Subject: Re: ip6tables: accept of IPv6 transport esp packages not possible - no rule matches

From: Patrick McHardy <[email-masked]>
Date: Sun, 02 Jan 2005 22:14:56 +0100

Peter Bieringer wrote:

>>>BTW: how to filter incoming traffic after decryption?
>>>
>>Use tunnel-mode. The decrypted packets will hit PRE_ROUTING
>>and LOCAL_IN again.
>>
>
>Ok, confirmed working in tunnel mode, ping6 packet was counted twice in
>different rules (esp and icmpv6)
>
>But for outgoing ping6 packets, this won't work, packet is only counted
>(and accepted) by the icmpv6 rule, esp rule got no match, also not the
>"all" rule.
>
>Looks like at the moment, outgoing packet is passing netfilter only one
>time, even if encryption is in tunnel mode.
>
That is correct.

>
>By design / bug / missing feature?
>
By design and missing feature :) As I said, patches to fix this for
IPv4 will be submitted this week .. IPv6 will hopefully follow soon.

Regards
Patrick