Date: Mon, 14 Jan 2002 09:12:16 -0800 From: Lars Eggert <larse@ISI.EDU> To: Blaz Zupan <blaz@si.FreeBSD.org> Cc: "Louis A. Mamakos" <louie@TransSys.COM>, freebsd-net@FreeBSD.ORG Subject: Re: Filtering packets received through an ipsec tunnel Message-ID: <3C431170.5080506@isi.edu> References: <20020114173900.I2807-100000@titanic.medinet.si>
next in thread | previous in thread | raw e-mail | index | archive | help
Blaz Zupan wrote: >>And before you suggest that the gif tunnels seen in all those IPSEC >>examples actually have anything to do with IPSEC tunnels, please try >>it and look again. It's completely uninvolved other than introducing >>a route as a side-effect. >> > > I'm not sure what you mean here, but shouldn't the following work: we create a > gif tunnel between the two endpoints and just encrypt the gif traffic itself. > Then we can filter the packets that go in and out of the gif interface. He was referring to using gif tunnels together with IPsec tunnel mode SAs (are you?) This "works" but precisely because of the side effect that Louis mentioned. A clean solution would user *either* IPIP tunnels (i.e. gif devices) and IPsec transport mode *or* IPsec tunnel mode (and no gifs). See the KAME IMPLEMENTATION file for details, or draft-touch-ipsec-vpn-02.txt (shameless plug :-). Lars -- Lars Eggert <larse@isi.edu> Information Sciences Institute http://www.isi.edu/larse/ University of Southern California To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3C431170.5080506>