From owner-freebsd-net@FreeBSD.ORG Fri Jul 30 08:15:09 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id CCCFC16A4CE for ; Fri, 30 Jul 2004 08:15:09 +0000 (GMT) Received: from transport.cksoft.de (transport.cksoft.de [62.111.66.27]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3EC5B43D2D for ; Fri, 30 Jul 2004 08:15:09 +0000 (GMT) (envelope-from bzeeb-lists@lists.zabbadoz.net) Received: from transport.cksoft.de (localhost [127.0.0.1]) by transport.cksoft.de (Postfix) with ESMTP id 5D8991FFDD4; Fri, 30 Jul 2004 10:15:07 +0200 (CEST) Received: by transport.cksoft.de (Postfix, from userid 66) id 7CF2D1FF931; Fri, 30 Jul 2004 10:15:05 +0200 (CEST) Received: by mail.int.zabbadoz.net (Postfix, from userid 1060) id 585741539E; Fri, 30 Jul 2004 08:12:51 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.int.zabbadoz.net (Postfix) with ESMTP id 4D9BF15384; Fri, 30 Jul 2004 08:12:52 +0000 (UTC) Date: Fri, 30 Jul 2004 08:12:52 +0000 (UTC) From: "Bjoern A. Zeeb" X-X-Sender: bz@e0-0.zab2.int.zabbadoz.net To: "Nickolay A. Kritsky" In-Reply-To: <11116772218.20040730115500@star-sw.com> Message-ID: References: <652582171.20040730075831@star-sw.com> <11116772218.20040730115500@star-sw.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Virus-Scanned: by AMaViS cksoft-s20020300-20031204bz on transport.cksoft.de cc: freebsd-net@freebsd.org Subject: Re[3]: ipsec packet filtering X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Jul 2004 08:15:09 -0000 On Fri, 30 Jul 2004, Nickolay A. Kritsky wrote: Hi, > I think I have got your point here, but filtering esp in tunnel mode > is of no use in many scenarios since higher protocol information (like > ports for TCP/UDP) is hidden in encrypted payload. at first it helps you to accept (only) encrypted traffic from your peers. > Correct me if I am wrong but diverting incoming packets wont help. > Libalias will just pass them unNATed. Or has it been changed since > 4.9? Let's see. ... > see? if the incoming packet is not in table, _and_ natd is not running > in proxy_only mode (which is not acceptable here) the packet flows by > without any change. And that's what the `man natd' says. please type man natd /reverse n this should be available in 4.9 too. > BAZ> The ruleset gets quite tricky then but it works here (HEAD from about > BAZ> 82 days ago according to uptime ;-) > > ? Do you mean you have the same scenario? And diverting on inside > interface works for you? yes of course and a lot more on my three inside and two outside interfaces. -- Bjoern A. Zeeb bzeeb at Zabbadoz dot NeT