os/doc
3
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

When IPSEC is configured according to the Handbook[1], pf fails

Browse source 
to track connection state properly, because it does not see
packets coming from the tunneled interface to gif(4).  Rebuilding
with IPSEC_FILTERGIF fixes the problem.

According to mlaier@ we cannot change GENERIC for this, but it's
ok to document the requirement for IPSEC_FILTERGIF.  Add a note
to this effect.

[1] http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html

PR:		kern/97057
Submitted by:	Dmitry Andrianov <freebsd@dima.spb.ru>
Suggested by:	mlaier
Reviewed by:	remko
This commit is contained in:
Giorgos Keramidas 2006-06-26 13:06:22 +00:00
parent 5d0d47d906
commit 4d2455bbfb
Notes: svn2git 2020-12-08 03:00:23 +00:00 
svn path=/head/; revision=28169
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
en_US.ISO8859-1/books/handbook/security/chapter.sgml
View file

@ -3116,7 +3116,17 @@ options FAST_IPSEC # new IPsec (cannot define w/ IPSEC)
<quote>Fast IPsec</quote> subsystem in lieu of the KAME
implementation of IPsec. Consult the &man.fast.ipsec.4;
manual page for more information.</para>
</note>
<note>
<para>To let firewalls properly track state for &man.gif.4;
tunnels too, you have to enable the
<option>IPSEC_FILTERGIF</option> in your kernel
configuration:</para>
<screen>
options IPSEC_FILTERGIF #filter ipsec packets from a tunnel
</screen>
</note>
<indexterm>