Port Forwarding for IPsec

Question

I don't want to use the built in vpn server and I've set up a RAS server at home and I can successfully connect to it locally using either PPTP or L2TP/IPsec. I've also created a port forwarding rule in the orbi to forward tcp/1723 for PPTP and I can successfully connect to it from a remote location.

IPsec requires IP protocol 50 for Encapsulated Security Protocol (ESP) and IP protocol 51 for Authentication Header (AH), as well as UDP/500. How can I forward this traffic through the ORBI? I would prefer to just use L2TP/IPsec.

CrimpOn · Answer

Have you tried creating rules for these ports just as you did for the PPTP?

When creating rules, I ignore the drop down menu and create everything as a "Custom Rule". Give it a cool name, enter the port, select TCP and/or UDP.

gordo5 · Answer

Well, that is actually the problem.&nbsp; The custom rule only allows you to select ports in Protocol&nbsp; 6 (TCP) and Protocol 17 (UDP).&nbsp; IPSec uses Protocol 50 (ESP) and Protocol 51 (AH).&nbsp;Here is a nice summary:https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml&nbsp;I saw the dropdown had a pre-defined rule for PPTP, which can be config'd using the custom rules.&nbsp; If the custom rules won't allow you to configure IPsec, it would be nice if it was included in the pre-defined dropdown.&nbsp;

CrimpOn · Answer

Of course, you are correct.&nbsp; (I now have a Dunce Cap for every day of the week!)&nbsp; Looks like you are stuck with either PPTP&nbsp; on the RAS or OpenVPN (on the Orbi itself).&nbsp; I have been very happy with OpenVPN on my Orbi.&nbsp;Perhaps you could hack at the iptables.&nbsp; I know that Voxel's custom firmware for the RBR50 allows customizing iptables.&nbsp; (I am also happy with this firmware.&nbsp; Probably fat and dumb as well.)

schumaku · Answer

ESP can never work as the NAT router would only translate the "outer" IP addresses, but there is no port information, ... so things will go bulloks.&nbsp;Look for L2TP/IPsec with NAT-T, here the ESP packets will be encpasulated in packets using port 4500/UDP.¨. Before, IKE will run on 500/UDP. AFAIK that's all you need to expose by adding forward rules.

gordo5 · Answer

Thanks.&nbsp; I wasn't aware of the NAT issue with ipsec.&nbsp; I've moved onto SSTP, which just needs tcp/443.&nbsp; Took a several stabs to get the certs right (or, at least, close enough), but it works now.&nbsp; Too bad there isn't any native android support for it...&nbsp;I went this route because I found the ORBI one slow.&nbsp; I don't think the orbi processor is up to the task except for light duty things, like rdp.&nbsp; Running my own vpn I can saturate my bandwidth.&nbsp; :-)&nbsp;

Forum Discussion

Port Forwarding for IPsec

5 Replies