remove ikev2/nat-pf scenario
This commit is contained in:
@@ -1,4 +0,0 @@
|
|||||||
The roadwarrior <b>carol</b> sets up a connection to host <b>alice</b> sitting behind the NAT router <b>moon</b>
|
|
||||||
using IKEv2. Port Forwarding is used to publish host <b>alice</b>. UDP encapsulation is used to traverse the NAT router.
|
|
||||||
The authentication is based on locally loaded <b>X.509 certificates</b>.
|
|
||||||
In order to test the tunnel the roadwarrior <b>carol</b> pings the host <b>alice</b>.
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
alice::ipsec statusall::rw-carol.*ESTABLISHED::YES
|
|
||||||
carol::ipsec statusall::home.*ESTABLISHED::YES
|
|
||||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
|
|
||||||
moon::tcpdumpcount::IP carol.strongswan.org.* > moon.strongswan.org.ipsec-nat-t: UDP::2
|
|
||||||
moon::tcpdumpcount::IP moon.strongswan.org.ipsec-nat-t > carol.strongswan.org.*: UDP::2
|
|
||||||
@@ -1,19 +0,0 @@
|
|||||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
|
||||||
|
|
||||||
version 2.0 # conforms to second version of ipsec.conf specification
|
|
||||||
|
|
||||||
config setup
|
|
||||||
plutostart=no
|
|
||||||
|
|
||||||
conn %default
|
|
||||||
left=PH_IP_ALICE
|
|
||||||
leftcert=aliceCert.pem
|
|
||||||
[email protected]
|
|
||||||
leftsubnet=10.1.0.10/32
|
|
||||||
keyexchange=ikev2
|
|
||||||
|
|
||||||
conn rw-carol
|
|
||||||
right=%any
|
|
||||||
rightcert=carolCert.pem
|
|
||||||
[email protected]
|
|
||||||
auto=add
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIEIjCCAwqgAwIBAgIBCjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
|
||||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
|
||||||
b290IENBMB4XDTA1MDEwMTIxNDMxOFoXDTA5MTIzMTIxNDMxOFowWjELMAkGA1UE
|
|
||||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh
|
|
||||||
cmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcN
|
|
||||||
AQEBBQADggEPADCCAQoCggEBALgbhJIECOCGyNJ4060un/wBuJ6MQjthK5CAEPgX
|
|
||||||
T/lvZynoSxhfuW5geDCCxQes6dZPeb6wJS4F5fH3qJoLM+Z4n13rZlCEyyMBkcFl
|
|
||||||
vK0aNFY+ARs0m7arUX8B7Pfi9N6WHTYgO4XpeBHLJrZQz9AU0V3S0rce/WVuVjii
|
|
||||||
S/cJhrgSi7rl87Qo1jYOA9P06BZQLj0dFNcWWrGpKp/hXvBF1OSP9b15jsgMlCCW
|
|
||||||
LJqXmLVKDtKgDPLJZR19mILhgcHvaxxD7craL9GR4QmWLb0m84oAIIwaw+0npZJM
|
|
||||||
YDMMeYeOtcepCWCmRy+XmsqcWu4rtNCu05W1RsXjYZEKBjcCAwEAAaOCAQYwggEC
|
|
||||||
MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRVNeym66J5uu+IfxhD
|
|
||||||
j9InsWdG0TBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTEL
|
|
||||||
MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT
|
|
||||||
EnN0cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRjYXJvbEBzdHJvbmdz
|
|
||||||
d2FuLm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4u
|
|
||||||
b3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQCxMEp+Zdclc0aI
|
|
||||||
U+jO3TmL81gcwea0BUucjZfDyvCSkDXcXidOez+l/vUueGC7Bqq1ukDF8cpVgGtM
|
|
||||||
2HPxM97ZSLPInMgWIeLq3uX8iTtIo05EYqRasJxBIAkY9o6ja6v6z0CZqjSbi2WE
|
|
||||||
HrHkFrkOTrRi7deGzbAAhWVjOnAfzSxBaujkdUxb6jGBc2F5qpAeVSbE+sAxzmSd
|
|
||||||
hRyF3tUUwl4yabBzmoedJzlQ4anqg0G14QScBxgXkq032gKuzNVVxWRp6OFannKG
|
|
||||||
C1INvsBWYtN62wjXlXXhM/M4sBFhmPpftVb+Amgr1jSspTX2dQsNqhI/WtNvLmfK
|
|
||||||
omBYfxqp
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
@@ -1,17 +0,0 @@
|
|||||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
|
||||||
|
|
||||||
version 2.0 # conforms to second version of ipsec.conf specification
|
|
||||||
|
|
||||||
config setup
|
|
||||||
plutostart=no
|
|
||||||
|
|
||||||
conn home
|
|
||||||
left=PH_IP_CAROL
|
|
||||||
leftcert=carolCert.pem
|
|
||||||
[email protected]
|
|
||||||
right=PH_IP_MOON
|
|
||||||
rightcert=aliceCert.pem
|
|
||||||
[email protected]
|
|
||||||
rightsubnet=10.1.0.0/24
|
|
||||||
keyexchange=ikev2
|
|
||||||
auto=add
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIEHzCCAwegAwIBAgIBBTANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
|
||||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
|
||||||
b290IENBMB4XDTA0MDkxMDExMjQzOVoXDTA5MDkwOTExMjQzOVowVzELMAkGA1UE
|
|
||||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsTBVNhbGVz
|
|
||||||
MR0wGwYDVQQDFBRhbGljZUBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEB
|
|
||||||
BQADggEPADCCAQoCggEBAK7FyvkE18/oujCaTd8GXBNOH+Cvoy0ibJ8j2sNsBrer
|
|
||||||
GS1lgxRs8zaVfK9fosadu0UZeWIHsOKkew5469sPvkKK2SGGH+pu+x+xO/vuaEG4
|
|
||||||
FlkAu8iGFWLQycLt6BJfcqw7FT8rwNuD18XXBXmP7hRavi/TEElbVYHbO7lm8T5W
|
|
||||||
6hTr/sYddiSB7X9/ba7JBy6lxmBcUAx5bjiiHLaW/llefkqyhc6dw5nvPZ2DchvH
|
|
||||||
v/HWvLF9bsvxbBkHU0/z/CEsRuMBI7EPEL4rx3UqmuCUAqiMJTS3IrDaIlfJOLWc
|
|
||||||
KlbsnE6hHpwmt9oDB9iWBY9WeZUSAtJGFw4b7FCZvQ0CAwEAAaOCAQYwggECMAkG
|
|
||||||
A1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRZmh0JtiNTjBsQsfD7ECNa
|
|
||||||
60iG2jBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkG
|
|
||||||
A1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0
|
|
||||||
cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRhbGljZUBzdHJvbmdzd2Fu
|
|
||||||
Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn
|
|
||||||
L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQADdQIlJkFtmHEjtuyo
|
|
||||||
2aIcrsUx98FtvVgB7RpQB8JZlly7UEjvX0CIIvW/7Al5/8h9s1rhrRffX7nXQKAQ
|
|
||||||
AmPnvD2Pp47obDnHqm/L109S1fcL5BiPN1AlgsseUBwzdqBpyRncPXZoAuBh/BU5
|
|
||||||
D/1Dip0hXgB/X6+QymSzRJoSKfpeXVICj1kYH1nIkn0YXthYF3BTrCheCzBlKn0S
|
|
||||||
CixbCUYsUjtSqld0nG76jyGb/gnWntNettH+RXWe1gm6qREJwfEFdeYviTqx2Uxi
|
|
||||||
6sBKG/XjNAcMArXb7V6w0YAwCyjwCl49B+mLZaFH+9izzBJ7NyVqhH8ToB1gt0re
|
|
||||||
JGhV
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
carol::ipsec stop
|
|
||||||
alice::ipsec stop
|
|
||||||
carol::rm /etc/ipsec.d/certs/*
|
|
||||||
alice::rm /etc/ipsec.d/certs/*
|
|
||||||
moon::iptables -t nat -F
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
moon::echo 1 > /proc/sys/net/ipv4/ip_forward
|
|
||||||
moon::iptables -m multiport -t nat -A PREROUTING -i eth0 -p udp --dports 500,4500 -j DNAT --to 10.1.0.10
|
|
||||||
alice::ipsec start
|
|
||||||
carol::ipsec start
|
|
||||||
carol::sleep 1
|
|
||||||
carol::ipsec up home
|
|
||||||
carol::sleep 1
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
#
|
|
||||||
# This configuration file provides information on the
|
|
||||||
# UML instances used for this test
|
|
||||||
|
|
||||||
# All UML instances that are required for this test
|
|
||||||
#
|
|
||||||
UMLHOSTS="alice moon carol winnetou"
|
|
||||||
|
|
||||||
# Corresponding block diagram
|
|
||||||
#
|
|
||||||
DIAGRAM="a-m-c-w.png"
|
|
||||||
|
|
||||||
# UML instances on which tcpdump is to be started
|
|
||||||
#
|
|
||||||
TCPDUMPHOSTS="moon"
|
|
||||||
|
|
||||||
# UML instances on which IPsec is started
|
|
||||||
# Used for IPsec logging purposes
|
|
||||||
#
|
|
||||||
IPSECHOSTS="alice carol"
|
|
||||||
Reference in New Issue
Block a user