From owner-freebsd-net@FreeBSD.ORG  Fri Jul 30 08:47:23 2004
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 0201816A4CF
	for <freebsd-net@freebsd.org>; Fri, 30 Jul 2004 08:47:23 +0000 (GMT)
Received: from mail.star-sw.com (mail.star-sw.com [217.195.82.1])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 1FF8643D48
	for <freebsd-net@freebsd.org>; Fri, 30 Jul 2004 08:47:22 +0000 (GMT)
	(envelope-from nkritsky@star-sw.com)
Received: from ARGON.star-sw.com (argon.star-sw.com [217.195.82.10])
	by mail.star-sw.com (8.12.11/8.12.11) with ESMTP id i6U8lLls021020;
	Fri, 30 Jul 2004 12:47:21 +0400 (MSD)
Received: from ibmka.star-sw.com ([192.168.32.130]) by ARGON.star-sw.com with
	Microsoft SMTPSVC(5.0.2195.5329);	 Fri, 30 Jul 2004 12:47:21 +0400
Date: Fri, 30 Jul 2004 12:47:20 +0400
From: "Nickolay A. Kritsky" <nkritsky@star-sw.com>
X-Mailer: The Bat! (v1.49) Personal
X-Priority: 3 (Normal)
Message-ID: <11319912718.20040730124720@star-sw.com>
To: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net>
In-reply-To: <Pine.BSF.4.53.0407300803100.41939@e0-0.zab2.int.zabbadoz.net>
References: <652582171.20040730075831@star-sw.com>
 <Pine.BSF.4.53.0407300457460.41939@e0-0.zab2.int.zabbadoz.net>
 <12410155296.20040730100443@star-sw.com>
 <Pine.BSF.4.53.0407300640090.41939@e0-0.zab2.int.zabbadoz.net>
 <11116772218.20040730115500@star-sw.com>
 <Pine.BSF.4.53.0407300803100.41939@e0-0.zab2.int.zabbadoz.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-OriginalArrivalTime: 30 Jul 2004 08:47:21.0005 (UTC)
	FILETIME=[D39D75D0:01C47611]
cc: freebsd-net@freebsd.org
Subject: Re[4]: ipsec packet filtering
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: "Nickolay A. Kritsky" <nkritsky@star-sw.com>
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 30 Jul 2004 08:47:23 -0000

Hello Bjoern,

Friday, July 30, 2004, 12:12:52 PM, Bjoern A. Zeeb wrote:

>> see? if the incoming packet is not in table, _and_ natd is not running
>> in proxy_only mode (which is not acceptable here) the packet flows by
>> without any change. And that's what the `man natd' says.

BAZ> please type

BAZ> man natd
BAZ> /reverse
BAZ> n

BAZ> this should be available in 4.9 too.

It's there. Oh my god! RTFM forever.
Well, thanks a lot, and sorry for time/traffic consumption.
<nooffencemeant>
I still don't like current situation with the way ipsec is processed
by ipfw,
</nooffencemeant>
but -reverse will help me for now.

-- 
Best regards,
;  Nickolay A. Kritsky
; SysAdmin STAR Software LLC
; mailto:nkritsky@star-sw.com