From owner-freebsd-net Sun Dec 17 23:48:36 2000 From owner-freebsd-net@FreeBSD.ORG Sun Dec 17 23:48:31 2000 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from osku.suutari.iki.fi (osku.syncrontech.com [213.28.98.4]) by hub.freebsd.org (Postfix) with ESMTP id CBDB337B400; Sun, 17 Dec 2000 23:48:29 -0800 (PST) Received: from coffee (adsl-nat.syncrontech.com [213.28.98.3]) by osku.suutari.iki.fi (8.9.3/8.9.3) with SMTP id JAA05093; Mon, 18 Dec 2000 09:47:28 +0200 (EET) (envelope-from ari@suutari.iki.fi) Message-ID: <011801c068c6$c585d6b0$0e05a8c0@intranet.syncrontech.com> From: "Ari Suutari" To: "Cy Schubert - ITSD Open Systems Group" Cc: , References: <200012161125.eBGBPkP05378@cwsys.cwsent.com> Subject: Re: IPFW & IPsec tunnel mode Date: Mon, 18 Dec 2000 09:47:28 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4133.2400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Hi, I read them. But I think that the final solution cannot be 'well we will have a hole like this always since it cannot be fixed'. I wasn't saying that I want a network interface device like 'tun', I just wanted something similar that could be used with ipfw to more accurately specify filters. why couldn't we have something like: (imagine that a new option -n has been addded to setkey's spdadd) setkey -c << ZZZ spdadd xxx.xxx.xxx.xxx yyy.yyy.yyy.yyy any -n my-tunnel-1 -P in ipsec esp/tunnel/aaa-bbb/requre; ZZZ and then (imagine that new keyword via-ipsec-tunnel has been added to ipfw) ipfw pass ip from any to any via-ipsec-tunnel my-tunnel-1 I think that this would just be, well, GREAT! It would allow very easy creation of VPNs with simple rules and without any holes. Ari S. ----- Original Message ----- From: "Cy Schubert - ITSD Open Systems Group" To: "Ari Suutari" Cc: ; Sent: 16. joulukuuta 2000 13:24 Subject: Re: IPFW & IPsec tunnel mode > In message <001301c0601e$34cab880$0e05a8c0@intranet.syncrontech.com>, > "Ari Suut > ari" writes: > > However, pipsecd only supports fixed keys and Kame seems more > > like the future way to go. Would it be possible to enhance ipfw & kame > > to work together better in same way (like having some kind of name for > > each tunnel and allowing ipfw rule to use them in similar way as > > 'via' is used with interfaces) ? > > Check the -security archives. This was just discussed about a month > ago. In that thread a KAME developer explained why it cannot be > accomplished. > > > Regards, Phone: (250)387-8437 > Cy Schubert Fax: (250)387-5766 > Team Leader, Sun/Alpha Team Internet: Cy.Schubert@osg.gov.bc.ca > Open Systems Group, ITSD, ISTA > Province of BC > > > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message