[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: pf does not pass esp?
Rickard Borgmäster <firstname.lastname@example.org> writes:
> Does this mean, that I cannot use ESP on a machine located behind the
> OpenBSD PF firewall?
No; you can, but the machine must have an official IP address. (More
precisely, it must have the same address on both sides of the PF
Also, IIRC you can't use "keep state" in your (3.0-stable) PF rules
I have ESP passing through not one but two OpenBSD 3.0 PF firewalls
with no problem. Rules example:
pass in on $ext_if proto ah from $foo_gw_foo to $foo_gw_here
pass in on $ext_if proto esp from $foo_gw_foo to $foo_gw_here
pass in proto ah from $foo_gw_here to $foo_gw_foo
pass in proto esp from $foo_gw_here to $foo_gw_foo