From owner-freebsd-net@FreeBSD.ORG  Thu Jul 14 06:43:43 2005
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: freebsd-net@freebsd.org
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id B792C16A41C
	for <freebsd-net@freebsd.org>; Thu, 14 Jul 2005 06:43:43 +0000 (GMT)
	(envelope-from tarkhil@webmail.sub.ru)
Received: from techno.sub.ru (webmail.sub.ru [213.247.139.22])
	by mx1.FreeBSD.org (Postfix) with SMTP id 9C5DB43D4C
	for <freebsd-net@freebsd.org>; Thu, 14 Jul 2005 06:43:42 +0000 (GMT)
	(envelope-from tarkhil@webmail.sub.ru)
Received: (qmail 66958 invoked by uid 0); 14 Jul 2005 06:44:54 -0000
Received: from webmail.sub.ru (HELO localhost) (213.247.139.22)
	by techno.sub.ru with SMTP; 14 Jul 2005 06:44:54 -0000
Received: from unknown ([213.247.139.22])
	by localhost (webmail.sub.ru [213.247.139.22]) (amavisd-new, port 10024)
	with SMTP id 65862-07 for <freebsd-net@freebsd.org>;
	Thu, 14 Jul 2005 10:44:50 +0400 (MSD)
Received: from webmail.sub.ru (HELO control.sub.ru) (213.247.139.22)
	by techno.sub.ru with SMTP; 14 Jul 2005 06:44:50 -0000
Received: (qmail 66902 invoked by uid 0); 14 Jul 2005 06:44:49 -0000
Received: from unknown (HELO armada) (192.168.1.251)
	by control.sub.ru with SMTP; 14 Jul 2005 06:44:49 -0000
Received: (qmail 84296 invoked from network); 14 Jul 2005 06:37:38 -0000
Received: from unknown (HELO ?127.0.0.1?) (127.0.0.1)
	by armada with SMTP; 14 Jul 2005 06:37:38 -0000
Message-ID: <42D60832.9090206@webmail.sub.ru>
Date: Thu, 14 Jul 2005 10:37:38 +0400
From: Alex Povolotsky <tarkhil@webmail.sub.ru>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.8) Gecko/20050704
X-Accept-Language: ru, en-us, en
MIME-Version: 1.0
To: compunction <compunction@gmail.com>
References: <42D536EC.5030500@webmail.sub.ru>
	<9f9a8c4005071322311907b4b@mail.gmail.com>
In-Reply-To: <9f9a8c4005071322311907b4b@mail.gmail.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by amavisd-new at mail.sub.ru
Cc: freebsd-net@freebsd.org
Subject: Re: GRE and PF problem
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 14 Jul 2005 06:43:43 -0000

compunction wrote:

>GRE needs to pass bidirectional.  You will need a binat to make it
>work.  I have not found a firewall that will allow GRE to work with a
>many to one nat.
>  
>

The most painful thing is that pf's nat works for GRE - SOMETIMES :-(

The only thing firewall needs to implement for natting GRE is creation 
of two rules (forward and back) for GRE packet, just like it does for ICMP.

I'm not a firewall writer, but as far as I understand general procedural 
programming, it cannot be THAT complicated.

Alex.