Subject: Re: ProxyARP and IPSec

From: "H. Peter Anvin" <[email-masked]>
Date: Wed, 23 Aug 2006 21:14:15 -0700

Andy Gay wrote:
>>>>
>>> Just tried it, and it works as advertised.
>>>
>> ... except that OpenSwan will rip out the route and install a route 
>> pointing to eth0, thus breaking the thing again.
> 
> Use a custom updown script with Openswan to fix that.
> 

*Nod.*

I'm thinking that David definitely has a point about having a usability 
problem, though.  All other kind of tunnels have endpoint devices 
associated with them, and that would make all these kinds of problems go 
away, plus would be nicer to deal with in iptables, dealing with routed 
IPsec connections, etc.

	-hpa