use static IPsec policy iptables rule for alice in mobike scenario

2008-11-25 08:11:14 +00:00
parent f1f09810fb
commit 895a1156d5
2 changed files with 4 additions and 1 deletions
@@ -17,6 +17,10 @@ start() {
 	/sbin/iptables -P OUTPUT DROP
 	/sbin/iptables -P FORWARD DROP

+        # allow IPsec tunnel traffic
+        iptables -A INPUT  -m policy --dir in  --pol ipsec --proto esp -j ACCEPT
+        iptables -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
+
 	# allow esp
 	iptables -A INPUT  -i eth0 -p 50 -j ACCEPT
 	iptables -A INPUT  -i eth1 -p 50 -j ACCEPT
@@ -16,7 +16,6 @@ conn mobike
 	left=PH_IP_ALICE1
 	leftcert=aliceCert.pem
 	[email protected]
-	leftfirewall=yes
 	right=PH_IP_SUN
 	[email protected]
 	rightsubnet=10.2.0.0/16