denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Speed up ifdown calls in ikev2/mobike scenarios

Browse Source 
ifdown calls bind's rndc, which tries to access TCP port 953 on lo.
If these packets are dropped by the firewall we have to wait for the TCP
connections to time out, which takes quite a while.
This commit is contained in:
Tobias Brunner
2015-11-09 15:18:35 +01:00
parent cbaafa03c7
commit 0ee4a333a8
3 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/mobike-nat/hosts/alice/etc/iptables.rules
+5 -1
View File
@@ -5,11 +5,15 @@
-P OUTPUT DROP -P OUTPUT DROP
-P FORWARD DROP -P FORWARD DROP
# allow traffic on lo as ifup/ifdown call bind's rndc which accesses TCP 953
-A OUTPUT -o lo -j ACCEPT
-A INPUT -i lo -j ACCEPT
# allow IPsec tunnel traffic # allow IPsec tunnel traffic
-A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT -A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT
-A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
# allow ESP # allow ESP
-A INPUT -i eth0 -p 50 -j ACCEPT -A INPUT -i eth0 -p 50 -j ACCEPT
-A INPUT -i eth1 -p 50 -j ACCEPT -A INPUT -i eth1 -p 50 -j ACCEPT
-A OUTPUT -o eth0 -p 50 -j ACCEPT -A OUTPUT -o eth0 -p 50 -j ACCEPT
testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/iptables.rules
+4
View File
@@ -5,6 +5,10 @@
-P OUTPUT DROP -P OUTPUT DROP
-P FORWARD DROP -P FORWARD DROP
# allow traffic on lo as ifup/ifdown call bind's rndc which accesses TCP 953
-A OUTPUT -o lo -j ACCEPT
-A INPUT -i lo -j ACCEPT
# allow IPsec tunnel traffic # allow IPsec tunnel traffic
-A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT -A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT
-A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
testing/tests/ikev2/mobike/hosts/alice/etc/iptables.rules
+4
View File
@@ -5,6 +5,10 @@
-P OUTPUT DROP -P OUTPUT DROP
-P FORWARD DROP -P FORWARD DROP
# allow traffic on lo as ifup/ifdown call bind's rndc which accesses TCP 953
-A OUTPUT -o lo -j ACCEPT
-A INPUT -i lo -j ACCEPT
# allow IPsec tunnel traffic # allow IPsec tunnel traffic
-A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT -A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT
-A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT