IPSec Host-to-Host VPN (RedHat) needs IP Forwarding?

Question

We would like to build a Host-to-Host IPSec VPN (both RedHat Linux). Is it really mandatory to activate IP Forwarding which is by default deactivated because of our security policy (/etc/sysctl.conf net.ipv4.ip_forward = 0)?

I understand that the VPN adapter have to forward traffic to other network adapters. However, the security risk is that these two servers are becoming "routers". These servers have multiple network adapters in which the traffic should be separated.

What controls should/could be implemented? For example, iptables to minimize the security risk?

Answer 1

I just did some research on this as I am in the same seat as you; I've set up a VPN but wanted to make sure that I'm not forwarding the world.

Enabling forwarding in the kernel, doesn't mean that everything will pass through iptables firewall. However, if the firewall allows all forwarding, you might be in big trouble. Luckily iptables seem to DROP forwarded packets by default. To have a look at your firewall forwarding policies, execute iptables -L FORWARD.

FORWARD is the chain where firewall rules for IP forwarding reside. If you are curious about the different tables and chains a forwarded packet goes through, have a look at https://www.frozentux.net/iptables-tutorial/chunkyhtml/c962.html.

This is what my FORWARD chain looks like on an Ubuntu machine, using the ufw firewall, with a single VPN:

# iptables -L FORWARD
Chain FORWARD (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  192.168.0.0/24       192.168.1.0/24       policy match dir in pol ipsec reqid 5 proto esp
ACCEPT     all  --  192.168.1.0/24       192.168.0.0/24       policy match dir out pol ipsec reqid 5 proto esp
ufw-before-logging-forward  all  --  anywhere             anywhere
ufw-before-forward  all  --  anywhere             anywhere
ufw-after-forward  all  --  anywhere             anywhere
ufw-after-logging-forward  all  --  anywhere             anywhere
ufw-reject-forward  all  --  anywhere             anywhere

Some things to note:

• The default action is DROP (policy DROP, good!).
• The only two ACCEPT rules are for established IPSEC connections (policy match dir in pol ipsec reqid 5 proto esp and policy match dir out pol ipsec reqid 5 proto esp). Those rules have been automagically added by my IPSEC application.
• My FORWARD chain above delegates to ufw-before-logging-forward chain etc. When I investigate them I see no additional ACCEPTs. That is, I should be safe.

Here's an excerpt from iptables -L where I look at the delegated chains:

# iptables -L
[...]

Chain ufw-after-forward (1 references)
target     prot opt source               destination

[...]

Chain ufw-after-logging-forward (1 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "

[...]

Chain ufw-before-forward (1 references)
target     prot opt source               destination
ufw-user-forward  all  --  anywhere             anywhere

[...]

Chain ufw-before-logging-forward (1 references)
target     prot opt source               destination

[...]

Chain ufw-reject-forward (1 references)
target     prot opt source               destination

[...]

Chain ufw-skip-to-policy-forward (0 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere

[...]

Chain ufw-user-forward (1 references)
target     prot opt source               destination

[...]

Chain ufw-user-logging-forward (0 references)
target     prot opt source               destination