Solved

Checkpoint VPN through Iptables

Posted on 2010-08-23
5
863 Views
Last Modified: 2012-05-10
My company have a firewall Linux / iptables, managed by firewallbuilder.

There is a user in my company, that needs to access a another company using a VPN client (Check Point VPN-1 SecureClient NGX R60 HFA2). But I am not able to perform this configuration in firewallbuilder / iptables.

The another company IT, which has firewall checkpoint, said that I needed just allow udp 500 port to ther firewall and put the rule as stateful. I confirmed that all rules in firewallbuilder are stateful by default and even allow all ports from client to destination, the VPN client does not work.

How can I troubleshoot this problem?
0
Comment
Question by:strausswalter
  • 2
  • 2
5 Comments
 
LVL 8

Accepted Solution

by:
jimmyray7 earned 500 total points
ID: 33503902
Try also allowing UDP port 4500, which is sometimes used if a client is behind NAT.
0
 
LVL 33

Expert Comment

by:Dave Howe
ID: 33519914
I have a cp secureclient (r60, but r56 works too) behind a nat. the boxes to tick are office mode and both udp encapsulation boxes in the advanced settings properties page for the connection.
0
 

Author Comment

by:strausswalter
ID: 33521468
I am concluding that the problem is not about ports, I already allow all ports. The problem apparently, is NAT related. I sow that IPSec is not compatible with traditional NAT, I would have to enable NAT-T. I am researching how to setup this type of NAT in iptables.

Using a direct Internet link at client computer (without NAT), the VPN client run normally.
0
 

Author Comment

by:strausswalter
ID: 33585750
Problem solved.

With the help of the company that use this vpn client, I downloaded the VPN client and tried re-install the vpn client in another computer. Looking for the client IP in iptables logs (tail -f /var/log/messages | grep 10.220.2.4) I could see a connect to another company firewall IP (201.x.x.x) at 4500 port. But in a secound connection the VPN client attempted to connect in a strange internal IP (10.1.x.x) at port 500.

The problem was that another company already owned the network 10.220.0.0, but they did not realize it. We assume, after these results, that after the first access the VPN client downloaded the another company network topology and the vpn client thought that it was in the company network and attempted to access a internal server.

We create a separate VLAN to this client, with another network address.

Now it is working properly.
0
 
LVL 33

Expert Comment

by:Dave Howe
ID: 33586747
no company owns 10.x.x.x - its an rfc1918 subnet :)
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
nagios 1 21
AWS EC2 PHP code is not being executed code shows on the page instead 8 65
mcrypt_create_iv() is deprecated 4 67
is my large folder zipped corrupted 4 47
Hello EE, Today we will learn how to send all your network traffic through Tor which is useful to get around censorship and being tracked all together to a certain degree. This article assumes you will be using Linux, have a minimal knowledge of …
It’s 2016. Password authentication should be dead — or at least close to dying. But, unfortunately, it has not traversed Quagga stage yet. Using password authentication is like laundering hotel guest linens with a washboard — it’s Passé.
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:

930 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now