ipsec packet filtering

[Mitch (bitblock)]

> But by adding the following option to the kernel conf file you can get
> the processing path I think you are asking for??
>
> options		IPSEC_FILTERGIF (documented in LINT)
>
> This then causes the decrypted packet to be passed thru IPFW again.
>
> Be aware this has significant consequences for where you do NAT in the
> ruleset and requires very careful crafting of the IPFW rules
>
> Pete


ok.

Will this allow me to do the following:

Client 1 <--\
           FREEBSD ROUTER <----> Internet
Client 2 <--/

Client 1, although on the same subnet as client 2, can not directly connect
to Client 2. This is an underlying restriction of the ATM transport of the
telco we deal with. No option.

I want to connect client 1, and client 2. I can create a VPN from client 1
to central router, and client 2 to central router. In the past, I could not
route this traffic.

Are you saying this should be possible now?

Thanks.

m/