PF Source routing of IPSEC tunnel ESP packets.
tom at tomjudge.com
Thu Feb 8 11:36:19 UTC 2007
I am having some problems with source routing using PF, I tried the PF
mailing list but got no responses.
The network layout is available at: http://www.tomjudge.com/tmp/tunnels.png
From the diagram Host A and B both have there default gateway set as
ISP A's router, and have a PF rule that should route traffic from ISP
B's addresses to ISP B's router. This seems to work for all traffic
except the IPSEC ESP packets which always get transmitted to the default
gateway that is set on the host. It seems that they do not pass through
the firewall or for some reason do not match the route-to rule. Can
anyone suggest a solution to this problem?
PF rule Host A: (First rule in rule set)
pass out quick on bge1 route-to ( bge1 188.8.131.52 ) inet from 184.108.40.206
to ! 220.127.116.11/27 keep state
PF rule Host B: (First rule in rule set)
pass out quick on bge1 route-to ( bge1 18.104.22.168 ) inet from 22.214.171.124
to ! 126.96.36.199/27 keep state
More information about the freebsd-questions