Shorewall users - Dec 2006 - ipsec using 2.6 kernel.

My current firewalls are  using the 2.6 kernel ipsec based on Debian Sarge.

Tried to switch to transport mode and run gre tunnels.
Got transport mode working but I do not like it.

Thinking it may be best to start over.

Was looking at
http://shorewall.net/IPSEC-2.6.html

Wondering if the the kernel and iptables still need patching in Debian etch?
Looks like there is policy routing in both but have not actually tested.
In etch currently have
iptables             1.3.6.0debian1-5
kernel is            2.6.18-7

The other thing is its not clear to me can shorewall set up tunnels or
ipsec?
Currently I start my ipsec tunnels before shorewall starts.

Thanks

John

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net''s Techsay panel and you''ll get the chance
to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

John McMonagle wrote:
> 
> Wondering if the the kernel and iptables still need patching in Debian
etch?
> Looks like there is policy routing in both but have not actually tested.
> In etch currently have
> iptables             1.3.6.0debian1-5
> kernel is            2.6.18-7
Beware Shorewall FAQ 61! I don''t know if the above iptables version
still has that problem.
> 
> The other thing is its not clear to me can shorewall set up tunnels or
> ipsec?
Shorewall does not set up any type of tunnels.
> Currently I start my ipsec tunnels before shorewall starts.
You will have to continue to configure the tunnel itself outside of
Shorewall.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key



-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net''s Techsay panel and you''ll get the chance
to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV