use static IPsec policy netfilter rules in MOBIKE scenarios

testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/init.d/iptables

@@ -17,6 +17,10 @@ start() {
 	/sbin/iptables -P OUTPUT DROP
 	/sbin/iptables -P FORWARD DROP
 
+        # allow IPsec tunnel traffic
+        iptables -A INPUT  -m policy --dir in  --pol ipsec --proto esp -j ACCEPT
+        iptables -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
+
 	# allow esp
 	iptables -A INPUT  -i eth0 -p 50 -j ACCEPT
 	iptables -A INPUT  -i eth1 -p 50 -j ACCEPT

testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/ipsec.conf

@@ -17,7 +17,6 @@ conn mobike
 	leftsourceip=%config
 	leftcert=aliceCert.pem
 	[email protected]
-	leftfirewall=yes
 	right=PH_IP_SUN
 	[email protected]
 	rightsubnet=10.2.0.0/16

testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink updown
+  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink
 }