Joe Pruett wrote:
trying this again on the -devel list. the basic question i'm trying to answer is if there really isn't a way to filter esp/ah packets after decryption/decapsulation in host2host mode. i've looked at what i think is the current linus kernel and don't see any changes to esp/ah handling to address this. is tunnel mode the only way i can do filtering on the packets after ah/esp have done their work?
Packets in both tunnel and transport mode traverse the netfilter hooks after decapsulation and before encapsulation. From a users POV there should be nothing special about it. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
