From owner-freebsd-net@FreeBSD.ORG Fri Jul 30 04:31:29 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 10F7C16A4CE for ; Fri, 30 Jul 2004 04:31:29 +0000 (GMT) Received: from bigass1.bitblock.com (ns1.bitblock.com [66.199.170.4]) by mx1.FreeBSD.org (Postfix) with ESMTP id B58ED43D48 for ; Fri, 30 Jul 2004 04:31:28 +0000 (GMT) (envelope-from mitch@bitblock.com) Received: from a1200 ([70.69.125.122]) (AUTH: LOGIN mitch@bitblock.com) by bigass1.bitblock.com with esmtp; Fri, 30 Jul 2004 04:31:23 +0000 X-Abuse-Reports: Visit http://www.bitblock.com/abuse.php X-Abuse-Reports: and submit a copy of the message headers X-Abuse-Reports: or review our policies and procedures X-Abuse-Reports: ID= 4109CF1B.00005209.bigass1.bitblock.com,dns; a1200 ([70.69.125.122]),AUTH: LOGIN mitch@bitblock.com From: "Mitch (bitblock)" To: "Nickolay A. Kritsky" , freebsd-net@freebsd.org Date: Thu, 29 Jul 2004 21:31:23 -0700 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) Importance: Normal In-Reply-To: <652582171.20040730075831@star-sw.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Subject: RE: ipsec packet filtering X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Jul 2004 04:31:29 -0000 I don't know what the reasons are, but I know the result. After much frustrating reasearch I came to the conclusion that I can: a) use linux (not an option as far as I'm concerned) b) use openvpn I need to create a hub and spoke type of vpn arrangement - one spoke node needs to communicate with another through a central router (I can't change this, it's how the carrier network I need works!) This is completly impossible in FreeBSD as far as I can see. I don't know why though ;-) Thanks. m/ > -----Original Message----- > From: owner-freebsd-net@freebsd.org > [mailto:owner-freebsd-net@freebsd.org]On Behalf Of Nickolay A. Kritsky > Sent: Thursday, July 29, 2004 8:59 PM > To: freebsd-net@freebsd.org > Subject: ipsec packet filtering > > > Hello freebsd-net, > > From searching the archives this looks like an old issue, but I > still can't understand something. > AFAIU, now the ipfw + ipsec interoperation looks like this: > input: encrypted packet comes to system. It is not checked against > ipfw rules. Rules are applied to decrypted payload packet. > output: packet is going to leave the system encrypted by ipsec. The > packet itself is not checked by firewall, but, after encryption, the > resulting ESP packet is run against ipfw rules. > I am sorry, but I still cannot understand the reasons for such > strange, ugly behaviour. Does anybody knows the reasons for that and > what chances are that we ever get fully-functional ipfw code > checking _every_ packet on the stack. > > Thanks. > > -- > Best regards, > ; Nickolay A. Kritsky > ; SysAdmin STAR Software LLC > ; mailto:nkritsky@star-sw.com > > > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" >