ipsec packet filtering

[Mitch (bitblock)]

I don't know what the reasons are, but I know the result.

After much frustrating reasearch I came to the conclusion that I can:

a) use linux (not an option as far as I'm concerned)
b) use openvpn

I need to create a hub and spoke type of vpn arrangement - one spoke node
needs to communicate with another through a central router (I can't change
this, it's how the carrier network I need works!)

This is completly impossible in FreeBSD as far as I can see.

I don't know why though ;-)

Thanks.

m/

> -----Original Message-----
> From: owner-freebsd-net at freebsd.org
> [mailto:owner-freebsd-net at freebsd.org]On Behalf Of Nickolay A. Kritsky
> Sent: Thursday, July 29, 2004 8:59 PM
> To: freebsd-net at freebsd.org
> Subject: ipsec packet filtering
>
>
> Hello freebsd-net,
>
>   From searching the archives this looks like an old issue, but I
>   still can't understand something.
>   AFAIU, now the ipfw + ipsec interoperation looks like this:
>   input: encrypted packet comes to system. It is not checked against
>   ipfw rules. Rules are applied to decrypted payload packet.
>   output: packet is going to leave the system encrypted by ipsec. The
>   packet itself is not checked by firewall, but, after encryption, the
>   resulting ESP packet is run against ipfw rules.
>   I am sorry, but I still cannot understand the reasons for such
>   strange, ugly behaviour. Does anybody knows the reasons for that and
>   what chances are that we ever get fully-functional ipfw code
>   checking _every_ packet on the stack.
>
>   Thanks.
>
> --
> Best regards,
> ;  Nickolay A. Kritsky
> ; SysAdmin STAR Software LLC
> ; mailto:nkritsky at star-sw.com
>
>
> _______________________________________________
> freebsd-net at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe at freebsd.org"
>