IPSec, nat on enc device

[Ermal Luçi]

>
> OpenBSD's way of doing things seems interesting while reading very
> quickly your link, I'll have to take some more time to really see
> exactly what they are doing.....
>
>
Basically they make aware the daemon and the firewall of the nat.

Actually it is more 'user-friendly' to configure though clamsy since you have
to do keep the same information in two places, firewall nat rules and the ipsec
daemon.

You just tell instrument the daemon to inject one 'normal'(out) SA's
match traffic
coming from your local network and one SA for incoming traffic from
remote network
with the natted network address.

This all is because pf(4) cannot do 'incoming nat' by default.

-- 
Ermal