From owner-freebsd-net@FreeBSD.ORG Fri Jul 30 03:58:43 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EDA1116A4CE for ; Fri, 30 Jul 2004 03:58:43 +0000 (GMT) Received: from mail.star-sw.com (mail.star-sw.com [217.195.82.1]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3CCE443D41 for ; Fri, 30 Jul 2004 03:58:43 +0000 (GMT) (envelope-from nkritsky@star-sw.com) Received: from ARGON.star-sw.com (argon.star-sw.com [217.195.82.10]) by mail.star-sw.com (8.12.11/8.12.11) with ESMTP id i6U3wUjk045367 for ; Fri, 30 Jul 2004 07:58:30 +0400 (MSD) Received: from ibmka.star-sw.com ([192.168.32.130]) by ARGON.star-sw.com with Microsoft SMTPSVC(5.0.2195.5329); Fri, 30 Jul 2004 07:58:30 +0400 Date: Fri, 30 Jul 2004 07:58:31 +0400 From: "Nickolay A. Kritsky" X-Mailer: The Bat! (v1.49) Personal X-Priority: 3 (Normal) Message-ID: <652582171.20040730075831@star-sw.com> To: freebsd-net@freebsd.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 30 Jul 2004 03:58:30.0832 (UTC) FILETIME=[7A06EB00:01C475E9] Subject: ipsec packet filtering X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: "Nickolay A. Kritsky" List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Jul 2004 03:58:44 -0000 Hello freebsd-net, From searching the archives this looks like an old issue, but I still can't understand something. AFAIU, now the ipfw + ipsec interoperation looks like this: input: encrypted packet comes to system. It is not checked against ipfw rules. Rules are applied to decrypted payload packet. output: packet is going to leave the system encrypted by ipsec. The packet itself is not checked by firewall, but, after encryption, the resulting ESP packet is run against ipfw rules. I am sorry, but I still cannot understand the reasons for such strange, ugly behaviour. Does anybody knows the reasons for that and what chances are that we ever get fully-functional ipfw code checking _every_ packet on the stack. Thanks. -- Best regards, ; Nickolay A. Kritsky ; SysAdmin STAR Software LLC ; mailto:nkritsky@star-sw.com