tech-net: Re: Non-IPSec Processing Point for ipf

Subject: Re: Non-IPSec Processing Point for ipf
To: Curt Sampson <cjs@cynic.net>
From: None <itojun@iijlab.net>
List: tech-net
Date: 04/18/2003 17:57:02

>> >If I have two IPSec links, one to network A/24 and one to network B/24,
>> >I need to block all source=A/24 packets that come in via the tunnel from
>> >B, and all source=B/24 packets that come in via the tunnel from A, because
>> >those packets are forged.
>> 	why not filter at the other end of the tunnel (tunnel egress point)?

	s/egress/ingress/

itojun