From owner-freebsd-security@FreeBSD.ORG Thu Oct 23 10:57:31 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6451416A4B3 for ; Thu, 23 Oct 2003 10:57:31 -0700 (PDT) Received: from breeze.hq.office1.bg (hq.office1.nat.panda.bg [217.75.134.56]) by mx1.FreeBSD.org (Postfix) with SMTP id BEA4C43F3F for ; Thu, 23 Oct 2003 10:57:27 -0700 (PDT) (envelope-from mailinglists@hq.panda.bg) Received: (qmail 59710 invoked by uid 85); 23 Oct 2003 17:57:26 -0000 Received: from unknown (HELO nik.panda) (192.168.2.113) by breeze.hq.office1.bg with SMTP; 23 Oct 2003 17:57:25 -0000 Date: Thu, 23 Oct 2003 21:00:20 +0300 From: Nikolay Petrov X-Mailer: The Bat! (v2.00.6) CD5BF9353B3B7091 Organization: Office 1 Superstore - Bulgaria X-Priority: 3 (Normal) Message-ID: <182543033578.20031023210020@hq.panda.bg> To: freebsd-security@freebsd.org In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Virus-Scanned-breeze: by Nik's Monitoring Daemon (parser4: AMaViS perl-11i - 23 Sep 2003 9:56:33 EEST) X-Virus-Scanner-Info-breeze: Scan Engine v4.2.40, DAT files v4299 created Oct 22 2003 Subject: Re: IPSec VPNs: to gif or not to gif X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Nikolay Petrov List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Oct 2003 17:57:31 -0000 Hello Jim, Wednesday, October 22, 2003, 2:28:45 PM, you wrote: JH> I will shortly be replacing a couple of proprietary VPN boxes JH> with a FreeBSD solution. Section 10.10 of the Handbook has a JH> detailed description of how to do this. JH> However I remember a lot of discussion about a year ago about JH> whether the gif interface was necessary to set up VPNs like JH> this or whether it was just a convenience, for "getting the JH> routing right". A number of people said that gif was not JH> needed but I've never found a step-by-step description of how JH> to set up a lan-to-lan VPN without using it. I use gif interface and tunneling mode, but can see any advantage of this, because i can not see packets that pass through gif interface. I try different configuration of ip addresses to the interface, but nothing change. This i maybe a error in the configuration but i see encapsulated packets and packets that pass through IPSec tunnel on my network card. JH> Is the Handbook the current received wisdom on how to set this JH> up, and is the use of the gif interface indeed necessary? JH> I also remember that the discussions diverted into a problem JH> with ipfw when gif was *not* used, but I haven't found any JH> messages to indicate that it was resolved. I recall suggestions JH> that a new interface esp0 be created so that ipfw could work JH> correctly on both the innner and outer packets of an ESP tunnel. JH> Was that issue ever resolved? JH> jim hatfield JH> _______________________________________________ JH> freebsd-security@freebsd.org mailing list JH> http://lists.freebsd.org/mailman/listinfo/freebsd-security JH> To unsubscribe, send any mail to JH> "freebsd-security-unsubscribe@freebsd.org" -- Best regards, Nikolay mailinglists@hq.panda.bg