[164729] in North American Network Operators' Group
Re: which firewall product?
daemon@ATHENA.MIT.EDU (Kinkaid, Kyle)
Tue Jul 30 19:00:42 2013
In-Reply-To: <CAP-guGVyrMcudLzf9YR13+WgGbfcn11Ad0gsHD3Dro4fsJL2mA@mail.gmail.com>
Date: Tue, 30 Jul 2013 15:28:05 -0700
From: "Kinkaid, Kyle" <kkinkaid@usgs.gov>
To: William Herrin <bill@herrin.us>
Cc: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Hi Bill,
I found nDPI (http://www.ntop.org/products/ndpi/) lists IP in IP as a
supported protocol. That doesn't fit your requirement that it be an
appliance but maybe it gets you going in the right direction.
Cheers,
Kyle
On Tue, Jul 30, 2013 at 1:38 PM, William Herrin <bill@herrin.us> wrote:
> On Tue, Jul 30, 2013 at 4:19 PM, Michael Brown <michael@supermathie.net>
> wrote:
> > In the pfSense UI, you create the physical interface as a GRE tunnel
> > then assign it to a logical interface against which you can apply the
> firewall rules:
>
> Thanks all. To be clear: I'm dealing with IPIP packets, not GRE
> packets. Linux LVS emits IPIP encapsulated packets when the target
> server is non-local. I have no option to emit GRE or another kind of
> tunnel packet.
>
> Also, I'd prefer not to terminate the IPIP tunnel on the firewall. I
> can, but I'd prefer not to. What I want to do is look inside at the
> packet encapsulated by IPIP. Even if I have to hand-crank the rules in
> terms of byte X inside the packet should be value Y.
>
> Thanks again,
> Bill Herrin
>
>
>
> --
> William D. Herrin ................ herrin@dirtside.com bill@herrin.us
> 3005 Crane Dr. ...................... Web: <http://bill.herrin.us/>
> Falls Church, VA 22042-3004
>
>
