Re: pf does not pass esp?

["Arvid Grøtting" <arvidg@netfonds.no>]

Rickard Borgmäster <doktorn@realworld.nu> writes:

> Does this mean, that I cannot use ESP on a machine located behind the
> OpenBSD PF firewall?

No; you can, but the machine must have an official IP address.  (More
precisely, it must have the same address on both sides of the PF
firewall.)

Also, IIRC you can't use "keep state" in your (3.0-stable) PF rules
for ESP.

I have ESP passing through not one but two OpenBSD 3.0 PF firewalls
with no problem.  Rules example:

pass in on $ext_if proto ah from $foo_gw_foo to $foo_gw_here
pass in on $ext_if proto esp from $foo_gw_foo to $foo_gw_here
pass in proto ah from $foo_gw_here to $foo_gw_foo
pass in proto esp from $foo_gw_here to $foo_gw_foo


-- 

Arvid