From owner-freebsd-net Tue Jan 15 4:34:21 2002 Delivered-To: freebsd-net@freebsd.org Received: from r4k.net (r4k.net [194.109.74.241]) by hub.freebsd.org (Postfix) with ESMTP id 286BE37B419 for ; Tue, 15 Jan 2002 04:34:06 -0800 (PST) Received: (from alexlh@localhost) by r4k.net (8.11.3/8.11.1) id g0FCYTf27746; Tue, 15 Jan 2002 13:34:29 +0100 (CET) (envelope-from alexlh) Date: Tue, 15 Jan 2002 13:34:29 +0100 From: Alex Le Heux To: Ari Suutari Cc: Rene de Vries , Kshitij Gunjikar , net@FreeBSD.ORG Subject: Re: Filtering packets received through an ipsec tunnel Message-ID: <20020115123429.GV75815@funk.org> References: <200201150733.g0F7Xww91320@guinness.syncrontech.com> <20020115121821.GU75815@funk.org> <200201151213.g0FCDbw92015@guinness.syncrontech.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200201151213.g0FCDbw92015@guinness.syncrontech.com> User-Agent: Mutt/1.3.25i Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Tue, Jan 15, 2002 at 02:22:17PM +0200, Ari Suutari wrote: > Hi, > > On Tuesday 15 January 2002 14:18, Alex Le Heux wrote: > > > > > Maybe one could remove this, add 'ipsec' flag to ipfw > > > (which would use the above ipsec_gethist to match it) > > > so the syntax would be something like this: > > > > > > ipfw add pass tcp from a to b ipsec setup # matches only packets that > came > > > via ipsec stack > > > ipfw add pass 50 from a to b # matches packets that didn't come via ipsec > > > > [snip] > > > > This looks like it would work for most situations. > > > > What one would not be able to do this way is prevent spoofing. In an ideal > > world I would also want to filter packets that come from the wrong tunnel. > > But doesn't ipsec stack already take care of this ? I think (hope) > that is doesn't process the packet if it is coming from wrong tunnel > because the packet does not match the policy. I'm not sure if it actually drops 'wrong' packets coming from the tunnel. I'll see if I have some time soon to look into it. Regards, Alex Le Heux -- "Although the force from the engine is a lot for a motorcycle, the Earth is not impressed. The Motorcycle and I loose the 'F' and 'm' battle and have to consume all the 'a' in the form of sheer unadulterated acceleration." - Ian Orr To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message