From owner-freebsd-net@FreeBSD.ORG Thu Jul 14 12:51:51 2005 Return-Path: X-Original-To: freebsd-net@freebsd.org Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DB07416A41C for ; Thu, 14 Jul 2005 12:51:51 +0000 (GMT) (envelope-from gpt@tirloni.org) Received: from srv-03.bs2.com.br (srv-03.bs2.com.br [200.203.183.32]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7538543D46 for ; Thu, 14 Jul 2005 12:51:51 +0000 (GMT) (envelope-from gpt@tirloni.org) Received: from localhost (localhost.bs2.com.br [127.0.0.1]) by srv-03.bs2.com.br (Postfix) with ESMTP id 3047F4ADC1; Thu, 14 Jul 2005 09:52:08 -0300 (BRT) Received: from [172.16.12.100] (unknown [200.138.144.12]) by srv-03.bs2.com.br (Postfix) with ESMTP id C0A734ADC7; Thu, 14 Jul 2005 09:52:07 -0300 (BRT) Message-ID: <42D65FE4.2030801@tirloni.org> Date: Thu, 14 Jul 2005 09:51:48 -0300 From: "Giovanni P. Tirloni" User-Agent: Mozilla Thunderbird 1.0.2-1.4.1.centos4 (X11/20050323) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Alex Povolotsky References: <42D536EC.5030500@webmail.sub.ru> <9f9a8c4005071322311907b4b@mail.gmail.com> <42D60832.9090206@webmail.sub.ru> In-Reply-To: <42D60832.9090206@webmail.sub.ru> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-net@freebsd.org Subject: Re: GRE and PF problem X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Jul 2005 12:51:52 -0000 Alex Povolotsky wrote: > compunction wrote: > >> GRE needs to pass bidirectional. You will need a binat to make it >> work. I have not found a firewall that will allow GRE to work with a >> many to one nat. >> >> > > The most painful thing is that pf's nat works for GRE - SOMETIMES :-( > > The only thing firewall needs to implement for natting GRE is creation > of two rules (forward and back) for GRE packet, just like it does for ICMP. > > I'm not a firewall writer, but as far as I understand general procedural > programming, it cannot be THAT complicated. When a packet comes from 1.2.3.4 to your external interface you can't determine if it's destined to 192.168.0.1 or 192.168.0.2 if both initiated a GRE tunnel to 1.2.3.4. That's because GRE doesn't have ports like UDP or TCP to make (de)multiplexing possible, AFAIK. http://www.networksorcery.com/enp/protocol/gre.htm -- Giovanni P. Tirloni / gpt@tirloni.org / PGP: 0xD0315C26