Re: New extension: CRYPT target

[Gervasio Bernal <gervasiobernal@speedy.com.ar>]

Carl-Daniel Hailfinger wrote:
> Gervasio Bernal wrote:
> 
>>(on host A, 1.2.3.4, FTP client)
>># iptables -t mangle -A POSTROUTING -d 1.2.3.5 -p tcp --dport 20:21 -j
>>CRYPT --cipher blowfish --key topsecret --mode ecb --direction encrypt
> 
> 
> Ouch. If anybody runs ps while this iptables command is running, he has
> your top secret key.
> 
> Does this provide any benefit over IPSEC?
IPSEC/OpenSwan is complicated to use and quite heavy.
CRYPT is truely peer-to-peer. It is compatible with routing daemons. It
allows you to encrypt all the traffic between two endpoints or only
certain type of traffic (ej: only TCP connections). It is extremely easy
to use for an administrator familiarized with Linux firewalling since it
uses Iptables and it does not make any modification to the normal
routing behavior. CRYPT is considerably light and does all the
encryption/decryption process at kernel space (contrary to OpenVPN).

> 
> Regards,
> Carl-Daniel