Date: Thu, 10 Mar 2016 16:30:30 +1100 (EST) From: Ian Smith <smithi@nimnet.asn.au> To: elof2@sentor.se Cc: Jan Bramkamp <crest@rlwinm.de>, freebsd-net <freebsd-net@freebsd.org> Subject: Re: Source routing howto Message-ID: <20160310153215.V61428@sola.nimnet.asn.au> In-Reply-To: <alpine.BSF.2.00.1603091336380.3214@farmermaggot.shire.sentor.se> References: <alpine.BSF.2.00.1603091119130.3214@farmermaggot.shire.sentor.se> <56E00A06.20700@rlwinm.de> <alpine.BSF.2.00.1603091336380.3214@farmermaggot.shire.sentor.se>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 9 Mar 2016 14:40:16 +0100, elof2@sentor.se wrote: > On Wed, 9 Mar 2016, Jan Bramkamp wrote: [..] > > I would avoid policies based on IP addresses and prefer to define policies > > based on (pseudo-) interfaces e.g. route (and nat?) traffic from vlan123 > > through the VPN tunnel. > > The only two things I have to play with here is: > * ip range 10.10.10.x > or > * tun0 > > Using 'tun0' might not be possible if it has to exist when ipfw/pf load at > boot, 'cause tun0 is not created until the openvpn service has started. I can't speak to pf, but ipfw doesn't require an interface to preexist. I use mpd which creates interface ng0, well after firewall rules have been loaded. In antiquity I used ppp; I can't recall whether the same applied to tun0 similarly, and don't use vpns at all, but: root@x200:~ # kldload ipfw && ipfw add 65000 allow ip from any to any 65000 allow ip from any to any root@x200:~ # ipfw add 20000 count ip from any to any via nonexisting 20000 count ip from any to any via nonexisting root@x200:~ # ipfw -t show 20000 0 0 count ip from any to any via nonexisting 65000 71 6588 Thu Mar 10 16:20:02 2016 allow ip from any to any 65535 0 0 deny ip from any to any cheers, Ian
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20160310153215.V61428>