On Thursday 11 September 2008, bbee wrote:
quoted text
> Hi,
>
> I have a laptop that is connected via wifi to an OBSD router. The router
> has seperate subnets for the wired and wireless interfaces (ie, they are
> not bridged). I'd like to give the laptop an IP from the wired LAN, the
> goal being to eventually get failover to work with trunk(4).

Sure.

quoted text
> As per the "IPSEC BRIDGE" section in brconfig(8) I've set up host-to-host
> ipsec and a gif tunnel between the router and the laptop. Then on the
> router, I bridge the wired interface and the gif tunnel.

Yes.

quoted text
> tcpdump shows me the laptop is recieving etherip packets from the router,
> but ofcourse since it isn't a bridge itself it doesn't know what to do with
> them. How do I get the laptop to process these packets?
> What interface do I assign an IP address to? I've tried giving the gif
> tunnel an ipv6 address, but if I then use it to send data it will send
> protocol 41 (ipv6) encapsulated packets and not 97 (etherip).

I don't know where you going with this, if your tunnel is working you should 
be able to pass trafic on it. Bridging does not (usually|necessarily) involve 
any specific support in the other end of a bridged interface.

quoted text
> Bridging the wired and wireless interfaces directly (and then having the
> router do transparent IPSEC) would only solve part of the problem, since
> I'd like the laptop to be able to use its local IP address even if it's
> doing IPSEC to the router over the internet.
>
> How does one, in general, bridge only a single host to a LAN with an
> OpenBSD router? Help!!

You would probably like to trunk the wired and the wireless interfaces on the 
laptop, and since you're encapsulating the wireless trafic over a gif-tunnel 
you fail since you can't trunk gif-interfaces. Sorry.

Tun-interfaces are trunkable (or atleast I have read so) so that would be a 
way to accomplish this. However, it's a bit ironic that OpenBSDs fancy 
ipsec.conf and friends (and I say this with quite a lot of admiration for 
them) falls short in this sitation. One way to work-around this slight 
short-coming is setup OpenVPN, which (IIRC) binds to tun-interfaces. I have 
however not tested this.


And if someone knows how to setup a tun-tunnel in stock OpenBSD which does not 
involve PPP or something like that, I would like to hear about it. 

/Johan