Terry Lambert wrote: > Les Biffle wrote: > >>>You could use the draft-touch-ipsec-vpn-04.txt together with ipfw rules, >>>but then you say you don't want to look at IP addresses... >> >>I'm happy to look at outside addresses, just not the ones on the inside. >>I would also consider matching up endpoint (VPN gateway or "outside") >>address and SPI to know which SA a packet is arriving on, for the >>inbound-through-tunnel direction, and then use the vlan interface name >>to help select the departing tunnel, if possible. >> >> >>>So no, I don't see how it can be done under your constraints. >> >>Well, not perhaps without some nethacks in the kernel. I've certainly >>done that before, but would prefer something more vanilla. > > > > One short answer is to not set a default route, per se. > > I know this is ugly, but it fixes the IPSec tunnel problem.
I don't think we have the same definition of "the IPSec tunnel problem." Mine is "tunnel mode SAs aren't interfaces, and IPsec duplicates encapsulation and firewalling techniques that are (better) handled outside IPsec", see draft-touch-ipsec-vpn. Having or not having a default route won't matter, since you'll have more specific routes that match before the default route would be picked. Lars -- Lars Eggert <[EMAIL PROTECTED]> USC Information Sciences Institute
smime.p7s
Description: S/MIME Cryptographic Signature
