Date: Thu, 21 Nov 2002 09:11:10 +0100 (CET) From: Helge Oldach <freebsd-stable-21nov02@oldach.net> To: guido@gvr.org (Guido van Rooij) Cc: archie@dellroad.org, dkelly@HiWAAY.net, sullrich@CRE8.COM, greg.panula@dolaninformation.com, FreeBSD-stable@FreeBSD.ORG Subject: Re: IPsec/gif VPN tunnel packets on wrong NIC in ipfw? SOLUTION AND QUESTIONS Message-ID: <200211210811.gAL8BALI080518@sep.oldach.net> In-Reply-To: <20021120124332.GD47298@gvr.gvr.org> from Guido van Rooij at "Nov 20, 2002 1:43:33 pm"
next in thread | previous in thread | raw e-mail | index | archive | help
Guido van Rooij: > Right now, if you use IPSec transport mode in combination with a > gif device, the incoming packets will pass through ipfw twice: > first, as encrypted ESP packets and 'in via fxp0', and again, as > decrypted whatever packets and 'in via gif0' > > In IPSec tunnel mode, the incoming packets will pass through ipfw twice: > both 'in via fxp0'. ACK. Note that this emulates behaviour of commercial IPSec implementations. For example, on Cisco IOS boxes the input access list (roughly a subset of ipfw) are checked twice - once for the original packet and once for the de-capsulated packet. This holds for tunnel mode as well as for transport mode. Helge To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200211210811.gAL8BALI080518>