Re: iptables, ipsec, and host2host

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Joe Pruett wrote:
 trying this again on the -devel list.  the basic question i'm trying to
 answer is if there really isn't a way to filter esp/ah packets after
 decryption/decapsulation in host2host mode.  i've looked at what i think
 is the current linus kernel and don't see any changes to esp/ah handling
 to address this.  is tunnel mode the only way i can do filtering on the
 packets after ah/esp have done their work?

Packets in both tunnel and transport mode traverse the netfilter hooks
after decapsulation and before encapsulation. From a users POV there
should be nothing special about it.

i don't see that behaviour on rhel/centos 5 kernels. could this have changed since 2.6.18? for tunnel mode, it looks to me like the ip-ip module is what causes traffic to be seen after decrypt/decap, and i just don't see anything like that for transport mode.

i'll do some more experiments.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux