Date: Mon, 14 Jan 2002 19:05:52 +0100 From: Rene de Vries <rene@canyon.xs4all.nl> To: net@freebsd.org Cc: Lars Eggert <larse@ISI.EDU> Subject: Re: Filtering packets received through an ipsec tunnel Message-ID: <58FB1C50-0919-11D6-AC08-00039357FA7A@canyon.xs4all.nl> In-Reply-To: <3C431170.5080506@isi.edu>
next in thread | previous in thread | raw e-mail | index | archive | help
Gif tunnels are not the samething as ipsec tunnels. For one some ipsec implementations simply won't work with gif tunnels. Furthermore the administrative overhead when there are more than a few tunnels is enormous. It is much simpler to have racoon do some (a lot) of the work for you. Say, for example, you have about 200(1) tunnel partners, of which only about 30 are connected at the same time. This would mean 200 extra interfaces, a totally unmanagable situation. Whereas the ip-filter rules could be very simple/generic for all of them. The only configuration issue you will have to face is generating the SPDs and filling racoon with the correct keys. But this can't be helped. 1) These number are an example, not reallife... On Monday, January 14, 2002, at 06:12 , Lars Eggert wrote: > Blaz Zupan wrote: > >>> And before you suggest that the gif tunnels seen in all those IPSEC >>> examples actually have anything to do with IPSEC tunnels, please try >>> it and look again. It's completely uninvolved other than introducing >>> a route as a side-effect. >>> >> I'm not sure what you mean here, but shouldn't the following work: we >> create a gif tunnel between the two endpoints and just encrypt the gif >> traffic itself. >> Then we can filter the packets that go in and out of the gif interface. > > He was referring to using gif tunnels together with IPsec tunnel mode > SAs (are you?) This "works" but precisely because of the side effect > that Louis mentioned. A clean solution would user *either* IPIP tunnels > (i.e. gif devices) and IPsec transport mode *or* IPsec tunnel mode (and > no gifs). See the KAME IMPLEMENTATION file for details, or > draft-touch-ipsec-vpn-02.txt (shameless plug :-). -- Rene de Vries <rene@tunix.nl> To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?58FB1C50-0919-11D6-AC08-00039357FA7A>