Displaying 5 results from an estimated 5 matches for "ipsec_filtergif".
2003 May 11
1
iHEADS UP: ipsec packet filtering change
On Sun, 23 Feb 2003 09:47:05 -0800, "Sam Leffler" <sam@errno.com> said:
>
>> Add a new config option IPSEC_FILTERGIF to control whether or not
>> packets coming out of a GIF tunnel are re-processed by ipfw,
>> et. al. By default they are not reprocessed. With the option they
>> are.
>
> This may affect your ipfw/ipf rules. If you are happy with the
> current behaviour then add IPSEC...
2003 Jun 07
1
Impossible to IPfilter this?
Hi!
I'm trying to increase security on my FreeBSD 4.8 firewall/DSL router/VPN
router.
My problem is with firewalling the VPN part. I'm using a tunnel to a
RedHat 7.1 box running FreeS/WAN. This tunnel allows traffic from my
internal net (172.17.0.0/24) to that box only:
spdadd 172.17.0.0/24 $REDHAT/32 any -P out ipsec esp/tunnel/$MYADDR-$REDHAT/unique;
spdadd $REDHAT/32 172.17.0.0/24
2003 May 15
2
FW: iHEADS UP: ipsec packet filtering change
> -----Original Message-----
> From: Greg Panula [mailto:greg.panula@dolaninformation.com]
> Sent: 12 May 2003 11:10
> To: Matthew Braithwaite
> Cc: stable@freebsd.org
> Subject: Re: iHEADS UP: ipsec packet filtering change
>
> You don't really need the gif tunnels for ipsec. Gif is more geared
> towards ipv4 <=> ipv6 type tunnels. A few of ipsec
2003 Oct 30
1
Using racoon-negotiated IPSec with ipfw and natd
[ -netters, please Cc me or security@ with replies. ]
I'm running into trouble integrating dynamic racoon-based IPSec into a network
with ipfw and natd. I need to be able to allow VPN access from any address
from authenticated clients. I've got the dynamic VPN working, with racoon
negotiating SAs and installing SPs, but the problem is that I can't tell
whether an incoming packet on
2003 Oct 22
9
IPSec VPNs: to gif or not to gif
I will shortly be replacing a couple of proprietary VPN boxes
with a FreeBSD solution. Section 10.10 of the Handbook has a
detailed description of how to do this.
However I remember a lot of discussion about a year ago about
whether the gif interface was necessary to set up VPNs like
this or whether it was just a convenience, for "getting the
routing right". A number of people said