Re: Filtering on IPSEC

2012-01-12 Thread VANHULLEBUS Yvan
Hi. On Wed, Jan 11, 2012 at 08:14:24PM -0600, David DeSimone wrote: > Alex Dupre wrote: > > > > I've setup my first IPSEC VPN beetween FreeBSD 8.2 and CheckPoint > > VPN-1. I've used a gif interface for the tunnel, setkey for security > > policies and racoon for ikev1. > > I've peered with Check

Re: Filtering on IPSEC

2012-01-12 Thread Alex Dupre
Bjoern A. Zeeb ha scritto: If you are using tunnel mode and gif you'll have trouble; just use tunnel mode without gif and you'll be happy. Done, it works and I see all packets on enc0 now, thanks. It's because (our) pf cannot NAT on incoming but only on outgoing interfaces. And you need

Re: Filtering on IPSEC

2012-01-11 Thread Bjoern A. Zeeb
On 12. Jan 2012, at 07:29 , Alex Dupre wrote: > Bjoern A. Zeeb ha scritto: >> Need more input. A) why are using gif? B) are you using transport mode? > > I'm using gif, because the official FreeBSD documentation says so > (http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html).

Re: Filtering on IPSEC

2012-01-11 Thread Alex Dupre
Bjoern A. Zeeb ha scritto: Need more input. A) why are using gif? B) are you using transport mode? I'm using gif, because the official FreeBSD documentation says so (http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html). My configuration is very similar to what described in

Re: Filtering on IPSEC

2012-01-11 Thread David DeSimone
Alex Dupre wrote: > > I've setup my first IPSEC VPN beetween FreeBSD 8.2 and CheckPoint > VPN-1. I've used a gif interface for the tunnel, setkey for security > policies and racoon for ikev1. I've peered with Checkpoint VPN's using FreeBSD but I never needed to use gif interfaces to make it happe

Re: Filtering on IPSEC

2012-01-11 Thread Bjoern A. Zeeb
On 11. Jan 2012, at 18:12 , Alex Dupre wrote: > Hi All, > I've setup my first IPSEC VPN beetween FreeBSD 8.2 and CheckPoint VPN-1. I've > used a gif interface for the tunnel, setkey for security policies and racoon > for ikev1. All is working fine, but I get a strange behavior: outgoing > pack

Filtering on IPSEC

2012-01-11 Thread Alex Dupre
Hi All, I've setup my first IPSEC VPN beetween FreeBSD 8.2 and CheckPoint VPN-1. I've used a gif interface for the tunnel, setkey for security policies and racoon for ikev1. All is working fine, but I get a strange behavior: outgoing packets go via enc0, while incoming packets arrive in gif0. T