Date: Tue, 15 Jan 2002 13:18:21 +0100 From: Alex Le Heux <alexlh@funk.org> To: Ari Suutari <ari.suutari@syncrontech.com> Cc: Rene de Vries <rene@canyon.xs4all.nl>, Kshitij Gunjikar <kshitijgunjikar@yahoo.com>, net@FreeBSD.ORG Subject: Re: Filtering packets received through an ipsec tunnel Message-ID: <20020115121821.GU75815@funk.org> In-Reply-To: <200201150733.g0F7Xww91320@guinness.syncrontech.com> References: <E4E6F464-0917-11D6-AC08-00039357FA7A@canyon.xs4all.nl> <200201150733.g0F7Xww91320@guinness.syncrontech.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Jan 15, 2002 at 09:42:37AM +0200, Ari Suutari wrote: > Hi, > > On Monday 14 January 2002 19:55, Rene de Vries wrote: > > Kshitij, > > A good solution, from my point of view, would be, instead of passing > > evering thing from an ipsec tunnel, using ip-filter (&co, but without > > dummyet) on emerging packets. These packets should then have a different > > interface or a special flag for easy testing in ip-filter (&co). > > I don't know what the best solution would be, extending ip-filter with > > an extra flag or adding a special (dummy) interface. My gut feeling is a > > special flag makes more sense, but will break current ip-filter/ipfw > > syntax/configurations. > > [snip] > Maybe one could remove this, add 'ipsec' flag to ipfw > (which would use the above ipsec_gethist to match it) > so the syntax would be something like this: > > ipfw add pass tcp from a to b ipsec setup # matches only packets that came > via ipsec stack > ipfw add pass 50 from a to b # matches packets that didn't come via ipsec [snip] This looks like it would work for most situations. What one would not be able to do this way is prevent spoofing. In an ideal world I would also want to filter packets that come from the wrong tunnel. That would require the ipfw rules to somehow identify the tunnel. I'm not entirely sure if this could be accomplished without major pain though. Regards, Alex Le Heux -- "The difference between men and boys is the speed of their toys..." - Motul ad in Motor Magazine To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020115121821.GU75815>