From owner-freebsd-security  Sat Mar  1 13:33: 2 2003
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id A387B37B401
	for <freebsd-security@FreeBSD.ORG>; Sat,  1 Mar 2003 13:32:57 -0800 (PST)
Received: from saul.cis.upenn.edu (SAUL.CIS.UPENN.EDU [158.130.12.4])
	by mx1.FreeBSD.org (Postfix) with ESMTP id F409B43FBD
	for <freebsd-security@FreeBSD.ORG>; Sat,  1 Mar 2003 13:32:56 -0800 (PST)
	(envelope-from agoodloe@saul.cis.upenn.edu)
Received: from saul.cis.upenn.edu (localhost [127.0.0.1])
	by saul.cis.upenn.edu (8.12.5/8.12.5) with ESMTP id h21LWuqP001030
	(version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO)
	for <freebsd-security@FreeBSD.ORG>; Sat, 1 Mar 2003 16:32:57 -0500 (EST)
Received: from localhost (agoodloe@localhost)
	by saul.cis.upenn.edu (8.12.5/8.12.5/Submit) with ESMTP id h21LWuFZ001027
	for <freebsd-security@FreeBSD.ORG>; Sat, 1 Mar 2003 16:32:56 -0500 (EST)
Date: Sat, 1 Mar 2003 16:32:55 -0500 (EST)
From: Alwyn Goodloe <agoodloe@saul.cis.upenn.edu>
To: freebsd-security@FreeBSD.ORG
Subject: IPSEC port filtering
Message-ID: <Pine.GSO.4.44.0303011624500.771-100000@saul.cis.upenn.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

In performing the setup for an experiment I have the following command:

setkey -c <<EOF

spdadd 192.168.4.2/32[any] 192.168.3.2/32[3322] udp -P out ipsec
esp/tunnel/192.168.5.1-192.168.7.2/require
esp/tunnel/192.168.5.1-192.168.5.2/require


Unfortunately, it doesn't seem to be filtering out UDP the packets heading
to that port. They just pass over the wire in the clear.  Using tcpdump
I can watch them heading for  192.168.3.2.3322
If I remove the port ([3322]) the packets are put in the tunnel. Is there
something wrong with the port filtering here.

Alwyn Goodloe
agoodloe@gradient.cis.upenn.edu



























































































To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message