Re: [PATCH] ipsec: Add block rules to avoid conntrack entries

[Michael Tremer <michael.tremer@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 1168 bytes --]

On Sun, 2015-10-04 at 12:25 -0400, Tom Rymes wrote:
> On 10/03/2015 5:31 PM, Michael Tremer wrote:
> > If an IPsec VPN connections is not established, there are
> > rare cases when packets are supposed to be sent through
> > that said tunnel and incorrectly handled.
> 
> Michael, et. al.:
> 
> I just posted a comment on the bug before I realized that e-mail
> would 
> be more appropriate.
> 
> My apologies for not being up to speed on this, but can you hold my
> hand 
> on implementing this? I am simply not confident enough to apply these
> changes without a better understanding of what I am doing.

You got this already applied (at least the bare essence of that). I
think we should wait for someone else to confirm that this is not
crashing anything :)

Since I emailed this patch I am still wondering if we should not limit
this rule to the RED interface. We didn't do that when we tried all
this on one of your machines (
https://bugzilla.ipfire.org/show_bug.cgi?id=10908#c16). It is an easier
solution, but I am wondering if that does not have any side-effects...

@Timo: You should use the Reviewed-by: tag then.

Best,
-Michael

> 
> Thank you,
> 
> Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]