Re: ip_output: NAT then IPSEC

2012-06-14 Thread Eugene Grosbein
15.06.2012 03:21, Michael Sierchio пишет: > On Thu, Jun 14, 2012 at 9:42 AM, Eugene Grosbein wrote: > >> How do I make FreeBSD 8-based router/NAT/security gateway >> first perform NAT for outgoing packets then apply IPSEC transport mode >> for plain TCP traffic? > > Forgive me, but I have to ask

Re: if_ipsec

2012-06-14 Thread Eugene M. Zheganin
Hi. On 14.06.2012 21:57, Jeremie Le Hen wrote: Not at all, I read the whole mail thoroughly actually :-). But I don't work on Cisco/Junipers equipements so I didn't exactly grasp what you meant. Okay. Actually, the whole idea is to 'simplify'. The conventional way of creating IPSec makes you

Re: ip_output: NAT then IPSEC

2012-06-14 Thread Bjoern A. Zeeb
On 14. Jun 2012, at 16:42 , Eugene Grosbein wrote: > Hi! > > How do I make FreeBSD 8-based router/NAT/security gateway > first perform NAT for outgoing packets then apply IPSEC transport mode > for plain TCP traffic? > > Presently, locally originated packets are encrypted just fine > but routed

Re: ip_output: NAT then IPSEC

2012-06-14 Thread Michael Sierchio
On Thu, Jun 14, 2012 at 9:42 AM, Eugene Grosbein wrote: > How do I make FreeBSD 8-based router/NAT/security gateway > first perform NAT for outgoing packets then apply IPSEC transport mode > for plain TCP traffic? Forgive me, but I have to ask - why? IPsec implies pairwise association, and reli

Re: if_ipsec

2012-06-14 Thread Adrian Chadd
Hm, I remember some reasons down in the deep, distant past as to why ipsec implementations moved away from tunnel mode == tunnel interfaces. When I was being a network engineer during the day, I constantly hated having to implement tunnels using traffic maps rather than actual interfaces. Chances

ip_output: NAT then IPSEC

2012-06-14 Thread Eugene Grosbein
Hi! How do I make FreeBSD 8-based router/NAT/security gateway first perform NAT for outgoing packets then apply IPSEC transport mode for plain TCP traffic? Presently, locally originated packets are encrypted just fine but routed and NAT-ed packet go out unencrypted. I use ipfw nat. Eugene Grosb

Re: if_ipsec

2012-06-14 Thread Jeremie Le Hen
Eugene On Thu, Jun 14, 2012 at 01:12:01PM +0600, Eugene M. Zheganin wrote: > Hi, > > On 09.06.2012 23:07, Jeremie Le Hen wrote: > > What it usually done for convenience is to create a gif(4) or gre(4) > > tunnel to another network, which is then encrypted using IPSec > > transport mode. The inn

Re: bin/117339: [patch] route(8): loading routing management commands from file

2012-06-14 Thread Alter
The following reply was made to PR bin/117339; it has been noted by GNATS. From: Alter To: bug-follo...@freebsd.org, al...@alter.org.ua Cc: Subject: Re: bin/117339: [patch] route(8): loading routing management commands from file Date: Thu, 14 Jun 2012 16:30:22 +0200 Hello bug-followup, Un

Re: kern/168842: FreeBSD 8.2-STABLE sending FIN no ACK packets.

2012-06-14 Thread Andre Oppermann
On 13.06.2012 15:19, Andre Oppermann wrote: On 08.06.2012 14:43, Nikolay Denev wrote: On Jun 8, 2012, at 4:30 AM, Adrian Chadd wrote: On 7 June 2012 05:41, Nikolay Denev wrote: Hello, I've been pointed out by our partner that we are sending TCP packets with FIN flag and no ACK set, which i

Re: if_ipsec

2012-06-14 Thread Eugene M. Zheganin
Hi, On 09.06.2012 23:07, Jeremie Le Hen wrote: What it usually done for convenience is to create a gif(4) or gre(4) tunnel to another network, which is then encrypted using IPSec transport mode. The inner IP/GRE header is considered as the payload and it is encrypted. The benefit of this appro