Date: Mon, 2 Aug 2004 09:14:46 +1000 From: "Peter Sandilands" <peter@sandilands.vu> To: "Mitch (bitblock)" <mitch@bitblock.com>, <freebsd-net@freebsd.org> Subject: RE: ipsec packet filtering Message-ID: <IOEHIPOKAPPDDMNJNKKGIEANCGAA.peter@sandilands.vu> In-Reply-To: <OCEGLFACMGOKINMEOKANGEEDDHAA.mitch@bitblock.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> -----Original Message----- > From: Mitch (bitblock) [mailto:mitch@bitblock.com] > Sent: Saturday, July 31, 2004 3:35 AM > To: peter@sandilands.vu; freebsd-net@freebsd.org > Subject: RE: ipsec packet filtering > > But by adding the following option to the kernel conf > >file you can get the processing path I think you are asking for?? > > > > options IPSEC_FILTERGIF (documented in LINT) > > > > This then causes the decrypted packet to be passed thru > >IPFW again.Be aware this has significant consequences for where you > >do NAT in the ruleset and requires very careful crafting of the IPFW rules > > Pete > ok. > Will this allow me to do the following: > > Client 1 <--\ > FREEBSD ROUTER <----> Internet > Client 2 <--/ > > Client 1, although on the same subnet as client 2, can not > directly connect to Client 2. This is an underlying restriction of the ATM > transport of the telco we deal with. No option. > > I want to connect client 1, and client 2. I can create a > VPN from client 1 to central router, and client 2 to central router. In the > past, I could not route this traffic. Are you saying this should be possible now? Taken me a while to think thru your Q. If the vpns have separate SAs and you use unique instead of require in the policy entry I think the answer is yes. That is assuming both vpns go out the one interface? You need that so the IPSEC code sees each VPN as different even tho' they use the one physical i/f However there may be an underlying packet routing issue here. I think you would need static routes defined for each client with the interface as the target rather than the IP eg: route add 192.168.1.0/24 -interface rl1 regards Pete
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?IOEHIPOKAPPDDMNJNKKGIEANCGAA.peter>