GRE and PF problem
tarkhil at webmail.sub.ru
Thu Jul 14 18:25:40 GMT 2005
Giovanni P. Tirloni wrote:
> Alex Povolotsky wrote:
>> compunction wrote:
>>> GRE needs to pass bidirectional. You will need a binat to make it
>>> work. I have not found a firewall that will allow GRE to work with a
>>> many to one nat.
>> The most painful thing is that pf's nat works for GRE - SOMETIMES :-(
>> The only thing firewall needs to implement for natting GRE is
>> creation of two rules (forward and back) for GRE packet, just like it
>> does for ICMP.
>> I'm not a firewall writer, but as far as I understand general
>> procedural programming, it cannot be THAT complicated.
> When a packet comes from 220.127.116.11 to your external interface you can't
> determine if it's destined to 192.168.0.1 or 192.168.0.2 if both
> initiated a GRE tunnel to 18.104.22.168. That's because GRE doesn't have
> ports like UDP or TCP to make (de)multiplexing possible, AFAIK.
Cool. I did not know that ICMP doesn't work through nat. It always
worked for me. Moreover, as far as I remember, GRE worked with
IPFW/NATD, and SOMETIMES it works with pf.
More information about the freebsd-net