Subject: [Mip4] Firewall traveral problem

From: "Niko A. Fikouras" <[email-masked]>
Date: Tue, 23 Sep 2003 11:30:16 +0200

Hi all,

we are testing the performance of MIP and NOMAD with UMTS. Using PPP our 
mobile node is allocated a globally routable IP address from the UMTS IP 
subnet. In turn the MN registers the CCOA issuing a RegReq with source 
IP address that of the MN. However, a Firewall at the UMTS IP subnet 
will not let any packets out unless the source address belongs withing 
its administered subnet. This was resolved with the help of a reverse 
IPIP tunnel. However, the Firewall will also not let any packets in, 
unless the mobile node has first initiated the flow. For this, the 
reverse IPIP tunnel was replaced with an IP+UDP tunnel which was 
constructed with the help of the OpenVPN software 
(http://openvpn.sourceforge.net/). We have been coming across several 
problems with OpenVPN and would like to know whether anyone has any 
implementation experience that might be willing to share with us.

Best Regards
niko

_______________________________________________
Mip4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip4

---

From: "Niko A. Fikouras" <[email-masked]>
Date: Tue, 23 Sep 2003 11:57:06 +0200

Hi,

first of all thanks for the prompt reply.

Maybe I was not clear enough in my first mail. I silently assumed that 
the MN's IP address is its home IP address. As a MIP MN is only allowed 
to issue packets with its home IP address, hence the RegReq will 
indicate the home IP address as the source IP address. Eventually, this 
packet will get dropped by the firewall.

Is there to your knowledge any implementation of rfc3519 for Linux?

thanx
niko

Henrik Levkowetz wrote:

>Tuesday 23 September 2003, Niko wrote:
>  
>
>I assume (since this is the MIP4 list) that we're talking MIPv4. Have
>you considered implementing MIP NAT traversal ? It sounds as if your
>scenario is a very close match to what NAT traversal was designed to
>do. 
>
>Just to check the premises here though, I wonder if you could clarify
>which address you're referring to when you say 'In turn the MN registers
>the CCOA issuing a RegReq with source IP address that of the MN' above -
>is this really the IP address assigned by the UMTS IP subnet? And in that
>case, how come the assigned IP address is not topologically correct?
>This seems a bit strange to me.
>
>	Henrik
>  
>

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 23 Sep 2003 05:48:59 -0400

Henrik

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 23 Sep 2003 06:12:30 -0400

> first of all thanks for the prompt reply.

Glad to oblige.

> packet will get dropped by the firewall.

Mmm, this doesn't sound right to me. Registration requests must be sent
by the mobile node with the source ip address set to the locally aquired
temporary ip address - how can it hope to get a response routed back to
it otherwise? 

> Is there to your knowledge any implementation of rfc3519 for Linux?

I believe that Jim Binkley <[email-masked]> at Portland State University
has had a student doing an rfc 3519 implementation on Linux, but I'm not
totally sure about the platform and the state of the code. You might want
to drop him a line.

	Regards,
		Henrik