From owner-freebsd-pf@freebsd.org  Tue May 30 16:22:20 2017
Return-Path: <owner-freebsd-pf@freebsd.org>
Delivered-To: freebsd-pf@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id C0415B87079
 for <freebsd-pf@mailman.ysv.freebsd.org>; Tue, 30 May 2017 16:22:20 +0000 (UTC)
 (envelope-from bzeeb-lists@lists.zabbadoz.net)
Received: from mx1.sbone.de (bird.sbone.de [46.4.1.90])
 (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits))
 (Client CN "mx1.sbone.de", Issuer "SBone.DE" (not verified))
 by mx1.freebsd.org (Postfix) with ESMTPS id 7E8CC6ABB5
 for <freebsd-pf@freebsd.org>; Tue, 30 May 2017 16:22:20 +0000 (UTC)
 (envelope-from bzeeb-lists@lists.zabbadoz.net)
Received: from mail.sbone.de (mail.sbone.de [IPv6:fde9:577b:c1a9:31::2013:587])
 (using TLSv1 with cipher ADH-CAMELLIA256-SHA (256/256 bits))
 (No client certificate requested)
 by mx1.sbone.de (Postfix) with ESMTPS id C33B325D3A0E;
 Tue, 30 May 2017 16:22:11 +0000 (UTC)
Received: from content-filter.sbone.de (content-filter.sbone.de
 [IPv6:fde9:577b:c1a9:31::2013:2742])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by mail.sbone.de (Postfix) with ESMTPS id F2148D1F80E;
 Tue, 30 May 2017 16:22:10 +0000 (UTC)
X-Virus-Scanned: amavisd-new at sbone.de
Received: from mail.sbone.de ([IPv6:fde9:577b:c1a9:31::2013:587])
 by content-filter.sbone.de (content-filter.sbone.de
 [fde9:577b:c1a9:31::2013:2742]) (amavisd-new, port 10024)
 with ESMTP id m8p8ePVSTPdJ; Tue, 30 May 2017 16:22:09 +0000 (UTC)
Received: from [10.248.105.171] (unknown [IPv6:fde9:577b:c1a9:f001::2])
 (using TLSv1 with cipher AES256-SHA (256/256 bits))
 (No client certificate requested)
 by mail.sbone.de (Postfix) with ESMTPSA id 1D788D1F7E3;
 Tue, 30 May 2017 16:22:07 +0000 (UTC)
From: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net>
To: "Kajetan Staszkiewicz" <vegeta@tuxpowered.net>
Cc: freebsd-pf@freebsd.org
Subject: Re: pf not checking traffic from tunnels
Date: Tue, 30 May 2017 16:22:05 +0000
Message-ID: <E08E37F7-F5E3-4079-8A1D-5126AADF1B8A@lists.zabbadoz.net>
In-Reply-To: <1853600.RL7SYQSJBX@energia>
References: <1853600.RL7SYQSJBX@energia>
MIME-Version: 1.0
Content-Type: text/plain; format=flowed
X-Mailer: MailMate (2.0BETAr6082)
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
 \(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf/>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 30 May 2017 16:22:20 -0000

On 30 May 2017, at 16:17, Kajetan Staszkiewicz wrote:

> Hello,
>
> I have a setup where FreeBSD-based routers serving datacenters are 
> connected
> via gif tunnels which are additionally encrypted using transport mode 
> IPsec.
> Each router runs pf and provides firewalling between multiple VLANs. 
> Tunnel
> interfaces were always trusted, though.
..

> Is there any option to check from userspace if the gif interface has 
> pf
> attached in netpfil hook for incoming traffic? Running tcpdump on gif
> interface correctly shows incoming icmp echo request.


What you want to read is
	man 4 enc
I think.

/bz