ipsec with ipfw

[Slawa Olhovchenkov]

On Sat, Mar 11, 2017 at 09:53:39PM -0800, Ermal Luçi wrote:

> On Sat, Mar 11, 2017 at 2:16 PM, Slawa Olhovchenkov <slw at zxy.spb.ru> wrote:
> 
> > On Sun, Mar 12, 2017 at 12:53:44AM +0330, Hooman Fazaeli wrote:
> >
> > > Hi,
> > >
> > > As you know the ipsec/setkey provide limited syntax to define security
> > > policies: only a single subnet/host, protocol number and optional port
> > > may be used to specify traffic's source and destination.
> > >
> > > I was thinking about the idea of using ipfw as the packet selector for
> > ipsec,
> > > much like it is used with dummeynet. Something like:
> > >
> > > ipfw add 100 ipsec 2 tcp from <lan-table> to <remote-servers-table>
> > 80,443,110,139
> > >
> > > What do you think? Are you interested in such a feature?
> > > Is it worth the effort? What are the implementation challenges?
> >
> > security policies is subject of ike protocol exchange, do you plened
> > to extend this protocol too?
> >
> 
> With the introduction of if_ipsec you can implement such tricks through
> routing.

1. routing don't distribute port/protocol info

2. connected client don't have any preconfigured security policies and
got it by IKE protocol from server. how do you to implement this? for
windows/ios/android clients.