[Shorewall-users] Opportunistic encryption

Tom Eastep
Wed, 30 Oct 2002 17:23:52 -0000

Tom Eastep wrote:
>
>
> Homer Parker wrote:
>
>>
>>     eth1 is the external (PCMCIA wireless, takes a while to
>> initialize)...
>> 128.63.2.52 is  h-root.skitter.caida.org, a root server for DNS...
>> Opportunistic encryption is a tunnel on the fly.. If the other end
>> supports it, we have an encrypted link, if not, plain old TCP/IP
link...
>> So, anything can be the other end of the link, and all destination
points
>> are tried... Also, I could go nowhere while I had ipsec running... See
>> google find in next post for more info...
>>
>>
>
> Then the icmp packets you are seeing make no sense at all since
it''s
> highly unlikely that a root name server is pinging you. I''m afraid
I''m
> not going to be of any more help on this one.
>

You can of course simply take the brute force approach and add this to
your rules file:

ACCEPT	fw	net	icmp	0

Don''t know where that will lead though...

-Tom
--
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@shorewall.net