Skip site navigation (1)Skip section navigation (2) 
Date:      Tue, 13 Aug 2002 09:13:00 -0700
From:      Lars Eggert <larse@ISI.EDU>
To:        Les Biffle <les@safety.net>
Cc:        hackers@freebsd.org
Subject:   Re: IP routing question
Message-ID:  <3D59300C.8090906@isi.edu>
References:  <200208131434.g7DEY1205125@ns3.safety.net>
next in thread | previous in thread | raw e-mail | index | archive | help 

[-- Attachment #1 --]
Les Biffle wrote:
> 1.  Create "n" IPSEC VPN tunnels
> 2.  Create "n" VLAN pseudo interfaces
> 3.  Route IP Packets based on their arrival iface/tunnel out through
>     a corresponding tunnel/iface.
> 
> For example, I want to route all packets received through VPN tunnel "2"
> out through VLAN "2," and all packets received on VLAN "2" out through
> VPN "2," without regard to source or destination IP Addresses.
> 
> I don't want to examine the IP Addresses of any of the routed packets,
> but only want to make the routing decision based on arrival interface.
> 
> Does anyone have any ideas or suggestions?  Please?

IPsec tunnel mode won't work, since SAs aren't represented as Interfaces.

I'm not aware of any routing daemon that can use inbound interfaces as a 
parameter in its forwarding decision, otherwise using IPIP tunnels 
together with IPsec transport mode (draft-touch-ipsec-vpn-04.txt) might 
have worked with whatever daemon does that.

You could use the draft-touch-ipsec-vpn-04.txt together with ipfw rules, 
but then you say you don't want to look at IP addresses...

So no, I don't see how it can be done under your constraints.

Lars
-- 
Lars Eggert <larse@isi.edu>           USC Information Sciences Institute

[-- Attachment #2 --]
0	*H
010	+0	*H
00G0
	*H
010	UZA10UWestern Cape10U	Cape Town10
U
Thawte10UCertificate Services1(0&UPersonal Freemail RSA 2000.8.300
010824164000Z
020824164000Z0T10
UEggert1
0U*Lars10ULars Eggert10	*H
	
larse@isi.edu00
	*H
0|\Pw v~~FDooӦA\-	 Cˀ4.)&{肋,z(ܷر߈T7_'txGH^tt/ҹB8%t<#ֲNV0T0*+e!000L2uMyffBNUbNJJcdZ2s0U0
larse@isi.edu0U00
	*H
aJPMՒ]cѭC+kS+wZ1gY",YT41
j6:~℩D~Kؚ‡l=u(ՎM?cF7@}T00G0
	*H
010	UZA10UWestern Cape10U	Cape Town10
U
Thawte10UCertificate Services1(0&UPersonal Freemail RSA 2000.8.300
010824164000Z
020824164000Z0T10
UEggert1
0U*Lars10ULars Eggert10	*H
	
larse@isi.edu00
	*H
0|\Pw v~~FDooӦA\-	 Cˀ4.)&{肋,z(ܷر߈T7_'txGH^tt/ҹB8%t<#ֲNV0T0*+e!000L2uMyffBNUbNJJcdZ2s0U0
larse@isi.edu0U00
	*H
aJPMՒ]cѭC+kS+wZ1gY",YT41
j6:~℩D~Kؚ‡l=u(ՎM?cF7@}T080fErtcvE.0
	*H
010	UZA10UWestern Cape10U	Cape Town10U
Thawte Consulting1(0&UCertification Services Division1$0"UThawte Personal Freemail CA1+0)	*H
	personal-freemail@thawte.com0
000830000000Z
040827235959Z010	UZA10UWestern Cape10U	Cape Town10
U
Thawte10UCertificate Services1(0&UPersonal Freemail RSA 2000.8.3000
	*H
032c	%E>nx'gڈD)c5*mp<ܮto034qmOe
KaU5u'rװ|CBPQ<9TIf-	kiN0L0)U"0 010UPrivateLabel1-2970U00U0
	*H
1KG]qSl]y=&b""I'{9$
*8PUl
LGlX1B	li+@]jy.%݊
Z<D&iHΥbb100010	UZA10UWestern Cape10U	Cape Town10
U
Thawte10UCertificate Services1(0&UPersonal Freemail RSA 2000.8.30G0	+a0	*H
	1	*H
0	*H
	1
020813161300Z0#	*H
	1.">.Û0R	*H
	1E0C0
*H
0*H
0
*H
@0+0
*H
(0*H
	1010	UZA10UWestern Cape10U	Cape Town10
U
Thawte10UCertificate Services1(0&UPersonal Freemail RSA 2000.8.30G0
	*H
Js{St<bIZ,Owtx>riiWTQJ Ea3ڴf ҩ9ĝs^cQhPdC[.bpt<l	tӺ`Gw*Zw

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3D59300C.8090906>