From owner-freebsd-stable Thu Nov 21 4:32:18 2002 Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5F66737B401 for ; Thu, 21 Nov 2002 04:32:17 -0800 (PST) Received: from sep.oldach.net (sep.oldach.net [194.180.25.6]) by mx1.FreeBSD.org (Postfix) with ESMTP id EC8C543E88 for ; Thu, 21 Nov 2002 04:32:15 -0800 (PST) (envelope-from hmo@sep.oldach.net) Received: from sep.oldach.net (localhost [127.0.0.1]) by sep.oldach.net (8.12.6/8.12.6/hmo29jun02) with ESMTP id gALCVQgm082160 (version=TLSv1/SSLv3 cipher=EDH-DSS-DES-CBC3-SHA bits=168 verify=NO); Thu, 21 Nov 2002 13:31:26 +0100 (CET) (envelope-from hmo@sep.oldach.net) Received: (from hmo@localhost) by sep.oldach.net (8.12.6/8.12.6/Submit) id gALCVP9e082159; Thu, 21 Nov 2002 13:31:25 +0100 (CET) (envelope-from hmo) Message-Id: <200211211231.gALCVP9e082159@sep.oldach.net> Subject: Re: IPsec/gif VPN tunnel packets on wrong NIC in ipfw? SOLUTION AND QUESTIONS In-Reply-To: <20021121090811.GB96801@gvr.gvr.org> from Guido van Rooij at "Nov 21, 2002 10: 8:11 am" To: guido@gvr.org (Guido van Rooij) Date: Thu, 21 Nov 2002 13:31:25 +0100 (CET) Cc: freebsd-stable-21nov02@oldach.net, hausen@punkt.de, archie@dellroad.org, dkelly@HiWAAY.net, sullrich@CRE8.COM, greg.panula@dolaninformation.com, FreeBSD-stable@FreeBSD.ORG From: Helge Oldach MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Guido van Rooij: > On Thu, Nov 21, 2002 at 09:37:04AM +0100, Helge Oldach wrote: > > The core problem is that we have a single routing table only, and hence > > we have a mix of internal and public routes. Consequently we will see > > both internal and external packets on interfaces. Therefore I don't see > > the need for an extra interface. I regard the gif set-up as confusion > > already, because this interface isn't used at all. > It is used. Why are the interface counters always zero? > It seems you think this is a routing issue, No, I don't think so. But having dual routing tables (one for the inside, and one for the outside) would be an approach to eliminate the problem. Helge To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message