From: Dax Kelson <dax@gurulabs.com>
To: Andreas Jellinghaus <aj@dungeon.inka.de>
Cc: Harald Welte <laforge@netfilter.org>,
netfilter-devel@lists.netfilter.org,
netfilter@lists.netfilter.org, netdev@oss.sgi.com
Subject: Re: port-based filtering of ESP packets with in-kernel IPsec?
Date: 30 Jul 2003 16:51:34 -0600 [thread overview]
Message-ID: <1059605494.3284.141.camel@mentor.gurulabs.com> (raw)
In-Reply-To: <1059597421.3284.7.camel@mentor.gurulabs.com>
On Wed, 2003-07-30 at 14:37, Dax Kelson wrote:
> On Wed, 2003-07-30 at 08:51, Andreas Jellinghaus wrote:
> > [netfilter]
> > incoming encrypted packets are seen as ESP/AH in INPUT
> > and then as decrypted packet in INPUT or FORWARD.
>
> Just to clarify, the packets will travel INPUT *twice* (once as ESP and
> then in the clear)?
If this is the case, then I see a problem.
If you have an explicit drop/reject all the bottom (or have a DROP
policy) of INPUT then no IPSEC traffic would be allowed.
I supposed you could add a rule that allowed all ESP traffic before the
the explicit drop.
Dax
next prev parent reply other threads:[~2003-07-30 22:51 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-07-30 4:44 port-based filtering of ESP packets with in-kernel IPsec? Rick Kennell
2003-07-30 10:34 ` Chris Wilson
2003-07-30 15:42 ` Rick Kennell
2003-07-30 15:42 ` Rick Kennell
2003-07-30 19:10 ` Henrik Nordstrom
2003-07-30 19:10 ` Henrik Nordstrom
2003-07-30 14:24 ` Harald Welte
2003-07-30 14:51 ` Andreas Jellinghaus
2003-07-30 14:51 ` Andreas Jellinghaus
2003-07-30 15:16 ` Harald Welte
2003-07-30 15:16 ` Harald Welte
2003-07-30 15:16 ` Harald Welte
2003-07-30 20:37 ` Dax Kelson
2003-07-30 22:51 ` Dax Kelson [this message]
2003-07-30 14:51 ` Andreas Jellinghaus
2003-07-30 15:45 ` Jeremy Davis
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1059605494.3284.141.camel@mentor.gurulabs.com \
--to=dax@gurulabs.com \
--cc=aj@dungeon.inka.de \
--cc=laforge@netfilter.org \
--cc=netdev@oss.sgi.com \
--cc=netfilter-devel@lists.netfilter.org \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.