From owner-freebsd-net@FreeBSD.ORG Tue Apr 11 21:28:03 2006 Return-Path: X-Original-To: freebsd-net@freebsd.org Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 66AA216A400 for ; Tue, 11 Apr 2006 21:28:03 +0000 (UTC) (envelope-from kbyanc@posi.net) Received: from ylpvm01.prodigy.net (ylpvm01-ext.prodigy.net [207.115.57.32]) by mx1.FreeBSD.org (Postfix) with ESMTP id A445243D45 for ; Tue, 11 Apr 2006 21:28:02 +0000 (GMT) (envelope-from kbyanc@posi.net) Received: from pimout5-ext.prodigy.net (pimout5-int.prodigy.net [207.115.4.21]) by ylpvm01.prodigy.net (8.12.10 outbound/8.12.10) with ESMTP id k3BLRxag010358 for ; Tue, 11 Apr 2006 17:27:59 -0400 X-ORBL: [71.141.241.167] Received: from gateway.posi.net (adsl-71-141-241-167.dsl.snfc21.pacbell.net [71.141.241.167]) by pimout5-ext.prodigy.net (8.13.6 out.dk/8.13.6) with ESMTP id k3BLRjCw262170; Tue, 11 Apr 2006 17:27:47 -0400 Received: from localhost (localhost [127.0.0.1]) by gateway.posi.net (Postfix) with ESMTP id 045D275E05F; Tue, 11 Apr 2006 15:35:35 -0700 (PDT) Date: Tue, 11 Apr 2006 15:35:35 -0700 (PDT) From: Kelly Yancey To: Dmitry Pryanishnikov In-Reply-To: <20060402151039.R51461@atlantis.atlantis.dp.ua> Message-ID: <20060411153224.L55107@gateway.posi.net> References: <442D8E98.6050903@vineyard.net> <20060331222813.GA29047@zen.inc> <20060331223613.GD80492@spc.org> <20060402130227.G99958@atlantis.atlantis.dp.ua> <20060402113516.D76259@maildrop.int.zabbadoz.net> <20060402151039.R51461@atlantis.atlantis.dp.ua> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Cc: "Bjoern A. Zeeb" , VANHULLEBUS Yvan , freebsd-net@freebsd.org Subject: Re: tcpdump and ipsec X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Apr 2006 21:28:03 -0000 On Sun, 2 Apr 2006, Dmitry Pryanishnikov wrote: > > Hello! > > On Sun, 2 Apr 2006, Bjoern A. Zeeb wrote: > >> Why not? IMHO it will be very useful feature: think about e.g. traffic > >> shaping for several different networks which are routed via the same > >> ipsec tunnel. Without the enc0, you can only shape them together, e.g.: > > > > why not shaping on the internal interface in case this is a gateway? > > You know src and dst there too. > > Gateway can also contain sources of traffic, and we should be able > to shape all outgoing or incoming traffic (not only transit packets, > but also locally-originated). > > > The only difference enc0 makes is for host-only-setups or if you want > > to see all your unencrpyted ipsec traffic on a gateway in one place. > > It seems to me that it's also useful for general traffic > shaping/accounting/filtering purposes. > > Sincerely, Dmitry I agree 100%. At work, we implemented the enc interface for FreeBSD 4.7 and 4.10 along with extending the divert interface such that we could perform filtering and NAT on packets after tunnel decapsulation. Just because one person doesn't have a use for the enc interface, does not mean that no one does. Kelly -- Kelly Yancey - kbyanc@{posi.net,FreeBSD.org} - kelly@nttmcl.com