Date: Sat, 10 Mar 2007 20:23:47 +0100 From: Jeremie Le Hen <jeremie@le-hen.org> To: VANHULLEBUS Yvan <vanhu_bsd@zeninc.net> Cc: freebsd-security@freebsd.org Subject: Re: IPSec tunnel interfaces (was: freebsd vpn server behind nat dsl router) Message-ID: <20070310192347.GC2887@obiwan.tataz.chchile.org> In-Reply-To: <20070307170617.GA2799@zen.inc> References: <Pine.LNX.4.64.0703061251310.15938@wnk.hamline.edu> <20070307170617.GA2799@zen.inc>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi Yvan, On Wed, Mar 07, 2007 at 06:06:17PM +0100, VANHULLEBUS Yvan wrote: > - FreeBSD handbook talks about Gif interfaces for IPSec tunnels. Just > forget that part and use directly IPSec tunnels without Gif > interfaces. While I understand why using gif(4) to create IPSec tunnels is not recommended because of interoperability, administratively it is pretty useful to see the tunnel as an interface. Everything that comes along such as routes, firewall rules et al work very naturally. I'm no IPSec expert as you probably are and I seem to recall the RFC advises (requires ?) it to be implemented as a bump in a stack. However, is it reasonable to expect to see this in the future ? It seems the enc(4) interface provides this feature somehow but only for FAST_IPSEC. What is the doom of IPSEC ? Are they to be merged in the future, or is it possible to make the enc(4) work with IPSEC as well ? Thank you. Regards, -- Jeremie Le Hen < jeremie at le-hen dot org >< ttz at chchile dot org >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20070310192347.GC2887>