[164726] in North American Network Operators' Group
Re: which firewall product?
daemon@ATHENA.MIT.EDU (William Herrin)
Tue Jul 30 16:39:33 2013
In-Reply-To: <51F81FD6.9000605@supermathie.net>
From: William Herrin <bill@herrin.us>
Date: Tue, 30 Jul 2013 16:38:49 -0400
To: Michael Brown <michael@supermathie.net>
Cc: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Tue, Jul 30, 2013 at 4:19 PM, Michael Brown <michael@supermathie.net> wrote:
> In the pfSense UI, you create the physical interface as a GRE tunnel
> then assign it to a logical interface against which you can apply the firewall rules:
Thanks all. To be clear: I'm dealing with IPIP packets, not GRE
packets. Linux LVS emits IPIP encapsulated packets when the target
server is non-local. I have no option to emit GRE or another kind of
tunnel packet.
Also, I'd prefer not to terminate the IPIP tunnel on the firewall. I
can, but I'd prefer not to. What I want to do is look inside at the
packet encapsulated by IPIP. Even if I have to hand-crank the rules in
terms of byte X inside the packet should be value Y.
Thanks again,
Bill Herrin
--
William D. Herrin ................ herrin@dirtside.com bill@herrin.us
3005 Crane Dr. ...................... Web: <http://bill.herrin.us/>
Falls Church, VA 22042-3004
