New answers tagged

2

Assuming that you mean "can host X, which terminates the IPSec tunnel, apply iptables filters to the de-tunneled traffic?" then the answer is yes. Here's a Server Fault Q&A on this exact topic - With iptables, match packets arrived via IPSEC tunnel - which states You need to use the policy module, and specify the ipsec policy, to match this ...


1

For the answer to this check out RFC 2104, em mine: A well-known practice with message authentication codes is to truncate the output of the MAC and output only part of the bits (e.g., [MM, ANSI]). Preneel and van Oorschot [PV] show some analytical advantages of truncating the output of hash-based MAC functions. The results in this area are not ...


0

First, quit using FTP entirely. The most common choice is to use SFTP instead Disable weak cipher suites like ones using RC4. There are other hardening steps you can take as well. The next common choice is to use FTPS instead. Disable weak cipher suites like ones using RC4. There are other hardening steps you can take as well. If you would like, you ...


1

Both will do what you need effectively. Whether you need to use one over the other depends on your use case. From what you have described, as long as there aren't other requirements, I'd go with TLS, as it requires very little additional work on most network architectures. IPSec is just a little more convoluted to set up - but it does provide additional ...


1

To elaborate more on Milen's answer, if you have no routing issues, then Transport mode is certainly feasible whether it's 2 gateways talking to each-other, or even 2 hosts talking to each-other (not doing IPsec). For example, if you had 2 public DMZ servers talking via Telnet over the Internet to each-other, and deeper in the network 2 IPsec routers were ...


0

In my experience, and in EXTREMELY rare cases, I have found a provider or some hop between endpoints that blocks ESP (IP protocol 50). A tunnel successfully establishes, but no traffic gets through. When I see this happen and rule out standard probable causes, I look to AH. I've used AH to 'prove' that to providers to get them to at least check their end. ...



Top 50 recent answers are included