Re: ip6tables: accept of IPv6 transport esp packages not possible - no rule matches

[Patrick McHardy <kaber@xxxxxxxxx>]

Peter Bieringer wrote:

> > > BTW: how to filter incoming traffic after decryption?
> > Use tunnel-mode. The decrypted packets will hit PRE_ROUTING
> > and LOCAL_IN again.
> Ok, confirmed working in tunnel mode, ping6 packet was counted twice in
> different rules (esp and icmpv6)
>
> But for outgoing ping6 packets, this won't work, packet is only counted
> (and accepted) by the icmpv6 rule, esp rule got no match, also not the
> "all" rule.
>
> Looks like at the moment, outgoing packet is passing netfilter only one
> time, even if encryption is in tunnel mode.
That is correct.

> By design / bug / missing feature?
By design and missing feature :) As I said, patches to fix this for
IPv4 will be submitted this week .. IPv6 will hopefully follow soon.

Regards
Patrick