From owner-freebsd-stable Tue Nov 19 20:33:45 2002 Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 054EE37B401 for ; Tue, 19 Nov 2002 20:33:44 -0800 (PST) Received: from exchange.corp.cre8.com (ns.cre8.com [216.135.81.2]) by mx1.FreeBSD.org (Postfix) with ESMTP id 517D643E88 for ; Tue, 19 Nov 2002 20:33:43 -0800 (PST) (envelope-from sullrich@CRE8.COM) Received: by exchange.corp.cre8.com with Internet Mail Service (5.5.2653.19) id <4G1JKW8K>; Tue, 19 Nov 2002 23:41:52 -0500 Message-ID: <2F6DCE1EFAB3BC418B5C324F13934C9601D23C76@exchange.corp.cre8.com> From: Scott Ullrich To: 'Archie Cobbs' , Guido van Rooij Cc: David Kelly , Scott Ullrich , "'greg.panula@dolaninformation.com'" , FreeBSD-stable@FreeBSD.ORG Subject: RE: IPsec/gif VPN tunnel packets on wrong NIC in ipfw? SOLUTION A ND QUESTIONS Date: Tue, 19 Nov 2002 23:41:49 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG I thought it was going to work after Guido pointed out that I was using tunnel mode vs. transport. I changed it over to transport and could not get it to work under any conditions. I tried gif rules, internal network rules before and after the divert and many other methods including using a allow all from any to any ruleset and could not get this to work so I am reverting back. I am honestly lost at this point and need to do the tcpdumps that david has done to see what is going wrong. -Scott -----Original Message----- From: Archie Cobbs [mailto:archie@dellroad.org] Sent: Tuesday, November 19, 2002 10:49 PM To: Guido van Rooij Cc: Archie Cobbs; David Kelly; Scott Ullrich; 'greg.panula@dolaninformation.com'; FreeBSD-stable@FreeBSD.ORG Subject: Re: IPsec/gif VPN tunnel packets on wrong NIC in ipfw? SOLUTION AND QUESTIONS Guido van Rooij wrote: > The problem here is that there is a de-tunneled packet that has no new > interface associated. What a mess :-( I'm confused. So, let me try to summarize things: Right now, if you use IPSec tunnel mode with a 'gif' interface, and suppose your Ethernet driver is fxp0, then incoming packets will pass through ipfw twice: first, as encrypted ESP packets and 'in via fxp0', and again, as decrypted whatever packets and 'in via gif0'. Is that correct?? Guido seems to think so... but Scott Ullrich wrote: > Guido, I have the exact scenario that you are recommending. I created > the gif devices just as you suggested and the whole nine yards. So Scott seems to be saying that it is NOT correct. Scott: can you please confirm/deny? ---------- Secondly, is the question of what to do about IPSec tunnel mode. I vote for creating a new pseudo-interface 'ipsec0'. This interface will automatically get created and attached the first time a tunnel mode IPSec packet is de-encapsulated and put back on ipintrq. -Archie __________________________________________________________________________ Archie Cobbs * Packet Design * http://www.packetdesign.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message