<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Kavinda,</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I had seen that diagram before. I found the one I mentioned easier to work with, but that was before I understood the purpose of the xfrm boxes.
<span id="🙂">🙂</span> So I see now that all the IPSec stuff is happening not as a normal process, but as a special use case that will, after encoding or decoding send the packets back through the PREROUTING / INPUT or OUT / POSTROUTING chanes for further
examination which, I think, was the piece that was throwing me. As I dug into xfrm, I found the first 30 minutes of this presentation immensely helpful.
<a href="https://www.youtube.com/watch?v=7oldcYljp4U" id="LPlnk">https://www.youtube.com/watch?v=7oldcYljp4U</a>
<br>
</div>
<div class="_Entity _EType_OWALinkPreview _EId_OWALinkPreview _EReadonly_1"></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks very much for your reply.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Scott<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> Wewegama, Kavinda <Kavinda.Wewegama@forcepoint.com><br>
<b>Sent:</b> September 14, 2020 11:12 PM<br>
<b>To:</b> Scott A. Wozny <sawozny@hotmail.com>; swan@lists.libreswan.org <swan@lists.libreswan.org><br>
<b>Subject:</b> RE: LibreSWAN and iptables</font>
<div> </div>
</div>
<div lang="EN-US">
<div class="x_WordSection1">
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: "Calibri", sans-serif;">
Hi Scott,</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: "Calibri", sans-serif;">
Have you seen this diagram before: <a href="https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg">
https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg</a>
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: "Calibri", sans-serif;">
It might answer some of your questions.</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: "Calibri", sans-serif;">
Thanks.</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: "Calibri", sans-serif;">
-Kavinda</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
<div style="border:none; border-left:solid blue 1.5pt; padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: "Calibri", sans-serif;">
<b>From:</b> Swan <swan-bounces@lists.libreswan.org> <b>On Behalf Of </b>Scott A. Wozny<br>
<b>Sent:</b> Monday, September 14, 2020 5:24 PM<br>
<b>To:</b> swan@lists.libreswan.org<br>
<b>Subject:</b> EXTERNAL: [Swan] LibreSWAN and iptables</p>
</div>
</div>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
<div>
<p><span style="font-size:12.0pt; color:black">My tenuous grip on iptables (and reality) is based upon this chart.
</span></p>
<p><span style="font-size:12.0pt; color:black"> </span></p>
<p><span style="font-size:12.0pt; color:black"><a href="https://stuffphilwrites.com/wp-content/uploads/2014/09/FW-IDS-iptables-Flowchart-v2019-04-30-1.png">https://stuffphilwrites.com/wp-content/uploads/2014/09/FW-IDS-iptables-Flowchart-v2019-04-30-1.png</a></span></p>
<p><span style="font-size:12.0pt; color:black"> </span></p>
<p><span style="font-size:12.0pt; color:black">With most of the work I’m doing, the processing flow of packets and applications is easy to understand. It’s an incoming or an outgoing packet and if it’s not both it’s either locally generated or locally processed
by a process. This works for all my servers and firewalls except for LibreSWAN because it seems (at least to me) to simultaneously exist as an application and a router.
</span></p>
<p><span style="font-size:12.0pt; color:black"> </span></p>
<p><span style="font-size:12.0pt; color:black">I’m trying to understand how LibreSWAN fits with the diagram referenced above and my understanding of iptables. For example, when an unencrypted packet comes in on the LAN side, is it processed through the PREROUTING
and INPUT chains to the ipsec process or is it processed through the PREROUTING and FORWARD chains and, if so, where does the actual encryption and inclusion in the IPSec payload occur? Conversely when IPSec tunnel traffic is created by the ipsec process,
does that traffic start life as a Locally Generated Packet subject to OUTPUT and POSTROUTING chains, or is it considered forwarded traffic and sent through the FORWARD and POSTROUTING chains, again, raising the question of where in the diagram the encryption
occurs? </span></p>
<p><span style="font-size:12.0pt; color:black"> </span></p>
<p><span style="font-size:12.0pt; color:black">The reason I’m trying to get a better hold of this is two-fold. First, I need to know how routing handles these packets at each stage (because the IPs change), mostly so I can figure out how to send out decrypted
data bound for the LAN out the LAN interface while still keeping VPN server management traffic to the management interface knowing that there will be overlap in the destinations. Second, I need to know how to write local firewall rules and what chains to apply
filtering and NAT’ing rules to at various stages of transmission.</span></p>
<p><span style="font-size:12.0pt; color:black"> </span></p>
<p><span style="font-size:12.0pt; color:black">Is there a resource describing this dance or does a simple rule of thumb exist that I’m missing? Two options that come to mind are:</span></p>
<p><span style="font-size:12.0pt; color:black">1) LibreSWAN operates fundamentally as an application. The FORWARD chain never gets involved so all packets are processed incoming through PREROUTING and INPUT chains to local processing with the encryption / decryption
operations under control of the ipsec process followed by “locally generated” ipsec packets being processed through OUTPUT and POSTROUTING until the outgoing packet leaves the system?</span></p>
<p><span style="font-size:12.0pt; color:black">2) LibreSWAN operates fundamentally as a router rather than a process and everything passes through the PREROUTING, FORWARD, POSTROUTING chains and nothing is considered INPUT or OUTPUT (or locally generated /
locally processed)? But in this case where is the encryption / packaging occurring relative to iptables?</span></p>
<p><span style="font-size:12.0pt; color:black"> </span></p>
<p><span style="font-size:12.0pt; color:black">Or maybe things aren’t that simple… Any suggestions for further research would be appreciated.</span></p>
<p><span style="font-size:12.0pt; color:black"> </span></p>
<p><span style="font-size:12.0pt; color:black">Thanks,</span></p>
<p><span style="font-size:12.0pt; color:black"> </span></p>
<p><span style="font-size:12.0pt; color:black">Scott</span></p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: "Calibri", sans-serif;">
<span style="font-size:12.0pt; color:black"> </span></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>