Article View: fj.net.ip
Article #133Re: ipsecでの-p 50パケット許可が必要な理由
From: Yasushi Shinjo
Date: Sat, 22 Nov 2003 10:20
Date: Sat, 22 Nov 2003 10:20
41 lines
3008 bytes
3008 bytes
$B?7>k!wC^GHBg3X>pJs$G$9!#$3$s$K$A$O!#(B
In article <bplbmk$rrk$1@wa1.seikyou.ne.jp>
"YYoshikawa" <YukaYoshikawa@sings.jp> writes:
> /sbin/iptables -A INPUT -i ppp0 -p tcp -m state --state ESTABLISHED --sport
> 50 -j ACCEPT
> /sbin/iptables -A INPUT -i ppp0 -p udp --dport 500 -j ACCEPT
...
> /sbin/iptables -A INPUT -i ppp0 -p 50 -j ACCEPT
> /sbin/iptables -A OUTPUT -o ppp0 -p 50 -j ACCEPT
> $B$rAPJ}$N(BRedhat9$B$G<B9T$7$F$+$i(BWin2k$B$+$i(Bping$B$,DL$j$^$7$?!#(B
> $B=j$G!"$3$N!V(B-p 50$B!W$C$F(Bipv6-crypt$B$N;v$J$s$G$9$h$M!#(B
> $B$3$N%k!<%k$O$I$&$7$FI,MW$J$s$G$7$g$&$+(B?
$B!V(B/sbin/iptables -A INPUT -i ppp0 -p 50 -j ACCEPT$B!W$O!"(B
(1) $BF~NO%$%s%?%U%'!<%9$,(B ppp0 $B$G!"$+$D!"(B
(2) $B%W%m%H%3%k$,(B 50 $B$J$i!"(B
(3) ACCEPT $B$KHt$Y(B
$B$H$$$&%k!<%k$r!"(BINPUT $B$KF~$l$m$HFI$_$^$9!#(B
-p 50 $B$O!"<!$N%U%!%$%k$KF~$C$F$$$kHV9f$G$9!#(B
------------------------------------------------------------
% egrep 'tcp|udp|50' /etc/protocols
tcp 6 TCP # transmission control protocol
udp 17 UDP # user datagram protocol
ipv6-crypt 50 IPv6-Crypt # Encryption Header for IPv6
%
------------------------------------------------------------
tcp $B$J$i(B 6, udp $B$J$i!"(B17$B!#(B
> $B=j$G!"$3$N!V(B-p 50$B!W$C$F(Bipv6-crypt$B$N;v$J$s$G$9$h$M!#(B
> $B$3$N%k!<%k$O$I$&$7$FI,MW$J$s$G$7$g$&$+(B?
IPv6 $B$O;H$C$F$$$J$$$N$K!"(Bipv6- $B$,=P$F$/$k$N$O2?8N$@$H$$$&$N(B
$B$,<ALd$G$9$+!#(Bipv4 $B$b(B ipv6 $B$b!"F1$8HV9f;H$C$F$$$k$s$8$c$J$$(B
$B$G$9$+$M!#(B
$BB3$-$O!"(BFollowup-To: fj.net.ip $B$H$$$&$3$H$G!#(B
$B!@!@!!?7>k!!Lw!!!J$7$s$8$g$&!!$d$9$7!K!!!@!@(B
$B!@!@!!C^GHBg3X!!EE;R!&>pJs!!!!!!!!!!!!!!!@!@(B
Technical Details
Message-ID:
<YAS.03Nov22192033@kirk.is.tsukuba.ac.jp>Path:
arc1-ca.pugleaf.net!archiver1.google.com!news2.google.com!news.maxwell.syr.edu!newsfeed.media.kyoto-u.ac.jp!newsfeed.mesh.ad.jp!news-sv.sinet!nadesico.cc.tsukuba.ac.jp!gama.is.tsukuba.ac.jp!yasReferences:
<bplbmk$rrk$1@wa1.seikyou.ne.jp>Show Full Headers
Complete Article Headers
X-Google-Language: Japanese,JIS X-Google-Thread: 10636f,a1d146b54f47a0da,start X-Google-Attributes: gid10636f,public X-Google-Thread: 101801,88579cb75855a678 X-Google-Attributes: gid101801,public X-Google-ArrivalTime: 2003-11-22 02:21:01 PST Path: arc1-ca.pugleaf.net!archiver1.google.com!news2.google.com!news.maxwell.syr.edu!newsfeed.media.kyoto-u.ac.jp!newsfeed.mesh.ad.jp!news-sv.sinet!nadesico.cc.tsukuba.ac.jp!gama.is.tsukuba.ac.jp!yas From: yas@is.tsukuba.ac.jp (Yasushi Shinjo) Newsgroups: fj.net.ip,fj.os.linux.networking Subject: Re: ipsecでの-p 50パケット許可が必要な理由 Followup-To: fj.net.ip Date: 22 Nov 2003 10:20:33 GMT Organization: Institute of Information Sciences and Electronics, University of Tsukuba Lines: 41 Message-ID: <YAS.03Nov22192033@kirk.is.tsukuba.ac.jp> References: <bplbmk$rrk$1@wa1.seikyou.ne.jp> NNTP-Posting-Host: kirk.hlla.is.tsukuba.ac.jp X-Trace: gama.is.tsukuba.ac.jp 1069495980 16802 130.158.85.129 (22 Nov 2003 10:13:00 GMT) X-Complaints-To: usenet@gama.is.tsukuba.ac.jp NNTP-Posting-Date: 22 Nov 2003 10:13:00 GMT In-reply-to: "YYoshikawa"'s message of Sat, 22 Nov 2003 00:41:05 +0900