Date: Wed, 20 Nov 2002 13:43:33 +0100 From: Guido van Rooij <guido@gvr.org> To: Archie Cobbs <archie@dellroad.org> Cc: David Kelly <dkelly@HiWAAY.net>, Scott Ullrich <sullrich@CRE8.COM>, "'greg.panula@dolaninformation.com'" <greg.panula@dolaninformation.com>, FreeBSD-stable@FreeBSD.ORG Subject: Re: IPsec/gif VPN tunnel packets on wrong NIC in ipfw? SOLUTION AND QUESTIONS Message-ID: <20021120124332.GD47298@gvr.gvr.org> In-Reply-To: <200211200348.gAK3mhtT058983@arch20m.dellroad.org> References: <20021119194150.GA43806@gvr.gvr.org> <200211200348.gAK3mhtT058983@arch20m.dellroad.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Nov 19, 2002 at 07:48:43PM -0800, Archie Cobbs wrote: > Guido van Rooij wrote: > > The problem here is that there is a de-tunneled packet that has no > > new interface associated. What a mess :-( > > I'm confused. So, let me try to summarize things: > > Right now, if you use IPSec tunnel mode with a 'gif' interface, and > suppose your Ethernet driver is fxp0, then incoming packets will > pass through ipfw twice: first, as encrypted ESP packets and 'in > via fxp0', and again, as decrypted whatever packets and 'in via > gif0'. > > Is that correct?? No. Right now, if you use IPSec transport mode in combination with a gif device, the incoming packets will pass through ipfw twice: first, as encrypted ESP packets and 'in via fxp0', and again, as decrypted whatever packets and 'in via gif0' In IPSec tunnel mode, the incoming packets will pass through ipfw twice: both 'in via fxp0'. -Guido To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20021120124332.GD47298>