> > OpenBSD's way of doing things seems interesting while reading very > quickly your link, I'll have to take some more time to really see > exactly what they are doing..... > > Basically they make aware the daemon and the firewall of the nat.
Actually it is more 'user-friendly' to configure though clamsy since you have to do keep the same information in two places, firewall nat rules and the ipsec daemon. You just tell instrument the daemon to inject one 'normal'(out) SA's match traffic coming from your local network and one SA for incoming traffic from remote network with the natted network address. This all is because pf(4) cannot do 'incoming nat' by default. -- Ermal _______________________________________________ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
