Can I use tranport mode (instead of tunnel mode) in IPsec if I tunnel a VPN via UDP? I don't see why the header (that sets the protocol and port) needs to be encrypted in my case (I suspect it would be dropped if the firewall cannot see it as UDP and an OK port). The security policy would apply to the other/peer host doing things the same way, of course.

Clarification: my packets need to go out as UDP so bare IPsec is not an option for me. Maybe I should do RFC3948 UDP Encapsulation of IPsec ESP Packets without AH or IKE for my needs. I am using PSK. Is this NAT Traversal I am ending up with?


In light of your edit:

An IPSec system supporting RFC3948 will do what you want, yes, assuming you do not need AH and that you're using either IKE or IKEv2.

However, the whole system has been designed for NAT traversal so I'm not certain it exactly fits your requirement (you didn't specify WHY you need to limit yourself to UDP or why you want to use IPsec).

  • i need to go through as protocol UDP so maybe i can re-encapsulate. that or use OpenVPN instead of IPsec. – Skaperen Jun 16 '15 at 12:01
  • You need to redefine your question properly, then: you're not making much sense – Stephane Jun 16 '15 at 12:02
  • maybe i am totally off track thinking about IPsec. see question edit i just did. i am trying to do like OpenVPN but need to skip ALL negotiations at the start because they won't go through. IPsec looked interesting because i could re-key it on the fly. – Skaperen Jun 16 '15 at 12:19
  • RFC3948 will not let your use manual keying, I'm afraid. Maybe you should explain your problem and ask to solve it instead because it's hard to give you options when we have no clue about your environment. – Stephane Jun 16 '15 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.