enabled firewall support

testing/tests/ikev2/rw-cert/description.txt

@@ -1,4 +1,6 @@
-The roadwarriors <b>carol</b> and <b>dave</b> set up a connection to gateway <b>moon</b>.
-The authentication is based on <b>X.509 certificates</b>.
-In order to test both tunnel and firewall, <b>carol</b> and <b>dave</b> ping the client
-<b>alice</b> behind the gateway <b>moon</b>.
+The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each 
+to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>.
+Upon the successful establishment of the IPsec tunnels, <b>leftfirewall=yes</b>
+automatically inserts iptables-based firewall rules that let pass the tunneled traffic.
+In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping
+the client <b>alice</b> behind the gateway <b>moon</b>.

testing/tests/ikev2/rw-cert/hosts/carol/etc/ipsec.conf

@@ -15,6 +15,7 @@ conn home
 	leftnexthop=%direct
 	leftcert=carolCert.pem
 	[email protected]
+	leftfirewall=yes
 	right=PH_IP_MOON
 	[email protected]
 	rightsubnet=10.1.0.0/16

testing/tests/ikev2/rw-cert/hosts/dave/etc/ipsec.conf

@@ -15,6 +15,7 @@ conn home
 	leftnexthop=%direct
 	leftcert=daveCert.pem
 	[email protected]
+	leftfirewall=yes
 	right=PH_IP_MOON
 	[email protected]
 	rightsubnet=10.1.0.0/16

testing/tests/ikev2/rw-cert/hosts/moon/etc/ipsec.conf

@@ -16,6 +16,7 @@ conn rw
 	leftcert=moonCert.pem
 	[email protected]
 	leftsubnet=10.1.0.0/16
+	leftfirewall=yes
 	right=%any
 	keyexchange=ikev2
 	auto=add

testing/tests/ikev2/rw-cert/posttest.dat

@@ -1,6 +1,12 @@
+moon::iptables -v -n -L
+carol::iptables -v -n -L
+dave::iptables -v -n -L
 moon::ipsec stop
 carol::ipsec stop
 dave::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+dave::/etc/init.d/iptables stop 2> /dev/null
 moon::rm /etc/ipsec.d/crls/*
 carol::rm /etc/ipsec.d/crls/*
 dave::rm /etc/ipsec.d/crls/*

testing/tests/ikev2/rw-cert/pretest.dat

@@ -1,4 +1,6 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+moon::/etc/init.d/iptables start 2> /dev/null
+carol::/etc/init.d/iptables start 2> /dev/null
+dave::/etc/init.d/iptables start 2> /dev/null
 moon::wget -q http://crl.strongswan.org/strongswan.crl -O /etc/ipsec.d/crls/strongswan.crl
 carol::wget -q http://crl.strongswan.org/strongswan.crl -O /etc/ipsec.d/crls/strongswan.crl
 dave::wget -q http://crl.strongswan.org/strongswan.crl -O /etc/ipsec.d/crls/strongswan.crl