From owner-freebsd-stable  Wed Nov 20  4:43:37 2002
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 8D77B37B406
	for <FreeBSD-stable@FreeBSD.ORG>; Wed, 20 Nov 2002 04:43:36 -0800 (PST)
Received: from gvr.gvr.org (gvr.gvr.org [212.61.40.17])
	by mx1.FreeBSD.org (Postfix) with ESMTP id B124543E8A
	for <FreeBSD-stable@FreeBSD.ORG>; Wed, 20 Nov 2002 04:43:34 -0800 (PST)
	(envelope-from guido@gvr.org)
Received: by gvr.gvr.org (Postfix, from userid 657)
	id 262952A4; Wed, 20 Nov 2002 13:43:33 +0100 (CET)
Date: Wed, 20 Nov 2002 13:43:33 +0100
From: Guido van Rooij <guido@gvr.org>
To: Archie Cobbs <archie@dellroad.org>
Cc: David Kelly <dkelly@HiWAAY.net>,
	Scott Ullrich <sullrich@CRE8.COM>,
	"'greg.panula@dolaninformation.com'" <greg.panula@dolaninformation.com>,
	FreeBSD-stable@FreeBSD.ORG
Subject: Re: IPsec/gif VPN tunnel packets on wrong NIC in ipfw? SOLUTION AND QUESTIONS
Message-ID: <20021120124332.GD47298@gvr.gvr.org>
References: <20021119194150.GA43806@gvr.gvr.org> <200211200348.gAK3mhtT058983@arch20m.dellroad.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <200211200348.gAK3mhtT058983@arch20m.dellroad.org>
Sender: owner-freebsd-stable@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-stable.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-stable>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-stable>
X-Loop: FreeBSD.ORG

On Tue, Nov 19, 2002 at 07:48:43PM -0800, Archie Cobbs wrote:
> Guido van Rooij wrote:
> > The problem here is that there is a de-tunneled packet that has no
> > new interface associated. What a mess :-(
> 
> I'm confused. So, let me try to summarize things:
> 
>   Right now, if you use IPSec tunnel mode with a 'gif' interface, and
>   suppose your Ethernet driver is fxp0, then incoming packets will
>   pass through ipfw twice: first, as encrypted ESP packets and 'in
>   via fxp0', and again, as decrypted whatever packets and 'in via
>   gif0'.
> 
> Is that correct??

No.

Right now, if you use IPSec transport mode in combination with a
gif device, the incoming packets will pass through ipfw twice:
first, as encrypted ESP packets and 'in via fxp0', and again, as
decrypted whatever packets and 'in via gif0'

In IPSec tunnel mode, the incoming packets will pass through ipfw twice:
both 'in via fxp0'.

-Guido

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message