IP tunnels - firewall kill when IP in IP packets

IP tunnels - firewall kill when IP in IP packets

by Tom Louis Demont -
Number of replies: 2

Hello,

This question is more about curiosity and not a top priority exam question (no problem if answered later). I was wondering: in slide 21 of ip2 slides, we are told that some firewalls kill the IP in IP packets. That's why we add a layer and put IP packet in UDP segment.

  1. I'm not sure I understand the firewall config rationale behind the killing of IP in IP packets. If this is trivially solved by putting IP in UDP, why firewalls are happier this way?
  2. Why is there the need for putting the L2TP/PPP header? It is said we must add a layer 2 protocol, but couldn't this one be added by the normal routing (frame read and replaced by routers from a subnet to another)?
Thanks!
In reply to Tom Louis Demont

Re: IP tunnels - firewall kill when IP in IP packets

by Jean-Yves Le Boudec -
1. Some NATs and firewalls are configured to exclude any IP protocol that is not UDP or TCP, perhpas by excessive simplicity.
2. The layer 2 protocol is added to carry information that is used by older systems (such as Windows) which use the alternative Ethernet format.