From owner-freebsd-security@FreeBSD.ORG  Sun Oct 26 08:52:23 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 6E16E16A4B3
	for <freebsd-security@freebsd.org>;
	Sun, 26 Oct 2003 08:52:23 -0800 (PST)
Received: from magnesium.net (toxic.magnesium.net [207.154.84.15])
	by mx1.FreeBSD.org (Postfix) with SMTP id A8FFA43FBD
	for <freebsd-security@freebsd.org>;
	Sun, 26 Oct 2003 08:52:22 -0800 (PST)	(envelope-from unfurl@dub.net)
Received: (qmail 32504 invoked by uid 1001); 26 Oct 2003 16:52:22 -0000
Date: 26 Oct 2003 08:52:22 -0800
Date: Sun, 26 Oct 2003 08:52:22 -0800
From: Bill Swingle <unfurl@dub.net>
To: "G. Panula" <greg.panula@lexisnexis.com>
Message-ID: <20031026165222.GA31223@dub.net>
References: <u0qcpv0csl3lb1p6a8aioe7qjqjtvd6th9@4ax.com>
	<3F97BA17.8050403@lexisnexis.com>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="ew6BAiZeqk4r7MaW"
Content-Disposition: inline
In-Reply-To: <3F97BA17.8050403@lexisnexis.com>
User-Agent: Mutt/1.4.1i
X-Operating-System: FreeBSD toxic.magnesium.net 5.1-RELEASE FreeBSD
	5.1-RELEASE 
cc: freebsd-security@freebsd.org
Subject: Re: IPSec VPNs: to gif or not to gif
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 26 Oct 2003 16:52:23 -0000


--ew6BAiZeqk4r7MaW
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Oct 23, 2003 at 06:23:03AM -0500, G. Panula wrote:
> Current behavior is encrypted packet is handled by ipfw once, then after=
=20
> decryption it is only handled by ipfw(again) if it passes thru an=20
> interface didn't arrive on.

Does this apply to ipfilter as well?

-Bill

--=20
-=3D| Bill Swingle - <unfurl@(dub.net|freebsd.org)>
-=3D| Every message PGP signed
-=3D| PGP Fingerprint: C1E3 49D1 EFC9 3EE0 EA6E  6414 5200 1C95 8E09 0223
-=3D| "Computers are useless. They can only give you answers" Pablo Picasso=
=20




--ew6BAiZeqk4r7MaW
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (FreeBSD)

iD8DBQE/m/vGUgAclY4JAiMRAo51AJ91HRZbQnv1smz9LQJA2iIbpCtodACeOVmL
v3paPTaEa0n1oq95QWtPppk=
=5ON6
-----END PGP SIGNATURE-----

--ew6BAiZeqk4r7MaW--