From owner-freebsd-stable  Thu Nov 21  0:12: 1 2002
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 78BF337B401
	for <FreeBSD-stable@FreeBSD.ORG>; Thu, 21 Nov 2002 00:12:00 -0800 (PST)
Received: from sep.oldach.net (sep.oldach.net [194.180.25.6])
	by mx1.FreeBSD.org (Postfix) with ESMTP id F0DED43E42
	for <FreeBSD-stable@FreeBSD.ORG>; Thu, 21 Nov 2002 00:11:58 -0800 (PST)
	(envelope-from hmo@sep.oldach.net)
Received: from sep.oldach.net (localhost [127.0.0.1])
	by sep.oldach.net (8.12.6/8.12.6/hmo29jun02) with ESMTP id gAL8BBgm080519
	(version=TLSv1/SSLv3 cipher=EDH-DSS-DES-CBC3-SHA bits=168 verify=NO);
	Thu, 21 Nov 2002 09:11:12 +0100 (CET)
	(envelope-from hmo@sep.oldach.net)
Received: (from hmo@localhost)
	by sep.oldach.net (8.12.6/8.12.6/Submit) id gAL8BALI080518;
	Thu, 21 Nov 2002 09:11:10 +0100 (CET)
	(envelope-from hmo)
Message-Id: <200211210811.gAL8BALI080518@sep.oldach.net>
Subject: Re: IPsec/gif VPN tunnel packets on wrong NIC in ipfw? SOLUTION AND QUESTIONS
In-Reply-To: <20021120124332.GD47298@gvr.gvr.org> from Guido van Rooij at "Nov 20, 2002  1:43:33 pm"
To: guido@gvr.org (Guido van Rooij)
Date: Thu, 21 Nov 2002 09:11:10 +0100 (CET)
Cc: archie@dellroad.org, dkelly@HiWAAY.net, sullrich@CRE8.COM,
	greg.panula@dolaninformation.com, FreeBSD-stable@FreeBSD.ORG
From: Helge Oldach <freebsd-stable-21nov02@oldach.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-stable@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-stable.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-stable>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-stable>
X-Loop: FreeBSD.ORG

Guido van Rooij:
> Right now, if you use IPSec transport mode in combination with a
> gif device, the incoming packets will pass through ipfw twice:
> first, as encrypted ESP packets and 'in via fxp0', and again, as
> decrypted whatever packets and 'in via gif0'
> 
> In IPSec tunnel mode, the incoming packets will pass through ipfw twice:
> both 'in via fxp0'.

ACK. Note that this emulates behaviour of commercial IPSec
implementations. For example, on Cisco IOS boxes the input access list
(roughly a subset of ipfw) are checked twice - once for the original
packet and once for the de-capsulated packet. This holds for tunnel mode
as well as for transport mode.

Helge

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message