Hi Bill, I found nDPI (http://www.ntop.org/products/ndpi/) lists IP in IP as a supported protocol. That doesn't fit your requirement that it be an appliance but maybe it gets you going in the right direction.
Cheers, Kyle On Tue, Jul 30, 2013 at 1:38 PM, William Herrin <b...@herrin.us> wrote: > On Tue, Jul 30, 2013 at 4:19 PM, Michael Brown <mich...@supermathie.net> > wrote: > > In the pfSense UI, you create the physical interface as a GRE tunnel > > then assign it to a logical interface against which you can apply the > firewall rules: > > Thanks all. To be clear: I'm dealing with IPIP packets, not GRE > packets. Linux LVS emits IPIP encapsulated packets when the target > server is non-local. I have no option to emit GRE or another kind of > tunnel packet. > > Also, I'd prefer not to terminate the IPIP tunnel on the firewall. I > can, but I'd prefer not to. What I want to do is look inside at the > packet encapsulated by IPIP. Even if I have to hand-crank the rules in > terms of byte X inside the packet should be value Y. > > Thanks again, > Bill Herrin > > > > -- > William D. Herrin ................ her...@dirtside.com b...@herrin.us > 3005 Crane Dr. ...................... Web: <http://bill.herrin.us/> > Falls Church, VA 22042-3004 > >
