Thanks alot! I'll give it a try in a day or two - with ipsecnat and compression
turned off also.
-----Исходное сообщение-----
От: "Tuomo Soini" <[email protected]>
Отправлено: 03.12.2016 14:01
Кому: "John Depp" <[email protected]>
Копия: "Shorewall Users" <[email protected]>
Тема: Re: [Shorewall-users] shorewall and Strongswan - possibleincompatibility?
On Wed, 30 Nov 2016 13:30:46 +0300
John Depp <[email protected]> wrote:
> Sorry for delay
> I'm pretty sure those proto 4 IPIP is ESP packets - I was using ping
> for testing and was capturing them with tshark, and they were marked
> ESP there.
ipcomp causes that. If you want to allow that, you need to add
following to tunnels:
ipip vpn 0.0.0.0/0
Of course if your IPsec zone is vpn.
But I'd like to warn that many latish crypto security problems are
related to compression with encryption so I'd suggest disabling ipcomp.
Also note that usually tunnel type ipsecnat is what you want instead of
tunnel type ipsec.
--
Tuomo Soini <[email protected]>
Foobar Linux services
+358 40 5240030
Foobar Oy <http://foobar.fi/>
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
