Date: Mon, 8 Dec 2008 21:02:00 +0000 (UTC) From: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net> To: Frank Behrens <frank@harz.behrens.de> Cc: freebsd-net@freebsd.org Subject: Re: Problem with new source address selection Message-ID: <20081208205426.V80401@maildrop.int.zabbadoz.net> In-Reply-To: <200812031220.mB3CK204015947@post.behrens.de> References: <200811280653.mAS6r1P3014050@post.behrens.de> <200812031220.mB3CK204015947@post.behrens.de>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 3 Dec 2008, Frank Behrens wrote: Hi, > As I mentioned earlier I believe the main problem is IPSEC itself, > where we don't have an interface for tunneled connections. So I made > a workaround with a dummy loopback device. So I have a question to > the network specialists: Is there no other solution? Am I the only > stupid man, who wants to tunnel a subnet with private address range > via IPSEC? No, you aren't. Let me try to explain a bit further why I don't think it's an IPsec problem (at least not in first place). Asume you'd not run IPsec but communicate with the people directly (with valid IPs). Instead of having policies to control the traffic you are using simple IP filters on each side. So now in your network topology, with your setup, with the destination not being on a directly connected network, what would source address selection pick as outgoing IP (obviously w/o the hack with the route to the loopback)? Would that IP match your policy and thus would the peer permit it in its firewall? >> When it comes to the source address selection I am tempted to answer >> with: I am willing to still allow this in 7 to not break production >> setups but I am inclined to not change HEAD and keep the behavior >> dropped there. See patch below, which basically is what you had with >> the version check and the if (ia == NULL) check to not blindly overwrite >> if we had found anything closer (untested). > > Thanks, I will try this. I am still discussing things, or rather have the question queued with someone but we are all a bit busy atm. Did you try the patch and did it work for you as expected? If so I'll add it to my repo and the next jail patch. /bz -- Bjoern A. Zeeb The greatest risk is not taking one.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20081208205426.V80401>