Re: Netfilter and IPSec interaction

[Aleksandar Milivojevic <alex@milivojevic.org>]

Aleksandar Milivojevic wrote:
> I'm writing set of firewall rules for IPSec based VPN, and have couple of
> questions.
> 
> I know that packets are supposed to go through Netfilter tables twice (as
> received from the wire, and than as outputed by IPSec module).  However, what I
> noticed is that this seems to be true only for incomming packets.  The outgoing
> packets seems to go through Netfilter tables only once.

Thanks to everybody who replied on the list and off-list.  I'll just 
write a short summary.

Apperently, this is a known problem and it has been discussed on 
Netfilter's development lists.  There are some patches that solve it, 
but they are not going to get into mainstream kernel since approach 
taken in them is problematic (and according to some sources, those 
patches are abandoned and not maintained anymore).  I wasn't able to 
find why the approach is problematic, but apperently answer to that 
question is burried somewhere in archives of Netfilter's development 
list.  Seems that correct approach to solve the problem still needs to 
be found (and once found and implemented will become part of mainstream 
kernel).