Re: ipsec / PF received-on

2013-06-05 Thread David Gwynne
On 04/06/2013, at 11:22 AM, Claudio Jeker cje...@diehard.n-r-g.com wrote: On Mon, Jun 03, 2013 at 11:49:58PM +0100, Stuart Henderson wrote: On a router running PF and isakmpd, I have a rule like this: match out on pppoe0 inet all received-on vlan5 nat-to $someip I was surprised to find

Re: ipsec / PF received-on

2013-06-04 Thread Mike Belopuhov
On 4 June 2013 02:48, Stuart Henderson st...@openbsd.org wrote: On 2013/06/04 02:01, Mike Belopuhov wrote: On 4 June 2013 00:49, Stuart Henderson s...@spacehopper.org wrote: On a router running PF and isakmpd, I have a rule like this: match out on pppoe0 inet all received-on vlan5 nat-to

ipsec / PF received-on

2013-06-03 Thread Stuart Henderson
On a router running PF and isakmpd, I have a rule like this: match out on pppoe0 inet all received-on vlan5 nat-to $someip I was surprised to find this being applied to packets received on vlan5 and caught by an ipsec flow; the resulting *encapsulated* (proto ESP) packets (as in, generated on

Re: ipsec / PF received-on

2013-06-03 Thread Chris Cappuccio
Stuart Henderson [s...@spacehopper.org] wrote: On a router running PF and isakmpd, I have a rule like this: match out on pppoe0 inet all received-on vlan5 nat-to $someip I was surprised to find this being applied to packets received on vlan5 and caught by an ipsec flow; the resulting

Re: ipsec / PF received-on

2013-06-03 Thread Stuart Henderson
On 2013/06/04 02:01, Mike Belopuhov wrote: On 4 June 2013 00:49, Stuart Henderson s...@spacehopper.org wrote: On a router running PF and isakmpd, I have a rule like this: match out on pppoe0 inet all received-on vlan5 nat-to $someip I was surprised to find this being applied to packets

Re: ipsec / PF received-on

2013-06-03 Thread Claudio Jeker
On Mon, Jun 03, 2013 at 11:49:58PM +0100, Stuart Henderson wrote: On a router running PF and isakmpd, I have a rule like this: match out on pppoe0 inet all received-on vlan5 nat-to $someip I was surprised to find this being applied to packets received on vlan5 and caught by an ipsec flow;