With iptables, match packets arrived via IPSEC tunnel

Question

I'm using IPSEC in a tunnel mode.

How to make an iptables rule that will match only packets which arrived via IPSEC tunnel (i.e. after IPSEC decrypted them - not the IPSEC packets when they arrive and before decryption).

The point is to have a certain port which will be accessible only via IPSEC and inaccessible to the rest of the world.

score 19 · Accepted Answer · answered Jan 06 '13 at 16:52

19

You need to use the policy module, and specify the ipsec policy, to match this traffic. The following rule, for example, allows all inbound traffic to tcp port 12345. Don't forget that rule order is important in iptables, and that you may need to allow the return-half packets as well, depending on your current OUTPUT restrictions.

iptables -A INPUT -m policy --pol ipsec --dir in -p tcp --dport 12345 -j ACCEPT

answered Jan 06 '13 at 16:52

MadHatter

78,442
20
178
229

Finally I tested it, and indeed it works for me. Thanks. – Sandman4 Jan 09 '13 at 10:48
Glad you got your problem fixed! – MadHatter Jan 09 '13 at 11:50

With iptables, match packets arrived via IPSEC tunnel

1 Answers1

Linked

Related