From owner-freebsd-security@FreeBSD.ORG Wed Oct 22 09:14:29 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 368C016A4B3 for ; Wed, 22 Oct 2003 09:14:29 -0700 (PDT) Received: from mail.secureworks.net (mail.secureworks.net [209.101.212.155]) by mx1.FreeBSD.org (Postfix) with SMTP id 234A343FA3 for ; Wed, 22 Oct 2003 09:14:26 -0700 (PDT) (envelope-from mdg@secureworks.net) Received: (qmail 43250 invoked from network); 22 Oct 2003 16:12:20 -0000 Received: from unknown (HELO HOST-192-168-10-225.internal.secureworks.net) (209.101.212.253) by mail.secureworks.net with SMTP; 22 Oct 2003 16:12:20 -0000 Date: Wed, 22 Oct 2003 12:14:24 -0400 (EDT) From: Matthew George X-X-Sender: mdg@localhost To: Jim Hatfield In-Reply-To: Message-ID: <20031022120340.R44441@localhost> References: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII cc: freebsd-security@freebsd.org Subject: Re: IPSec VPNs: to gif or not to gif X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Oct 2003 16:14:29 -0000 On Wed, 22 Oct 2003, Jim Hatfield wrote: > However I remember a lot of discussion about a year ago about > whether the gif interface was necessary to set up VPNs like > this or whether it was just a convenience, for "getting the > routing right". A number of people said that gif was not > needed but I've never found a step-by-step description of how > to set up a lan-to-lan VPN without using it. > > Is the Handbook the current received wisdom on how to set this > up, and is the use of the gif interface indeed necessary? I'm running fine without a gif interface ... (replaced IP addresses are the public IP's of the machines) spdadd 192.168.128.0/17[any] 192.168.0.0/17[any] any -P in ipsec esp/tunnel/a.b.c.d-w.x.y.z/require; spdadd 192.168.0.0/17[any] 192.168.128.0/17[any] any -P out ipsec esp/tunnel/w.x.y.z-a.b.c.d/require; (vice versa on the other host's setkey config) ... and then just standard remote and sainfo configs in racoon.conf > > I also remember that the discussions diverted into a problem > with ipfw when gif was *not* used, but I haven't found any > messages to indicate that it was resolved. I recall suggestions > that a new interface esp0 be created so that ipfw could work > correctly on both the innner and outer packets of an ESP tunnel. > > Was that issue ever resolved? > > jim hatfield > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" > > -- Matthew George SecureWorks Technical Operations