From owner-freebsd-net@FreeBSD.ORG Thu Apr 3 00:27:35 2003 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9DB3937B401 for ; Thu, 3 Apr 2003 00:27:35 -0800 (PST) Received: from hubsch.org (as1-3-6.ars.s.bonet.se [194.236.5.112]) by mx1.FreeBSD.org (Postfix) with SMTP id 4A7BD43F93 for ; Thu, 3 Apr 2003 00:27:34 -0800 (PST) (envelope-from micke@hubsch.org) Received: (qmail 13484 invoked by uid 204); 3 Apr 2003 08:27:31 -0000 Received: from unknown (HELO snaps.home) (172.16.1.3) by 0 with SMTP; 3 Apr 2003 08:27:31 -0000 Date: Thu, 3 Apr 2003 10:27:31 +0200 (CEST) From: Mikael Hubsch X-X-Sender: micke@snaps.home To: freebsd-net@freebsd.org In-Reply-To: <05b901c2f881$67e907f0$52557f42@errno.com> Message-ID: <20030403101114.H13386-100000@snaps.home> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Subject: Re: options FAST_IPSEC & tunnels X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Apr 2003 08:27:35 -0000 On Tue, 1 Apr 2003, Sam Leffler wrote: > Packets are tagged once they've been processed on input. I think you can do > a similar check with something like: > > if (m_tag_find(PACKET_TAG_IPSEC_IN_DONE) != NULL) > goto pass; > > Long term, I intend is to associate packets with an enc device so there's a > way to identify these packets when writing firewall rules. > If the packets are tagged wouldn't it be better to add an ipfw option instead of changing the interface? Then you could add a rule that both test on correct incoming interface and the fact that ipsec processing was done. For example, ipfw add pass esp from 10.1.1.0/24 to any in via fxp1 ipfw add deny all from any to any in via fxp1 not ipsecdone -- Mikael Hubsch