Re: (review request) ipfw and ipsec processing order foroutgoingpackets

From: Ari Suutari (ari_at_suutari.iki.fi)
Date: 12/07/04

  • Next message: RoyalShells Admin: "WATCHING DDOS ATTACKS" 
    To: "Jeremie Le Hen" <jeremie@le-hen.org>
Date: Tue, 7 Dec 2004 10:43:00 +0200

    Hi,

    > But I may be
    > missing something because I can see no way in firewall rules to
    > distinguish between the before IPSec processing hook and the after IPSec
    > processing one. Could you clarify this for me please ?

        There is a keyword "ipsec" in ipfw2, which matches if packet has emerged
        from ipsec tunnel. To match packet before ipsec stack, use protocol
    esp/ah
        in ipfw rule. To match packet after ipsec stack, use tcp/udp/ip as
    protocol
        and "ipsec" keyword.

        The problem is that this doesn't work for outgoing packets, which breaks
        at least statefull rules.

            Ari S.

    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"

  • Next message: RoyalShells Admin: "WATCHING DDOS ATTACKS"

    Relevant Pages

    • Re: IPSEC Policy to secure TS
      ... Ipsec will also require additional ... firewall rules other than 3389 of course. ... > computers accessing the TS from across the internet. ... >>> policy, try server request policy to see if that will ...
      (microsoft.public.win2000.security)
    • RE: Editing MS-2000 Firewall Rules
      ... there have been some issues pointed out with IPSec before on this ... the rules underlying IP Filtering rules to do filtering by Src/Dest ... Subject: Editing MS-2000 Firewall Rules ... > firewall rules in a Windows 2000 Box such as firewall rules in Linux ...
      (Focus-Microsoft)
    • Re: ipsec and ICF
      ... qAPLAh wrote: ... how I should set up firewall rules with ipsec? ... Tom ...
      (microsoft.public.windowsxp.security_admin)
    • Re: (review request) ipfw and ipsec processing order for outgoingpackets
      ... I was trying to avoid duplicating ... missing something because I can see no way in firewall rules to ... distinguish between the before IPSec processing hook and the after IPSec ...
      (freebsd-net)
    • Re: Restrict Tcp/IP connetions
      ... You want to create an ipsec filtering policy. ... a mirrored "block all" ip rule, then an mirrored rule that will permit all ... that firewall rules in that their ordering does not matter, ...
      (microsoft.public.win2000.security)