Hello! > But seriously, pfkeyv2 already fills in the source address. Do you mean PROXY? Well, nobody uses it. But we could to enforce this. F.e. for beginning it is possible to reject attempts to install tunnel SA without proxy address. Alexey - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html