Message-ID: <4198DDA8.3000100@globalintech.pl>
Date: Mon, 15 Nov 2004 17:47:36 +0100
From: Blizbor <kernel@globalintech.pl>
User-Agent: Mozilla Thunderbird 0.6 (Windows/20040502)
MIME-Version: 1.0
To: linux-kernel@vger.kernel.org
Subject: Re: 2.6 native IPsec implementation question
References: <4198B2B6.9050803@globalintech.pl> <Pine.LNX.4.53.0411151455020.17543@yvahk01.tjqt.qr> <4198C1A4.8080707@globalintech.pl> <Pine.LNX.4.53.0411151557550.17812@yvahk01.tjqt.qr>
In-Reply-To: <Pine.LNX.4.53.0411151557550.17812@yvahk01.tjqt.qr>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1243
Lines: 34

Jan Engelhardt wrote:

>You "sit" on the network card chip and then think of input and output.
>Btw, -j DROP will only drop what has not been matched up to now. So if you get
>to -j ACCEPT IPsec traffic beforehand (I think -m ah / -m esp, did not
>it?), they will never reach -j DROP.
>  
>
No, it's not like you think.

Situation is NOT EASY IF you have ONE VPN.
Just "close" eth0 for anything, allow AH,ESP,DNS from "any" IP addres,
then how you detect if tcp/389 is from VPN or form world ? You cant.
To make things harder - there are eth0, eth1, eth2 and eth3, two of them
has public IP addresses, two has private IP addresses, there is IPsec VPN
server running on both public addresses and a lot (32) of roadwarrior VPN
clients.

So, in this not easy situation firewalling is not possible.
Believe me.

But, how to implement firewall using iptables command is not my issue.
Lets assume that I just want to do "mrtg" traffic accounting....

So, my questions are still actual.

Regards,
Blizbor

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/