<html dir="ltr"><head></head><body style="text-align:left; direction:ltr;"><div>Hi Paul,</div><div><br></div><div>I might be able to write up a howto at some point however I'm still stumbling over a few issues. </div><div>For instance on shutdown the automount NFS mounts are being unmounted after the IPSEC tunnel terminates. I've tried the _netdev however this appears to do very little. </div><div>Also having automount home directories makes firefox very slow to start. The existing environment variable fixes don't appear to do much in this regards however something like fs-cache might help. However this requires systemd to do it's job well.</div><div><br></div><div>There's also a few selinux bugs/configuration issues which are floating around as well in centos8</div><div><br></div><div>On a more positive note libreswan with a few tweaks appears to be very solid.</div><div><br></div><div><br></div><div>Kind Regards</div><div><br></div><div>-----Original Message-----</div><div><b>From</b>: Paul Wouters <<a href="mailto:Paul%20Wouters%20%3cpaul@nohats.ca%3e">paul@nohats.ca</a>></div><div><b>To</b>: Ian Willis <<a href="mailto:Ian%20Willis%20%3cian@checksum.net.au%3e">ian@checksum.net.au</a>></div><div><b>Cc</b>: <a href="mailto:swan@lists.libreswan.org">swan@lists.libreswan.org</a></div><div><b>Subject</b>: Re: [Swan] Firewalld libreswan centos8</div><div><b>Date</b>: Mon, 30 Dec 2019 21:48:23 -0500 (EST)</div><div><br></div><pre>On Tue, 31 Dec 2019, Ian Willis wrote:</pre><pre><br></pre><pre></pre><pre>Doing a tcpdump on the outbound interface on the client shows a mix of IPSEC and ICMP packeting during the ping tests which initially</pre><pre>confused me but appears to be normal.</pre><pre></pre><pre><br></pre><pre>It is, unless you are doing XFRMi interfaces (arriving soon) or VTI</pre><pre>interfaces (obsoleted soon). The problem is that tcpdump "sees" the</pre><pre>packet before encryption and not after encryption, and for incoming</pre><pre>packets sees it twice - before and after encryption. Once a virtual</pre><pre>interface is used, these two streams properly split between virtual</pre><pre>and physical interface.</pre><pre><br></pre><pre></pre><pre>I suspect that I need to work on the packets from a postrouting perspective as the incoming packets aren't visible. I suspect that</pre><pre>firewalld is more of a machine based firewall rather than a firewall proper, so my expectations may be a little high.</pre><pre></pre><pre><br></pre><pre>Right.</pre><pre><br></pre><pre></pre><pre>On the bright side, I now have clients machines joining a private freeipa kerberos domain via an ipsec tunnel.</pre><pre></pre><pre><br></pre><pre>Do you have any documentation on this you could share with us? I'd love</pre><pre>to have a HOWTO written up for this!</pre><pre><br></pre><pre>Paul</pre><pre><br></pre></body></html>