[ previous ] [ next ] [ threads ]
 
 From:  George Bourozikas <george at bourozikas dot net>
 To:  m0n0wall at lists dot m0n0 dot ch
 Subject:  Re: [m0n0wall] IPsec will not forward fragmented packets / MTU issue
 Date:  Mon, 28 Mar 2005 15:06:45 -0500 
Following up, here is a dump of the rules (111.111.111.111 is the main office, 
222.222.222.222 is remote - private IP's are unchanged)

======================================================
LOCAL RULES
======================================================

@1 pass out quick on lo0 from any to any
@2 pass out quick on sis0 proto udp from 192.168.1.1/32 port = 67 to any port 
= 68
@3 pass out quick on sis1 proto udp from any port = 68 to any port = 67
@4 pass out quick on sis1 proto udp from 111.111.111.111/32 port = 500 to any
@5 pass out quick on sis1 proto esp from 111.111.111.111/32 to any
@6 pass out quick on sis1 proto ah from 111.111.111.111/32 to any
@7 pass out quick on sis0 proto udp from 192.168.1.1/32 port = 500 to any
@8 pass out quick on sis0 proto esp from 192.168.1.1/32 to any
@9 pass out quick on sis0 proto ah from 192.168.1.1/32 to any
@10 pass out quick on sis0 from any to any keep state
@11 pass out quick on sis1 from any to any keep state
@12 block out log quick from any to any
@1 pass in quick on lo0 from any to any
@2 block in log quick from any to any with short
@3 block in log quick from any to any with ipopt
@4 pass in quick on sis0 proto udp from any port = 68 to 255.255.255.255/32 
port = 67
@5 pass in quick on sis0 proto udp from any port = 68 to 192.168.1.1/32 port = 
67
@6 block in log quick on sis1 from 192.168.1.0/24 to any
@7 block in log quick on sis1 proto udp from any port = 67 to 192.168.1.0/24 
port = 68
@8 pass in quick on sis1 proto udp from any port = 67 to any port = 68
@9 block in log quick on sis0 from !192.168.1.0/24 to any
@10 block in log quick on sis1 from 10.0.0.0/8 to any
@11 block in log quick on sis1 from 127.0.0.0/8 to any
@12 block in log quick on sis1 from 172.16.0.0/12 to any
@13 block in log quick on sis1 from 192.168.0.0/16 to any
@14 pass in quick on sis1 proto udp from any to 111.111.111.111/32 port = 500
@15 pass in quick on sis1 proto esp from any to 111.111.111.111/32
@16 pass in quick on sis1 proto ah from any to 111.111.111.111/32
@17 pass in quick on sis0 proto udp from any to 192.168.1.1/32 port = 500
@18 pass in quick on sis0 proto esp from any to 192.168.1.1/32
@19 pass in quick on sis0 proto ah from any to 192.168.1.1/32
@20 skip 1 in proto tcp from any to any flags S/FSRA
@21 block in log quick proto tcp from any to any
@22 block in log quick on sis0 from any to any head 100
@1 pass in quick from 192.168.1.0/24 to 192.168.1.1/32 keep state group 100
@2 pass in quick from 192.168.1.0/24 to any keep state keep frags group 100
@23 block in log quick on sis1 from any to any head 200
@1 pass in quick proto esp from 222.222.222.222/32 to 192.168.1.0/24 keep 
state keep frags group 200
@2 pass in quick proto tcp from any to 111.111.111.111/31 port = 987 keep 
state keep frags group 200
@3 pass in quick proto tcp from any to 192.168.1.151/32 port = 22 keep state 
group 200
@24 block in log quick from any to any



======================================================
REMOTE RULES
======================================================


@1 pass out quick on lo0 from any to any
@2 pass out quick on sis0 proto udp from 192.168.2.1/32 port = 67 to any port 
= 68
@3 pass out quick on sis1 proto udp from any port = 68 to any port = 67
@4 pass out quick on sis1 proto udp from 222.222.222.222/32 port = 500 to any
@5 pass out quick on sis1 proto esp from 222.222.222.222/32 to any
@6 pass out quick on sis1 proto ah from 222.222.222.222/32 to any
@7 pass out quick on sis0 proto udp from 192.168.2.1/32 port = 500 to any
@8 pass out quick on sis0 proto esp from 192.168.2.1/32 to any
@9 pass out quick on sis0 proto ah from 192.168.2.1/32 to any
@10 pass out quick on sis0 from any to any keep state
@11 pass out quick on sis1 from any to any keep state
@12 block out log quick from any to any
@1 pass in quick on lo0 from any to any
@2 block in log quick from any to any with short
@3 block in log quick from any to any with ipopt
@4 pass in quick on sis0 proto udp from any port = 68 to 255.255.255.255/32 
port = 67
@5 pass in quick on sis0 proto udp from any port = 68 to 192.168.2.1/32 port = 
67
@6 block in log quick on sis1 from 192.168.2.0/24 to any
@7 block in log quick on sis1 proto udp from any port = 67 to 192.168.2.0/24 
port = 68
@8 pass in quick on sis1 proto udp from any port = 67 to any port = 68
@9 block in log quick on sis0 from !192.168.2.0/24 to any
@10 block in log quick on sis1 from 10.0.0.0/8 to any
@11 block in log quick on sis1 from 127.0.0.0/8 to any
@12 block in log quick on sis1 from 172.16.0.0/12 to any
@13 block in log quick on sis1 from 192.168.0.0/16 to any
@14 pass in quick on sis1 proto udp from any to 222.222.222.222/32 port = 500
@15 pass in quick on sis1 proto esp from any to 222.222.222.222/32
@16 pass in quick on sis1 proto ah from any to 222.222.222.222/32
@17 pass in quick on sis0 proto udp from any to 192.168.2.1/32 port = 500
@18 pass in quick on sis0 proto esp from any to 192.168.2.1/32
@19 pass in quick on sis0 proto ah from any to 192.168.2.1/32
@20 skip 1 in proto tcp from any to any flags S/FSRA
@21 block in log quick proto tcp from any to any
@22 block in log quick on sis0 from any to any head 100
@1 pass in quick from 192.168.2.0/24 to 192.168.2.1/32 keep state group 100
@2 pass in quick from 192.168.2.0/24 to any keep state keep frags group 100
@23 block in log quick on sis1 from any to any head 200
@1 pass in quick proto esp from 111.111.111.111/32 to 192.168.2.0/24 keep 
state keep frags group 200
@2 pass in quick proto tcp from any to 64.81.197.78/31 port = 987 keep state 
keep frags group 200
@3 pass in quick proto tcp from any to 192.168.2.11/32 port = 22 keep state 
group 200
@24 block in log quick from any to any