From owner-freebsd-stable Tue Nov 19 20: 0:56 2002 Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DED6437B401 for ; Tue, 19 Nov 2002 20:00:54 -0800 (PST) Received: from InterJet.dellroad.org (adsl-63-194-81-26.dsl.snfc21.pacbell.net [63.194.81.26]) by mx1.FreeBSD.org (Postfix) with ESMTP id 091E443E42 for ; Tue, 19 Nov 2002 20:00:54 -0800 (PST) (envelope-from archie@dellroad.org) Received: from arch20m.dellroad.org (arch20m.dellroad.org [10.1.1.20]) by InterJet.dellroad.org (8.9.1a/8.9.1) with ESMTP id TAA70106; Tue, 19 Nov 2002 19:48:43 -0800 (PST) Received: from arch20m.dellroad.org (localhost [127.0.0.1]) by arch20m.dellroad.org (8.12.6/8.12.6) with ESMTP id gAK3mhOS058984; Tue, 19 Nov 2002 19:48:43 -0800 (PST) (envelope-from archie@arch20m.dellroad.org) Received: (from archie@localhost) by arch20m.dellroad.org (8.12.6/8.12.6/Submit) id gAK3mhtT058983; Tue, 19 Nov 2002 19:48:43 -0800 (PST) From: Archie Cobbs Message-Id: <200211200348.gAK3mhtT058983@arch20m.dellroad.org> Subject: Re: IPsec/gif VPN tunnel packets on wrong NIC in ipfw? SOLUTION AND QUESTIONS In-Reply-To: <20021119194150.GA43806@gvr.gvr.org> To: Guido van Rooij Date: Tue, 19 Nov 2002 19:48:43 -0800 (PST) Cc: Archie Cobbs , David Kelly , Scott Ullrich , "'greg.panula@dolaninformation.com'" , FreeBSD-stable@FreeBSD.ORG X-Mailer: ELM [version 2.4ME+ PL99b (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Guido van Rooij wrote: > The problem here is that there is a de-tunneled packet that has no > new interface associated. What a mess :-( I'm confused. So, let me try to summarize things: Right now, if you use IPSec tunnel mode with a 'gif' interface, and suppose your Ethernet driver is fxp0, then incoming packets will pass through ipfw twice: first, as encrypted ESP packets and 'in via fxp0', and again, as decrypted whatever packets and 'in via gif0'. Is that correct?? Guido seems to think so... but Scott Ullrich wrote: > Guido, I have the exact scenario that you are recommending. I created the > gif devices just as you suggested and the whole nine yards. So Scott seems to be saying that it is NOT correct. Scott: can you please confirm/deny? ---------- Secondly, is the question of what to do about IPSec tunnel mode. I vote for creating a new pseudo-interface 'ipsec0'. This interface will automatically get created and attached the first time a tunnel mode IPSec packet is de-encapsulated and put back on ipintrq. -Archie __________________________________________________________________________ Archie Cobbs * Packet Design * http://www.packetdesign.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message