2012年3月5日 星期一

NAT traversal and IPsec

In order for IPsec to work through a NAT, the following protocols need to be allowed through the NAT interface(s), eg. the LAN router:
or, in case of NAT-T:
  • IKE - UDP port 500
  • IPsec NAT-T - UDP port 4500
Often this is accomplished on home routers by enabling "IPsec Passthrough".
In Windows XP, NAT-T is enabled by default, but in XP with SP2, has been disabled by default for the case when the VPN server is also behind a NAT device, because of a rare and controversial security issue[1]. IPsec NAT-T patches are also available for Windows 2000, Windows NT and Windows 98.
One usage of NAT-T and IPsec is to enable opportunistic encryption between systems. NAT-T allows systems behind NATs to request and establish secure connections on demand.

沒有留言:

張貼留言

用ipset配置linux防火牆

From:http://blog.chinaunix.net/uid-21706718-id-3561951.html iptables是在linux內核裡配置防火牆規則的用戶空間工具,它實際上是netfilter框架的一部分.可能因為iptables是netfilter框架裡最...