|
ru.linux
- RU.LINUX ---------------------------------------------------------------------
From : Aleksey Barabanov 2:5020/400 29 Jul 2005 12:54:42
To : Yuri Timofeev
Subject : Re: iptables и где там IPsec ?
--------------------------------------------------------------------------------
Yuri Timofeev wrote:
> По документации, чтобы обpазовался туннель, даются указания
> непосpедственно ядpу (у меня 2.6.11 + ipsec-tools).
------------------------^^^^^^^^^^^^^
Это уже совсем другой вопрос.
Hачинайте думать с этого
alekseybb@wsalekseybb:~> sed -n '/2.6 kernel/
$p' /usr/share/doc/packages/openswan/README.SUSE
Firewalling with 2.6 kernel IPsec
---------------------------------
In former times (2.4 kernel with KLIPS module), the use could use firewall
rules that were matching only network packets received to sent via ipsec
by specifying the interface ipsecX. This interface does not exist any more
with the in-kernel implementation of IPsec support in kernel 2.6.
To allow filtering specifically for IPsec packets, a new netfilter policy
module has been created. To find out about it, enter
ipsec -m policy --help
You can match IPsec/non-IPsec traffic (--pol ipsec/none) by direction
(in/out), protocol (esp/ah/ipcomp), mode (tunnel/transport), ... and do
whatever you want with the matching packets (ACCEPT, DROP, ...)
Here's an example that rejects all incoming packets from the interface
$WLAN_IF that is are not IPsec ESP packets.
iptables -A FORWARD -i $WLAN_IF -m policy --dir in --pol ipsec -j ACCEPT
iptables -A FORWARD -i $WLAN_IF -j LOG --log-prefix "NonESP: "
iptables -A FORWARD -i $WLAN_IF -j DROP
Your Novell/SUSE team.
http://www.suse.com/feedback/
alekseybb@wsalekseybb:~>
--
Bye.
Aleksey Barabanov <alekseybb at mail.ru>
--- ifmail v.2.15dev5.3
* Origin: home (2:5020/400)
Вернуться к списку тем, сортированных по: возрастание даты уменьшение даты тема автор
|
