Re: Requireing IPsec on wi interface?

Hey list,

Just to close out my thread, here is what I found dealing with forcing IPsec
on a network interface with FreeBSD 4.7-STABLE or later...

IPsec packets can be seperated from clear packets at the layer2 level in the
firewall.  Once they get up to the higher levels, the esp flag cannot be
used to seperate clear from encrypted packets.  This is an example of how to
block all non-ipsec packets coming in on an interface:

allow all esp from any to any in via wi0 layer2
deny all not esp from any to any in via wi0 layer2
allow all from any to any in via wi0 not layer2

You will need IPFW2, so read the IPFW man page on how to build it into your
system.

Ben



To Unsubscribe: send mail to [email protected]
with "unsubscribe freebsd-mobile" in the body of the message