From owner-freebsd-questions@FreeBSD.ORG Thu Feb 8 11:36:19 2007 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 3B4C316A401 for ; Thu, 8 Feb 2007 11:36:17 +0000 (UTC) (envelope-from tom@tomjudge.com) Received: from smtp807.mail.ird.yahoo.com (smtp807.mail.ird.yahoo.com [217.146.188.67]) by mx1.freebsd.org (Postfix) with SMTP id 92F4813C4A6 for ; Thu, 8 Feb 2007 11:36:16 +0000 (UTC) (envelope-from tom@tomjudge.com) Received: (qmail 73958 invoked from network); 8 Feb 2007 11:09:26 -0000 Received: from unknown (HELO ?192.168.1.2?) (thomasjudge@btinternet.com@81.157.42.3 with plain) by smtp807.mail.ird.yahoo.com with SMTP; 8 Feb 2007 11:09:26 -0000 X-YMail-OSG: 1bzxtFEVM1kmXd6GN2kZH.cltXM.ktXK5onvzwTSLKyXPQ7MWnTWUs0qvs0CcisIoGfcuAHl1TYjxOmxsOkTM.R0QRmtDyMm8BUx1T6mFo.5cra7frwQDWNbV46UO0NFa0lD7um56of1qxa5DiITk.FtLOv_7YNjUrFrUw8cAXkKiDNt14.7wlnYdxD1NadgkmOefJMxKoZa0A-- Message-ID: <45CB0504.4060607@tomjudge.com> Date: Thu, 08 Feb 2007 11:09:56 +0000 From: Tom Judge User-Agent: Thunderbird 1.5.0.9 (X11/20070104) MIME-Version: 1.0 To: freebsd-questions@freebsd.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: PF Source routing of IPSEC tunnel ESP packets. X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Feb 2007 11:36:19 -0000 Hi, I am having some problems with source routing using PF, I tried the PF mailing list but got no responses. The network layout is available at: http://www.tomjudge.com/tmp/tunnels.png From the diagram Host A and B both have there default gateway set as ISP A's router, and have a PF rule that should route traffic from ISP B's addresses to ISP B's router. This seems to work for all traffic except the IPSEC ESP packets which always get transmitted to the default gateway that is set on the host. It seems that they do not pass through the firewall or for some reason do not match the route-to rule. Can anyone suggest a solution to this problem? PF rule Host A: (First rule in rule set) pass out quick on bge1 route-to ( bge1 112.0.0.1 ) inet from 112.0.0.2 to ! 112.0.0.0/27 keep state PF rule Host B: (First rule in rule set) pass out quick on bge1 route-to ( bge1 114.0.0.1 ) inet from 114.0.0.2 to ! 114.0.0.0/27 keep state Thanks Tom