Thank you very much for spending so much efforts to resolve my issue.
As I've mentioned the simplest way to avoid the problem is to turn off
ipcomp.
The only drawback is the way the ipcomp could be turned on or off in
strongswan - the single option
compress = <yes|no> does the thing, so many ppl (me included) could just
turn it on for good.
As for cleaner solution, I'd suggest removing the "policy match dir in pol
none" statement from eth0_in zone in net-fw rule - let all packets hit the
rule and then we could apply rules from shorewall/rules for them - but of
course I just don't see the whole picture and don't know why this statement
was inserted for.
I think i'll cease further efforts as I'm satisfied with no ipcomp at all.
Thank you anyways!
2016-12-17 4:46 GMT+03:00 Tom Eastep <[email protected]>:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> On 12/16/2016 03:07 PM, Tom Eastep wrote:
>
> >
> > I will continue to work on this to come up with a cleaner
> > solution.
> >
>
> I should add that I believe that this is a Netfilter issue. So the
> solution will probably not be a change to Shorewall.
>
> - -Tom
> - --
> Tom Eastep \ When I die, I want to go like my Grandfather who
> Shoreline, \ died peacefully in his sleep. Not screaming like
> Washington, USA \ all of the passengers in his car
> http://shorewall.net \________________________________________________
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
> Comment: GPGTools - http://gpgtools.org
>
> iQIcBAEBCAAGBQJYVJj/AAoJEJbms/JCOk0QM/YP/2ViKrR7GL3BDG3k6xbWYP6B
> wzJLjhKmunpLX7MlgtYDKkBnTYP7wdYanUTV0RZml+X09yCRQV2nK1EGS1Y2Qy/G
> 7I4LzKgTdCbOYSHhoyncAcUwd1iR2pnGCZiI9cfhUPJxAPGw8m2OK+j4bwHjENUG
> HzeObWmZn+RtZ+Pvme2QwM7oHyC7oR1MFGp+dzkMtcSPo+fbqqg90tbcC2pZpHh+
> H5jCD6IP+Cboomjf+3n3pTzOVeYW2lnLYNmj96zhcMV7B5kBz6mOf1Ax3IM0DWbM
> TaluoOIprcnpal5+RLooDWD4GQTqNUZs+x2/ZjFCXzRL7cXTUIdK2ac83Svofb9h
> /pyzfuXZIVRp9PAW9qzRlvBOFqeCt613PSC10mFutfL3gV+OLAjKpru8MIv9quDu
> l+FLal8WJ8op9egS67iLVjj3N31lA9Te8xW3esJxKuPh9CvCFub8N8ecuPR4DB7j
> wv9wNdEL9ypQ6Fp0p05zN+GQjB83WSTWCoRJmC4VvxIEfeyap18LB3wuTn2O0yBx
> MiCIxwwCKCJI67ySL3fDUWv0buYnfFwg49m03FhJIJREyaoPabAsAJ0ZfFEZrGyr
> fKV7javShb6y6SnrMB9GY26jiMTerfrXWg2hlCQyaBv/YWK4wF8VTg+gxx7SWc+7
> zaD9Gg6+45w0YkS3R1w4
> =zw/E
> -----END PGP SIGNATURE-----
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> _______________________________________________
> Shorewall-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/shorewall-users
>
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
