NetFilter
[Top] [All Lists]

Re: SNAT before IPSec

To: Mail List - Netfilter <netfilter@lists.netfilter.org>
Subject: Re: SNAT before IPSec
From: Grant Taylor <gtaylor@riverviewtech.net>
Date: Tue, 05 Jun 2007 09:36:59 -0500
Delivered-to: sp-com-lists@consult.net
Delivered-to: netfilter-list1@securepoint.com
In-reply-to: <8bd3dfad0706050529s484d42b6t9ef4ae0fd1730367@mail.gmail.com>
List-archive: </pipermail/netfilter>
List-help: <mailto:netfilter-request@lists.netfilter.org?subject=help>
List-id: General discussion and user questions <netfilter.lists.netfilter.org>
List-post: <mailto:netfilter@lists.netfilter.org>
List-subscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=subscribe>
List-unsubscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=unsubscribe>
Organization: Riverview Technologies Inc.
References: <8bd3dfad0706050529s484d42b6t9ef4ae0fd1730367@mail.gmail.com>
Reply-to: gtaylor+reply@riverviewtech.net
Sender: netfilter-bounces@lists.netfilter.org
User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.3) Gecko/20070511 Thunderbird/2.0.0.0 Mnenhy/0.7.5.666
On 06/05/07 07:29, noa levy wrote:
SNAT takes place in POST_ROUTING. Can IPSec be applied after that? I
have read that after IPSec the packet gets injected to LOCAL_OUT
again, but when does the actual IPSec policy decision take place?
Won't it happen *before* SNAT? Can I control it?

Last I looked (it's been a while) the basic methodology at the time was that (unencrypted) traffic would pass through the kernel like regular traffic. Then after everything else was done it would be encrypted and looped back through the system in its encrypted form. So what you would do is selectively do what ever you wanted to do to the traffic before it was encrypted by matching that traffic with filters. In short, do what ever you want to with the clear text traffic, then do what ever you want with cypher text traffic.

There use to be a series of patches that needed to be applied to the kernel to make this packet flow possible. I do not know if these patches are still required or not, though I would expect it to be main line by now.

Can / will any one confirm / refute this please?



Grant. . . .


<Prev in Thread] Current Thread [Next in Thread>