Date: Mon, 4 Mar 2002 21:28:50 -0800 From: "Crist J. Clark" <cjc@FreeBSD.ORG> To: "Dalin S. Owen" <dowen@pstis.com> Cc: freebsd-security@FreeBSD.ORG Subject: Re: ESP + IPFW Message-ID: <20020304212850.M87533@blossom.cjclark.org> In-Reply-To: <20020305021845.510AE37B41C@hub.freebsd.org>; from dowen@pstis.com on Mon, Mar 04, 2002 at 06:15:16PM -0700 References: <20020305021845.510AE37B41C@hub.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Mar 04, 2002 at 06:15:16PM -0700, Dalin S. Owen wrote: > > I have IPsec running between two FreeBSD machines (over an 802.11b link), > they are manually keyed (not using an IKE daemon). First question, is it > more secure to use an IKE? I mean, doesn't it rotate keys, instead of just > using static ones? And if I use an IKE, can those generated keys be sniffed, > or are they encrypted with the last key? Don't worry. Keys don't go over the network in the clear. It would kind of break the whole system wouldn't it. > Now, another issue. I have the following rules on each machine with ipfw (I > am only going to show the relevant ones for simplicity): > > #nat box (I have a seperate interface for the 802.11 AP) > ipfw add 10 allow esp from any to any via dc1 > #this stops anyone from using my AP > ipfw add 20 deny ip from any to any via dc1 > > #workstation > ipfw add 10 allow esp from any to any > > Now, everything works fine. But I would like to be able to firewall the > packets *after* they are translated by IPSec (ESP) with IPFW? How would I > do that? They seem to only pass into IPFW once, not twice.. Can you run IPF > with IPFW to do it, and in that case which firewalling system gets matched > first? Yep. They go through ipfw(8) once. If you run ipf(8), they go through ipf(8) then ipfw(8)... once. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020304212850.M87533>