On Wed, 30 Nov 2016 13:30:46 +0300 John Depp <[email protected]> wrote:
> Sorry for delay > I'm pretty sure those proto 4 IPIP is ESP packets - I was using ping > for testing and was capturing them with tshark, and they were marked > ESP there. ipcomp causes that. If you want to allow that, you need to add following to tunnels: ipip vpn 0.0.0.0/0 Of course if your IPsec zone is vpn. But I'd like to warn that many latish crypto security problems are related to compression with encryption so I'd suggest disabling ipcomp. Also note that usually tunnel type ipsecnat is what you want instead of tunnel type ipsec. -- Tuomo Soini <[email protected]> Foobar Linux services +358 40 5240030 Foobar Oy <http://foobar.fi/> ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
