From owner-freebsd-net@freebsd.org Thu Mar 10 05:37:56 2016 Return-Path: Delivered-To: freebsd-net@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 71EA9ACA45F for ; Thu, 10 Mar 2016 05:37:56 +0000 (UTC) (envelope-from smithi@nimnet.asn.au) Received: from sola.nimnet.asn.au (paqi.nimnet.asn.au [115.70.110.159]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id E7DCCA56 for ; Thu, 10 Mar 2016 05:37:55 +0000 (UTC) (envelope-from smithi@nimnet.asn.au) Received: from localhost (localhost [127.0.0.1]) by sola.nimnet.asn.au (8.14.2/8.14.2) with ESMTP id u2A5UU4j041337; Thu, 10 Mar 2016 16:30:31 +1100 (EST) (envelope-from smithi@nimnet.asn.au) Date: Thu, 10 Mar 2016 16:30:30 +1100 (EST) From: Ian Smith To: elof2@sentor.se cc: Jan Bramkamp , freebsd-net Subject: Re: Source routing howto In-Reply-To: Message-ID: <20160310153215.V61428@sola.nimnet.asn.au> References: <56E00A06.20700@rlwinm.de> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 05:37:56 -0000 On Wed, 9 Mar 2016 14:40:16 +0100, elof2@sentor.se wrote: > On Wed, 9 Mar 2016, Jan Bramkamp wrote: [..] > > I would avoid policies based on IP addresses and prefer to define policies > > based on (pseudo-) interfaces e.g. route (and nat?) traffic from vlan123 > > through the VPN tunnel. > > The only two things I have to play with here is: > * ip range 10.10.10.x > or > * tun0 > > Using 'tun0' might not be possible if it has to exist when ipfw/pf load at > boot, 'cause tun0 is not created until the openvpn service has started. I can't speak to pf, but ipfw doesn't require an interface to preexist. I use mpd which creates interface ng0, well after firewall rules have been loaded. In antiquity I used ppp; I can't recall whether the same applied to tun0 similarly, and don't use vpns at all, but: root@x200:~ # kldload ipfw && ipfw add 65000 allow ip from any to any 65000 allow ip from any to any root@x200:~ # ipfw add 20000 count ip from any to any via nonexisting 20000 count ip from any to any via nonexisting root@x200:~ # ipfw -t show 20000 0 0 count ip from any to any via nonexisting 65000 71 6588 Thu Mar 10 16:20:02 2016 allow ip from any to any 65535 0 0 deny ip from any to any cheers, Ian