Re: Re: [Users] Making FreeS/WAN harder to use, INTENTIONALLY.

-----BEGIN PGP SIGNED MESSAGE-----


>>>>> "Sam" == Sam Sgro <[email protected]> writes:
    >> No, it is quite right.  It isn't for VPNs. End of story.

    Sam> I'm going to have to explain how our default config breaks routing
    Sam> for most SG users as we attempt to use technology (OE) they have no
    Sam> hope of succeeding at (ie, there are no KEY/TXT records for our
    Sam> public IP, so why are we even trying?).

  Yes, this is an issue.

  Btw, there is another issue for SG users - one can not enable OE if the
gateway is doing NAT for the clients. 

  In theory, there is no reason why one can't do NAPT, and then host-OE on
the resulting packet. In practice, the %pass route that occurs when the 
remote host does not support OE seems to cause some errant state to occur in
connection tracking.
  The NAPT occurs properly before the packet arrives at ipsec0, but the
responding packet, arriving at eth1/ppp0 does not get matched properly.

  I don't know why as yet.

    Sam> This is a story that is considered a priority by some members of the
    Sam> team. I propose it become a greater priority for 2.01.
 
  It is already the highest priority story.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email protected] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
Comment: Finger me for keys

iQCVAwUBPmODRYqHRg3pndX9AQGpEQP+KrvG6I4FbUjiwRGztechqqljyD3kRpHO
aZ4KfX2+ti9MJ3Ph07Zu8g2cgL2LQ7+q6PQpSsgdjzKjMyHwY2dm8n4xJlQ2Qiyw
bpRJkhsL+7ci4/KEjWGAzQwSozTBbGIZKH0/e203Oa1wxQqixVmDDoYD4xRUqgxm
0OROJt8treI=
=VxfQ
-----END PGP SIGNATURE-----