Subject: Re: [netfilter-core] [NETFILTER] Apply IPsec to ipt_REJECT packets

From: Patrick McHardy <[email-masked]>
Date: Tue, 23 Nov 2004 19:17:36 +0100

Herbert Xu wrote:

>Hi:
>
>I found out today that packets generated by ipt_REJECT weren't protected
>by IPsec.  This is because the proto field isn't set at all in the flow
>supplied to ip_route_output_key.
>
>The following patch sets that as well as protocol-specific fields so
>that the appropriate IPsec policy can be applied.
>  
>

The patch doesn't handle tcp resets sent in response to a forwarded packet.
I'll send a patch later tonight.

Regards
Patrick