999 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i... (2 Replies)
Discussion started by: thehaapyappy
2 Replies
8. IP Networking
Please can somebody help me. I'm trying to open ports 999, 1982 and 1983 but am not having much luck. I used
iptables -A INPUT -i eth0 -p tcp --sport 999 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 1982 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables... (5 Replies)
Discussion started by: thehaapyappy
5 Replies
9. Solaris
Hello,
One of our developers is asking for a command/script in Solaris similar to "netstat -anp" in Linux. He gave this output as an example:
root@xxx:~# netstat -anp | grep LISTEN
tcp 0 0 0.0.0.0:7937 0.0.0.0:* LISTEN 16082/nsrexecd
tcp 0 ... (7 Replies)
Discussion started by: vimes
7 Replies
10. Shell Programming and Scripting
My requirement is
I need to write a program in shell scripting to check 2 TCP unused unique port numbers in SOLARIS and I have to lock the same ports so that it will not be used in any other new process and the same port numbers should be used and locked in the LINUX machine to communicate... (2 Replies)
Discussion started by: sreeramr30
2 Replies
NAT action in tc(8) Linux NAT action in tc(8)
NAME
nat - stateless native address translation action
SYNOPSIS
tc ... action nat DIRECTION OLD NEW
DIRECTION := { ingress | egress }
OLD := IPV4_ADDR_SPEC
NEW := IPV4_ADDR_SPEC
IPV4_ADDR_SPEC := { default | any | all | in_addr[/{prefix|netmask}]
DESCRIPTION
The nat action allows to perform NAT without the overhead of conntrack, which is desirable if the number of flows or addresses to perform
NAT on is large. This action is best used in combination with the u32 filter to allow for efficient lookups of a large number of stateless
NAT rules in constant time.
OPTIONS
ingress
Translate destination addresses, i.e. perform DNAT.
egress Translate source addresses, i.e. perform SNAT.
OLD Specifies addresses which should be translated.
NEW Specifies addresses which OLD should be translated into.
NOTES
The accepted address format in OLD and NEW is quite flexible. It may either consist of one of the keywords default, any or all, represent-
ing the all-zero IP address or a combination of IP address and netmask or prefix length separated by a slash (/) sign. In any case, the
mask (or prefix length) value of OLD is used for NEW as well so that a one-to-one mapping of addresses is assured.
Address translation is done using a combination of binary operations. First, the original (source or destination) address is matched
against the value of OLD. If the original address fits, the new address is created by taking the leading bits from NEW (defined by the
netmask of OLD) and taking the remaining bits from the original address.
There is rudimental support for upper layer protocols, namely TCP, UDP and ICMP. While for the first two only checksum recalculation is
performed, the action also takes care of embedded IP headers in ICMP packets by translating the respective address therein, too.
SEE ALSO
tc(8)
iproute2 12 Jan 2015 NAT action in tc(8)