On Tuesday 2009-02-17 19:23, Patrick McHardy wrote: > Joe Pruett wrote: >> trying this again on the -devel list. the basic question i'm trying to answer >> is if there really isn't a way to filter esp/ah packets after >> decryption/decapsulation in host2host mode. i've looked at what i think is >> the current linus kernel and don't see any changes to esp/ah handling to >> address this. is tunnel mode the only way i can do filtering on the packets >> after ah/esp have done their work? > > Packets in both tunnel and transport mode traverse the netfilter hooks > after decapsulation and before encapsulation. From a users POV there > should be nothing special about it. Precisely, see http://jengelh.medozas.de/images/nf-packet-flow.png . -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
