Re: IPSec VPNs: to gif or not to gif

From: Jim Hatfield (subscriber_at_insignia.com)
Date: 10/24/03

  • Next message: Eric Anderson: "Re: /var partition overflow (due to spyware?) in FreeBSD default install" 
    To: freebsd-security@freebsd.org
Date: Fri, 24 Oct 2003 12:40:11 +0100

    On Thu, 23 Oct 2003 12:23:03 +0100, in local.freebsd.security you
    wrote:

    >The issue was put to bed.
    >Reference:
    >http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/netinet/ip_input.c?rev=1.2
    >14&content-type=text/x-cvsweb-markup
    >http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/netinet/ip_input.c?rev=1.1
    >30.2.48&content-type=text/x-cvsweb-markup
    >http://docs.freebsd.org/cgi/getmsg.cgi?fetch=132950+0+/usr/local/www/db/
    >text/2001/freebsd-security/20010325.freebsd-security
    >
    >Current behavior is encrypted packet is handled by ipfw once, then after
    >
    >decryption it is only handled by ipfw(again) if it passes thru an
    >interface didn't arrive on.

    Many thanks, that's very helpful.

    Jim
    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"

  • Next message: Eric Anderson: "Re: /var partition overflow (due to spyware?) in FreeBSD default install"

    Relevant Pages

    • Re: IPSec VPNs: to gif or not to gif
      ... > Current behavior is encrypted packet is handled by ipfw once, ... > decryption it is only handled by ipfwif it passes thru an ... They can only give you answers" Pablo Picasso ...
      (FreeBSD-Security)
    • Re: IPSec VPNs: to gif or not to gif
      ... >> Current behavior is encrypted packet is handled by ipfw once, ... >> decryption it is only handled by ipfwif it passes thru an ... To unsubscribe, ...
      (FreeBSD-Security)
    • Re: multiple natd + ipfw, with 2 internal ips
      ... I have a little problem with my natd or ipfw configuration. ... Well you could if you set your internal interface to be in promiscuous mode and set proxy arp for that address ... is the next hop router, it uses ARP to find the MAC address of this router. ...
      (freebsd-net)
    • RE: Which interface do I put natd and ipfw
      ... You only NAT the public internet facing interface, ... You should turn on user ppp -nat function and not use the ipfw ... public internet use keep-state. ... All rules use via interface name to specify the interface the ...
      (freebsd-questions)
    • Re: Freebsd IP Forwarding performance (question, and some info) [7-stable, current, em, smp]
      ... All incoming traffic from any particular interface is still serialized though. ... I've really only focused on local traffic performance with my 10gbps Chelsio setup, it should be possible to do packet forwarding from multiple input queues using that hardware and driver today. ... However, these necessarily take a cache miss or two on packet header data in order to break out the packets from the input queue into flows that can be processed independently without ordering constraints, so if those cache misses on header data are a big part of the performance of a configuration, load balancing in this manner may not help. ... Maximum PPS with one ipfw rule on UP: ...
      (freebsd-net)