From owner-freebsd-security@FreeBSD.ORG Wed Oct 22 13:30:01 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 68CFD16A4C0 for ; Wed, 22 Oct 2003 13:30:01 -0700 (PDT) Received: from dmz2.unixjunkie.com (adsl-65-70-175-250.dsl.rcsntx.swbell.net [65.70.175.250]) by mx1.FreeBSD.org (Postfix) with ESMTP id E017C43FDF for ; Wed, 22 Oct 2003 13:29:55 -0700 (PDT) (envelope-from strgout@unixjunkie.com) Received: from mail.unixjunkie.com (mail [10.253.254.36]) by dmz2.unixjunkie.com (8.12.8p2/8.12.8) with ESMTP id h9MKrrk7060589 for ; Wed, 22 Oct 2003 15:53:53 -0500 (CDT) (envelope-from strgout@mail.unixjunkie.com) Received: from mail.unixjunkie.com (mail [10.253.254.36]) by mail.unixjunkie.com (8.12.8p2/8.12.8) with ESMTP id h9MKrrlf060586 for ; Wed, 22 Oct 2003 15:53:53 -0500 (CDT) (envelope-from strgout@mail.unixjunkie.com) Received: (from strgout@localhost) by mail.unixjunkie.com (8.12.8p2/8.12.8/Submit) id h9MKrrxn060585 for freebsd-security@freebsd.org; Wed, 22 Oct 2003 15:53:53 -0500 (CDT) (envelope-from strgout) Date: Wed, 22 Oct 2003 15:53:52 -0500 From: John To: freebsd-security@freebsd.org Message-ID: <20031022205352.GA60569@mail.unixjunkie.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4i Subject: Re: IPSec VPNs: to gif or not to gif X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Oct 2003 20:30:01 -0000 On Wed, Oct 22, 2003 at 12:28:45PM +0100, Jim Hatfield wrote: > I will shortly be replacing a couple of proprietary VPN boxes > with a FreeBSD solution. Section 10.10 of the Handbook has a > detailed description of how to do this. > > However I remember a lot of discussion about a year ago about > whether the gif interface was necessary to set up VPNs like > this or whether it was just a convenience, for "getting the > routing right". A number of people said that gif was not > needed but I've never found a step-by-step description of how > to set up a lan-to-lan VPN without using it. > > Is the Handbook the current received wisdom on how to set this > up, and is the use of the gif interface indeed necessary? > > I also remember that the discussions diverted into a problem > with ipfw when gif was *not* used, but I haven't found any > messages to indicate that it was resolved. I recall suggestions > that a new interface esp0 be created so that ipfw could work > correctly on both the innner and outer packets of an ESP tunnel. > > Was that issue ever resolved? > > jim hatfield > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" I think one reason someone might want to use gif interfaces is becuase trasport mode ipsec doesn't require the peer address, if you then do a gif tunnel over the transport ipsec you have dynamic vpn based on a 509 cert or some crazy jazz like that. I however just do tunnel mode ipsec with no gif tunnel and packet filter to only allow protocol 50 and udp 500 to/from the remote peer. If any of the kame folks are watching, thanks for writing racoon!