enabled firewall support

2006-09-18 07:41:54 +00:00
parent f9aa9e2977
commit 957115957a
36 changed files with 94 additions and 32 deletions
@@ -1,4 +1,6 @@
 A connection between the subnets behind the gateways <b>moon</b> and <b>sun</b> is set up.
-The authentication is based on <b>X.509 certificates</b>.
+The authentication is based on <b>X.509 certificates</b>. Upon the successful
+establishment of the IPsec tunnel, <b>leftfirewall=yes</b> automatically
+inserts iptables-based firewall rules that let pass the tunneled traffic.
 In order to test both tunnel and firewall, client <b>alice</b> behind gateway <b>moon</b>
 pings client <b>bob</b> located behind gateway <b>sun</b>.
@@ -9,14 +9,15 @@ conn %default
 	keylife=20m
 	rekeymargin=3m
 	keyingtries=1
-	
+	keyexchange=ikev2
+
 conn net-net 
 	left=PH_IP_MOON
 	leftcert=moonCert.pem
 	[email protected]
 	leftsubnet=10.1.0.0/16
+	leftfirewall=yes
 	right=PH_IP_SUN
 	[email protected]
 	rightsubnet=10.2.0.0/16
-	keyexchange=ikev2
 	auto=add
@@ -9,14 +9,15 @@ conn %default
 	keylife=20m
 	rekeymargin=3m
        keyingtries=1
+	keyexchange=ikev2

 conn net-net 
 	left=PH_IP_SUN
 	leftcert=sunCert.pem
 	[email protected]
 	leftsubnet=10.2.0.0/16
+	leftfirewall=yes
 	right=PH_IP_MOON
 	[email protected]
 	rightsubnet=10.1.0.0/16
-	keyexchange=ikev2
 	auto=add
@@ -1,5 +1,9 @@
+moon::iptables -v -n -L
+sun::iptables -v -n -L
 moon::ipsec stop
 sun::ipsec stop
-sun::rm /etc/ipsec.d/crls/*
+moon::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null
 moon::rm /etc/ipsec.d/crls/*
+sun::rm /etc/ipsec.d/crls/*

@@ -1,5 +1,5 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
-sun::echo 1 > /proc/sys/net/ipv4/ip_forward
+moon::/etc/init.d/iptables start 2> /dev/null
+sun::/etc/init.d/iptables start 2> /dev/null
 moon::wget -q http://crl.strongswan.org/strongswan.crl -O /etc/ipsec.d/crls/strongswan.crl
 sun::wget -q http://crl.strongswan.org/strongswan.crl -O /etc/ipsec.d/crls/strongswan.crl
 moon::ipsec start