- import of strongswan-2.7.0
- applied patch for charon
This commit is contained in:
Martin Willi
@@ -0,0 +1 @@
|
||||
eroute
|
||||
@@ -0,0 +1,52 @@
|
||||
# Makefile for the KLIPS interface utilities
|
||||
# Copyright (C) 1998, 1999 Henry Spencer.
|
||||
# Copyright (C) 1999, 2000, 2001 Richard Guy Briggs
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License as published by the
|
||||
# Free Software Foundation; either version 2 of the License, or (at your
|
||||
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# for more details.
|
||||
#
|
||||
# RCSID $Id: Makefile,v 1.1 2004/03/15 20:35:27 as Exp $
|
||||
|
||||
FREESWANSRCDIR=../..
|
||||
include ${FREESWANSRCDIR}/Makefile.inc
|
||||
|
||||
PROGRAM:=eroute
|
||||
EXTRA5PROC=eroute.5
|
||||
|
||||
LIBS:=${FREESWANLIB}
|
||||
|
||||
include ../Makefile.program
|
||||
|
||||
#
|
||||
# $Log: Makefile,v $
|
||||
# Revision 1.1 2004/03/15 20:35:27 as
|
||||
# added files from freeswan-2.04-x509-1.5.3
|
||||
#
|
||||
# Revision 1.4 2002/06/03 20:25:31 mcr
|
||||
# man page for files actually existant in /proc/net changed back to
|
||||
# ipsec_foo via new EXTRA5PROC process.
|
||||
#
|
||||
# Revision 1.3 2002/06/02 22:02:14 mcr
|
||||
# changed TOPDIR->FREESWANSRCDIR in all Makefiles.
|
||||
# (note that linux/net/ipsec/Makefile uses TOPDIR because this is the
|
||||
# kernel sense.)
|
||||
#
|
||||
# Revision 1.2 2002/04/26 01:21:26 mcr
|
||||
# while tracking down a missing (not installed) /etc/ipsec.conf,
|
||||
# MCR has decided that it is not okay for each program subdir to have
|
||||
# some subset (determined with -f) of possible files.
|
||||
# Each subdir that defines $PROGRAM, MUST have a PROGRAM.8 file as well as a PROGRAM file.
|
||||
# Optional PROGRAM.5 files have been added to the makefiles.
|
||||
#
|
||||
# Revision 1.1 2002/04/24 07:55:32 mcr
|
||||
# #include patches and Makefiles for post-reorg compilation.
|
||||
#
|
||||
#
|
||||
#
|
||||
@@ -0,0 +1,272 @@
|
||||
.TH IPSEC_EROUTE 5 "20 Sep 2001"
|
||||
.\"
|
||||
.\" RCSID $Id: eroute.5,v 1.1 2004/03/15 20:35:27 as Exp $
|
||||
.\"
|
||||
.SH NAME
|
||||
ipsec_eroute \- list of existing eroutes
|
||||
.SH SYNOPSIS
|
||||
.B ipsec
|
||||
.B eroute
|
||||
.PP
|
||||
.B cat
|
||||
.B /proc/net/ipsec_eroute
|
||||
.SH DESCRIPTION
|
||||
.I /proc/net/ipsec_eroute
|
||||
lists the IPSEC extended routing tables,
|
||||
which control what (if any) processing is applied
|
||||
to non-encrypted packets arriving for IPSEC processing and forwarding.
|
||||
At this point it is a read-only file.
|
||||
.PP
|
||||
A table entry consists of:
|
||||
.IP + 3
|
||||
packet count,
|
||||
.IP +
|
||||
source address with mask and source port (0 if all ports or not applicable)
|
||||
.IP +
|
||||
a '->' separator for visual and automated parsing between src and dst
|
||||
.IP +
|
||||
destination address with mask and destination port (0 if all ports or
|
||||
not applicable)
|
||||
.IP +
|
||||
a '=>' separator for visual and automated parsing between selection
|
||||
criteria and SAID to use
|
||||
.IP +
|
||||
SAID (Security Association IDentifier), comprised of:
|
||||
.IP + 6
|
||||
protocol
|
||||
(\fIproto\fR),
|
||||
.IP +
|
||||
address family
|
||||
(\fIaf\fR),
|
||||
where '.' stands for IPv4 and ':' for IPv6
|
||||
.IP +
|
||||
Security Parameters Index
|
||||
(\fISPI\fR),
|
||||
.IP +
|
||||
effective destination
|
||||
(\fIedst\fR),
|
||||
where the packet should be forwarded after processing
|
||||
(normally the other security gateway)
|
||||
together indicate which Security Association should be used to process
|
||||
the packet,
|
||||
.IP + 3
|
||||
a ':' separating the SAID from the transport protocol (0 if all protocols)
|
||||
.IP +
|
||||
source identity text string with no whitespace, in parens,
|
||||
.IP +
|
||||
destination identity text string with no whitespace, in parens
|
||||
.PP
|
||||
Addresses are written as IPv4 dotted quads or IPv6 coloned hex,
|
||||
protocol is one of "ah", "esp", "comp" or "tun"
|
||||
and
|
||||
SPIs are prefixed hexadecimal numbers where the prefix '.' is for IPv4 and the prefix ':' is for IPv6
|
||||
.
|
||||
.PP
|
||||
SAIDs are written as "protoafSPI@edst". There are also 5
|
||||
"magic" SAIDs which have special meaning:
|
||||
.IP + 3
|
||||
.B %drop
|
||||
means that matches are to be dropped
|
||||
.IP +
|
||||
.B %reject
|
||||
means that matches are to be dropped and an ICMP returned, if
|
||||
possible to inform
|
||||
.IP +
|
||||
.B %trap
|
||||
means that matches are to trigger an ACQUIRE message to the Key
|
||||
Management daemon(s) and a hold eroute will be put in place to
|
||||
prevent subsequent packets also triggering ACQUIRE messages.
|
||||
.IP +
|
||||
.B %hold
|
||||
means that matches are to stored until the eroute is replaced or
|
||||
until that eroute gets reaped
|
||||
.IP +
|
||||
.B %pass
|
||||
means that matches are to allowed to pass without IPSEC processing
|
||||
.br
|
||||
.ne 5
|
||||
.SH EXAMPLES
|
||||
.LP
|
||||
.B "1867 172.31.252.0/24:0 -> 0.0.0.0/0:0 => [email protected]:0 "
|
||||
.br
|
||||
.B " () ()"
|
||||
.LP
|
||||
means that 1,867 packets have been sent to an
|
||||
.BR eroute
|
||||
that has been set up to protect traffic between the subnet
|
||||
.BR 172.31.252.0
|
||||
with a subnet mask of
|
||||
.BR 24
|
||||
bits and the default address/mask represented by an address of
|
||||
.BR 0.0.0.0
|
||||
with a subnet mask of
|
||||
.BR 0
|
||||
bits using the local machine as a security gateway on this end of the
|
||||
tunnel and the machine
|
||||
.BR 192.168.43.1
|
||||
on the other end of the tunnel with a Security Association IDentifier of
|
||||
.BR [email protected]
|
||||
which means that it is a tunnel mode connection (4, IPPROTO_IPIP) with a
|
||||
Security Parameters Index of
|
||||
.BR 130
|
||||
in hexadecimal with no identies defined for either end.
|
||||
.LP
|
||||
.B "746 192.168.2.110/32:0 -> 192.168.2.120/32:25 => [email protected]:6 "
|
||||
.br
|
||||
.B " () ()"
|
||||
.LP
|
||||
means that 746 packets have been sent to an
|
||||
.BR eroute
|
||||
that has been set up to protect traffic sent from any port on the host
|
||||
.BR 192.168.2.110
|
||||
to the SMTP (TCP, port 25) port on the host
|
||||
.BR 192.168.2.120
|
||||
with a Security Association IDentifier of
|
||||
.BR [email protected]
|
||||
which means that it is a transport mode connection with a
|
||||
Security Parameters Index of
|
||||
.BR 130
|
||||
in hexadecimal with no identies defined for either end.
|
||||
.LP
|
||||
.B 125 3049:1::/64 -> 0:0/0 => tun:130@3058:4::5 () ()
|
||||
.LP
|
||||
means that 125 packets have been sent to an
|
||||
.BR eroute
|
||||
that has been set up to protect traffic between the subnet
|
||||
.BR 3049:1::
|
||||
with a subnet mask of
|
||||
.BR 64
|
||||
bits and the default address/mask represented by an address of
|
||||
.BR 0:0
|
||||
with a subnet mask of
|
||||
.BR 0
|
||||
bits using the local machine as a security gateway on this end of the
|
||||
tunnel and the machine
|
||||
.BR 3058:4::5
|
||||
on the other end of the tunnel with a Security Association IDentifier of
|
||||
.BR tun:130@3058:4::5
|
||||
which means that it is a tunnel mode connection with a
|
||||
Security Parameters Index of
|
||||
.BR 130
|
||||
in hexadecimal with no identies defined for either end.
|
||||
.LP
|
||||
.B 42 192.168.6.0/24:0 -> 192.168.7.0/24:0 => %passthrough
|
||||
.LP
|
||||
means that 42 packets have been sent to an
|
||||
.BR eroute
|
||||
that has been set up to pass the traffic from the subnet
|
||||
.BR 192.168.6.0
|
||||
with a subnet mask of
|
||||
.BR 24
|
||||
bits and to subnet
|
||||
.BR 192.168.7.0
|
||||
with a subnet mask of
|
||||
.BR 24
|
||||
bits without any IPSEC processing with no identies defined for either end.
|
||||
.LP
|
||||
.B 2112 192.168.8.55/32:0 -> 192.168.9.47/24:0 => %hold (east) ()
|
||||
.LP
|
||||
means that 2112 packets have been sent to an
|
||||
.BR eroute
|
||||
that has been set up to hold the traffic from the host
|
||||
.BR 192.168.8.55
|
||||
and to host
|
||||
.BR 192.168.9.47
|
||||
until a key exchange from a Key Management daemon
|
||||
succeeds and puts in an SA or fails and puts in a pass
|
||||
or drop eroute depending on the default configuration with the local client
|
||||
defined as "east" and no identy defined for the remote end.
|
||||
.LP
|
||||
.B "2001 192.168.2.110/32:0 -> 192.168.2.120/32:0 => "
|
||||
.br
|
||||
.B " [email protected]:0 () ()"
|
||||
.LP
|
||||
means that 2001 packets have been sent to an
|
||||
.BR eroute
|
||||
that has been set up to protect traffic between the host
|
||||
.BR 192.168.2.110
|
||||
and the host
|
||||
.BR 192.168.2.120
|
||||
using
|
||||
.BR 192.168.2.110
|
||||
as a security gateway on this end of the
|
||||
connection and the machine
|
||||
.BR 192.168.2.120
|
||||
on the other end of the connection with a Security Association IDentifier of
|
||||
.BR [email protected]
|
||||
which means that it is a transport mode connection with a Security
|
||||
Parameters Index of
|
||||
.BR e6de
|
||||
in hexadecimal using Encapsuation Security Payload protocol (50,
|
||||
IPPROTO_ESP) with no identies defined for either end.
|
||||
.LP
|
||||
.B "1984 3049:1::110/128 -> 3049:1::120/128 => "
|
||||
.br
|
||||
.B " ah:f5ed@3049:1::120 () ()"
|
||||
.LP
|
||||
means that 1984 packets have been sent to an
|
||||
.BR eroute
|
||||
that has been set up to authenticate traffic between the host
|
||||
.BR 3049:1::110
|
||||
and the host
|
||||
.BR 3049:1::120
|
||||
using
|
||||
.BR 3049:1::110
|
||||
as a security gateway on this end of the
|
||||
connection and the machine
|
||||
.BR 3049:1::120
|
||||
on the other end of the connection with a Security Association IDentifier of
|
||||
.BR ah:f5ed@3049:1::120
|
||||
which means that it is a transport mode connection with a Security
|
||||
Parameters Index of
|
||||
.BR f5ed
|
||||
in hexadecimal using Authentication Header protocol (51,
|
||||
IPPROTO_AH) with no identies defined for either end.
|
||||
.SH FILES
|
||||
/proc/net/ipsec_eroute, /usr/local/bin/ipsec
|
||||
.SH "SEE ALSO"
|
||||
ipsec(8), ipsec_manual(8), ipsec_tncfg(5), ipsec_spi(5),
|
||||
ipsec_spigrp(5), ipsec_klipsdebug(5), ipsec_eroute(8), ipsec_version(5),
|
||||
ipsec_pf_key(5)
|
||||
.SH HISTORY
|
||||
Written for the Linux FreeS/WAN project
|
||||
<http://www.freeswan.org/>
|
||||
by Richard Guy Briggs.
|
||||
.\"
|
||||
.\" $Log: eroute.5,v $
|
||||
.\" Revision 1.1 2004/03/15 20:35:27 as
|
||||
.\" added files from freeswan-2.04-x509-1.5.3
|
||||
.\"
|
||||
.\" Revision 1.9 2002/04/24 07:35:38 mcr
|
||||
.\" Moved from ./klips/utils/eroute.5,v
|
||||
.\"
|
||||
.\" Revision 1.8 2001/09/20 15:33:13 rgb
|
||||
.\" PF_KEYv2 ident extension output documentation.
|
||||
.\"
|
||||
.\" Revision 1.7 2001/05/29 05:15:31 rgb
|
||||
.\" Added packet count field at beginning of line.
|
||||
.\"
|
||||
.\" Revision 1.6 2001/02/26 19:58:32 rgb
|
||||
.\" Put SAID elements in order they appear in SAID.
|
||||
.\" Implement magic SAs %drop, %reject, %trap, %hold, %pass as part
|
||||
.\" of the new SPD and to support opportunistic.
|
||||
.\"
|
||||
.\" Revision 1.5 2000/09/17 18:56:48 rgb
|
||||
.\" Added IPCOMP support.
|
||||
.\"
|
||||
.\" Revision 1.4 2000/09/13 15:54:31 rgb
|
||||
.\" Added Gerhard's ipv6 updates.
|
||||
.\"
|
||||
.\" Revision 1.3 2000/06/30 18:21:55 rgb
|
||||
.\" Update SEE ALSO sections to include ipsec_version(5) and ipsec_pf_key(5)
|
||||
.\" and correct FILES sections to no longer refer to /dev/ipsec which has
|
||||
.\" been removed since PF_KEY does not use it.
|
||||
.\"
|
||||
.\" Revision 1.2 2000/06/28 12:44:11 henry
|
||||
.\" format touchup
|
||||
.\"
|
||||
.\" Revision 1.1 2000/06/28 05:43:00 rgb
|
||||
.\" Added manpages for all 5 klips utils.
|
||||
.\"
|
||||
.\"
|
||||
.\"
|
||||
@@ -0,0 +1,354 @@
|
||||
.TH IPSEC_EROUTE 8 "21 Jun 2000"
|
||||
.\"
|
||||
.\" RCSID $Id: eroute.8,v 1.1 2004/03/15 20:35:27 as Exp $
|
||||
.\"
|
||||
.SH NAME
|
||||
ipsec eroute \- manipulate IPSEC extended routing tables
|
||||
.SH SYNOPSIS
|
||||
.B ipsec
|
||||
.B eroute
|
||||
.PP
|
||||
.B ipsec
|
||||
.B eroute
|
||||
.B \-\-add
|
||||
.B \-\-eraf (inet | inet6)
|
||||
.B \-\-src
|
||||
src/srcmaskbits|srcmask
|
||||
.B \-\-dst
|
||||
dst/dstmaskbits|dstmask
|
||||
[
|
||||
.B \-\-transport\-proto
|
||||
transport-protocol
|
||||
]
|
||||
[
|
||||
.B \-\-src\-port
|
||||
source-port
|
||||
]
|
||||
[
|
||||
.B \-\-dst\-port
|
||||
dest-port
|
||||
]
|
||||
<SAID>
|
||||
.PP
|
||||
.B ipsec
|
||||
.B eroute
|
||||
.B \-\-replace
|
||||
.B \-\-eraf (inet | inet6)
|
||||
.B \-\-src
|
||||
src/srcmaskbits|srcmask
|
||||
.B \-\-dst
|
||||
dst/dstmaskbits|dstmask
|
||||
[
|
||||
.B \-\-transport\-proto
|
||||
transport-protocol
|
||||
]
|
||||
[
|
||||
.B \-\-src\-port
|
||||
source-port
|
||||
]
|
||||
[
|
||||
.B \-\-dst\-port
|
||||
dest-port
|
||||
]
|
||||
<SAID>
|
||||
.PP
|
||||
.B ipsec
|
||||
.B eroute
|
||||
.B \-\-del
|
||||
.B \-\-eraf (inet | inet6)
|
||||
.B \-\-src
|
||||
src/srcmaskbits|srcmask
|
||||
.B \-\-dst
|
||||
dst/dstmaskbits|dstmask
|
||||
[
|
||||
.B \-\-transport\-proto
|
||||
transport-protocol
|
||||
]
|
||||
[
|
||||
.B \-\-src\-port
|
||||
source-port
|
||||
]
|
||||
[
|
||||
.B \-\-dst\-port
|
||||
dest-port
|
||||
]
|
||||
.PP
|
||||
.B ipsec
|
||||
.B eroute
|
||||
.B \-\-clear
|
||||
.PP
|
||||
.B ipsec
|
||||
.B eroute
|
||||
.B \-\-help
|
||||
.PP
|
||||
.B ipsec
|
||||
.B eroute
|
||||
.B \-\-version
|
||||
.PP
|
||||
Where <SAID> is
|
||||
.B \-\-af
|
||||
(inet | inet6)
|
||||
.B \-\-edst
|
||||
edst
|
||||
.B \-\-spi
|
||||
spi
|
||||
.B \-\-proto
|
||||
proto
|
||||
OR
|
||||
.B \-\-said
|
||||
said
|
||||
OR
|
||||
.B \-\-said
|
||||
.B (%passthrough | %passthrough4 | %passthrough6 | %drop | %reject | %trap | %hold | %pass )
|
||||
.SH DESCRIPTION
|
||||
.I Eroute
|
||||
manages the IPSEC extended routing tables,
|
||||
which control what (if any) processing is applied
|
||||
to non-encrypted packets arriving for IPSEC processing and forwarding.
|
||||
The form with no additional arguments lists the contents of
|
||||
/proc/net/ipsec_eroute.
|
||||
The
|
||||
.B \-\-add
|
||||
form adds a table entry, the
|
||||
.B \-\-replace
|
||||
form replaces a table entry, while the
|
||||
.B \-\-del
|
||||
form deletes one. The
|
||||
.B \-\-clear
|
||||
form deletes the entire table.
|
||||
.PP
|
||||
A table entry consists of:
|
||||
.IP + 3
|
||||
source and destination addresses,
|
||||
with masks, source and destination ports and protocol
|
||||
for selection of packets. The source and destination ports are only
|
||||
legal if the transport protocol is
|
||||
.BR TCP
|
||||
or
|
||||
.BR UDP.
|
||||
A port can be specified as either decimal, hexadecimal (leading 0x),
|
||||
octal (leading 0) or a name listed in the first column of /etc/services.
|
||||
A transport protocol can be specified as either decimal, hexadecimal
|
||||
(leading 0x), octal (leading 0) or a name listed in the first column
|
||||
of /etc/protocols. If a transport protocol or port is not specified
|
||||
then it defaults to 0 which means all protocols or all ports
|
||||
respectively.
|
||||
.IP +
|
||||
Security Association IDentifier, comprised of:
|
||||
.IP + 6
|
||||
protocol
|
||||
(\fIproto\fR), indicating (together with the
|
||||
effective destination and the security parameters index)
|
||||
which Security Association should be used to process the packet
|
||||
.IP +
|
||||
address family
|
||||
(\fIaf\fR),
|
||||
.IP +
|
||||
Security Parameters Index
|
||||
(\fIspi\fR), indicating (together with the
|
||||
effective destination and protocol)
|
||||
which Security Association should be used to process the packet
|
||||
(must be larger than or equal to 0x100)
|
||||
.IP +
|
||||
effective destination
|
||||
(\fIedst\fR),
|
||||
where the packet should be forwarded after processing
|
||||
(normally the other security gateway)
|
||||
.IP + 3
|
||||
OR
|
||||
.IP + 6
|
||||
SAID
|
||||
(\fIsaid\fR), indicating
|
||||
which Security Association should be used to process the packet
|
||||
.PP
|
||||
Addresses are written as IPv4 dotted quads or IPv6 coloned hex,
|
||||
protocol is one of "ah", "esp", "comp" or "tun" and SPIs are
|
||||
prefixed hexadecimal numbers where '.' represents IPv4 and ':'
|
||||
stands for IPv6.
|
||||
.PP
|
||||
SAIDs are written as "protoafSPI@address". There are also 5
|
||||
"magic" SAIDs which have special meaning:
|
||||
.IP + 3
|
||||
.B %drop
|
||||
means that matches are to be dropped
|
||||
.IP +
|
||||
.B %reject
|
||||
means that matches are to be dropped and an ICMP returned, if
|
||||
possible to inform
|
||||
.IP +
|
||||
.B %trap
|
||||
means that matches are to trigger an ACQUIRE message to the Key
|
||||
Management daemon(s) and a hold eroute will be put in place to
|
||||
prevent subsequent packets also triggering ACQUIRE messages.
|
||||
.IP +
|
||||
.B %hold
|
||||
means that matches are to stored until the eroute is replaced or
|
||||
until that eroute gets reaped
|
||||
.IP +
|
||||
.B %pass
|
||||
means that matches are to allowed to pass without IPSEC processing
|
||||
.PP
|
||||
The format of /proc/net/ipsec_eroute is listed in ipsec_eroute(5).
|
||||
.br
|
||||
.ne 5
|
||||
.SH EXAMPLES
|
||||
.LP
|
||||
.B "ipsec eroute \-\-add \-\-eraf inet \-\-src 192.168.0.1/32 \e"
|
||||
.br
|
||||
.B " \-\-dst 192.168.2.0/24 \-\-af inet \-\-edst 192.168.0.2 \e"
|
||||
.br
|
||||
.B " \-\-spi 0x135 \-\-proto tun"
|
||||
.LP
|
||||
sets up an
|
||||
.BR eroute
|
||||
on a Security Gateway to protect traffic between the host
|
||||
.BR 192.168.0.1
|
||||
and the subnet
|
||||
.BR 192.168.2.0
|
||||
with
|
||||
.BR 24
|
||||
bits of subnet mask via Security Gateway
|
||||
.BR 192.168.0.2
|
||||
using the Security Association with address
|
||||
.BR 192.168.0.2 ,
|
||||
Security Parameters Index
|
||||
.BR 0x135
|
||||
and protocol
|
||||
.BR tun
|
||||
(50, IPPROTO_ESP).
|
||||
.LP
|
||||
.B "ipsec eroute \-\-add \-\-eraf inet6 \-\-src 3049:1::1/128 \e"
|
||||
.br
|
||||
.B " \-\-dst 3049:2::/64 \-\-af inet6 \-\-edst 3049:1::2 \e"
|
||||
.br
|
||||
.B " \-\-spi 0x145 \-\-proto tun"
|
||||
.LP
|
||||
sets up an
|
||||
.BR eroute
|
||||
on a Security Gateway to protect traffic between the host
|
||||
.BR 3049:1::1
|
||||
and the subnet
|
||||
.BR 3049:2::
|
||||
with
|
||||
.BR 64
|
||||
bits of subnet mask via Security Gateway
|
||||
.BR 3049:1::2
|
||||
using the Security Association with address
|
||||
.BR 3049:1::2 ,
|
||||
Security Parameters Index
|
||||
.BR 0x145
|
||||
and protocol
|
||||
.BR tun
|
||||
(50, IPPROTO_ESP).
|
||||
.LP
|
||||
.B "ipsec eroute \-\-replace \-\-eraf inet \-\-src company.com/24 \e"
|
||||
.br
|
||||
.B " \-\-dst ftp.ngo.org/32 \-\-said [email protected]"
|
||||
.LP
|
||||
replaces an
|
||||
.BR eroute
|
||||
on a Security Gateway to protect traffic between the subnet
|
||||
.BR company.com
|
||||
with
|
||||
.BR 24
|
||||
bits of subnet mask and the host
|
||||
.BR ftp.ngo.org
|
||||
via Security Gateway
|
||||
.BR gw.ngo.org
|
||||
using the Security Association with Security Association ID
|
||||
.BR [email protected]
|
||||
.LP
|
||||
.B "ipsec eroute \-\-del \-\-eraf inet \-\-src company.com/24 \e"
|
||||
.br
|
||||
.B " \-\-dst www.ietf.org/32 \-\-said %passthrough4"
|
||||
.LP
|
||||
deletes an
|
||||
.BR eroute
|
||||
on a Security Gateway that allowed traffic between the subnet
|
||||
.BR company.com
|
||||
with
|
||||
.BR 24
|
||||
bits of subnet mask and the host
|
||||
.BR www.ietf.org
|
||||
to pass in the clear, unprocessed.
|
||||
.LP
|
||||
.B "ipsec eroute \-\-add \-\-eraf inet \-\-src company.com/24 \e"
|
||||
.br
|
||||
.B " \-\-dst mail.ngo.org/32 \-\-transport-proto 6 \e"
|
||||
.br
|
||||
.B " \-\-dst\-port 110 \-\-said [email protected]"
|
||||
.LP
|
||||
sets up an
|
||||
.BR eroute
|
||||
on on a Security Gateway to protect only TCP traffic on port 110
|
||||
(pop3) between the subnet
|
||||
.BR company.com
|
||||
with
|
||||
.BR 24
|
||||
bits of subnet mask and the host
|
||||
.BR ftp.ngo.org
|
||||
via Security Gateway
|
||||
.BR mail.ngo.org
|
||||
using the Security Association with Security Association ID
|
||||
.BR [email protected].
|
||||
Note that any other traffic bound for
|
||||
.BR mail.ngo.org
|
||||
that is routed via the ipsec device will be dropped. If you wish to
|
||||
allow other traffic to pass through then you must add a %pass rule.
|
||||
For example the following rule when combined with the above will
|
||||
ensure that POP3 messages read from
|
||||
.BR mail.ngo.org
|
||||
will be encrypted but all other traffic to/from
|
||||
.BR mail.ngo.org
|
||||
will be in clear text.
|
||||
.LP
|
||||
.B "ipsec eroute \-\-add \-\-eraf inet \-\-src company.com/24 \e"
|
||||
.br
|
||||
.B " \-\-dst mail.ngo.org/32 \-\-said %pass"
|
||||
.br
|
||||
.LP
|
||||
.SH FILES
|
||||
/proc/net/ipsec_eroute, /usr/local/bin/ipsec
|
||||
.SH "SEE ALSO"
|
||||
ipsec(8), ipsec_manual(8), ipsec_tncfg(8), ipsec_spi(8),
|
||||
ipsec_spigrp(8), ipsec_klipsdebug(8), ipsec_eroute(5)
|
||||
.SH HISTORY
|
||||
Written for the Linux FreeS/WAN project
|
||||
<http://www.freeswan.org/>
|
||||
by Richard Guy Briggs.
|
||||
.\"
|
||||
.\" $Log: eroute.8,v $
|
||||
.\" Revision 1.1 2004/03/15 20:35:27 as
|
||||
.\" added files from freeswan-2.04-x509-1.5.3
|
||||
.\"
|
||||
.\" Revision 1.25 2002/04/24 07:35:38 mcr
|
||||
.\" Moved from ./klips/utils/eroute.8,v
|
||||
.\"
|
||||
.\" Revision 1.24 2001/02/26 19:58:49 rgb
|
||||
.\" Added a comment on the restriction of spi > 0x100.
|
||||
.\" Implement magic SAs %drop, %reject, %trap, %hold, %pass as part
|
||||
.\" of the new SPD and to support opportunistic.
|
||||
.\"
|
||||
.\" Revision 1.23 2000/09/17 18:56:48 rgb
|
||||
.\" Added IPCOMP support.
|
||||
.\"
|
||||
.\" Revision 1.22 2000/09/13 15:54:31 rgb
|
||||
.\" Added Gerhard's ipv6 updates.
|
||||
.\"
|
||||
.\" Revision 1.21 2000/06/30 18:21:55 rgb
|
||||
.\" Update SEE ALSO sections to include ipsec_version(5) and ipsec_pf_key(5)
|
||||
.\" and correct FILES sections to no longer refer to /dev/ipsec which has
|
||||
.\" been removed since PF_KEY does not use it.
|
||||
.\"
|
||||
.\" Revision 1.20 2000/06/21 16:54:57 rgb
|
||||
.\" Added 'no additional args' text for listing contents of
|
||||
.\" /proc/net/ipsec_* files.
|
||||
.\"
|
||||
.\" Revision 1.19 1999/07/19 18:47:24 henry
|
||||
.\" fix slightly-misformed comments
|
||||
.\"
|
||||
.\" Revision 1.18 1999/04/06 04:54:37 rgb
|
||||
.\" Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
|
||||
.\" patch shell fixes.
|
||||
.\"
|
||||
.\"
|
||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user