denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

upgraded ikev2 scenarios to 5.0.0

Browse Source
This commit is contained in:
Andreas Steffen
2012-05-11 11:00:32 +02:00
parent 0e1c6fa2a9
commit a56fdff194
475 changed files with 1161 additions and 1704 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/nat-rw-mark/description.txt
+16
View File
@@ -0,0 +1,16 @@
The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> set up
tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router.
Since both roadwarriors possess the same 10.1.0.0/25 subnet, gateway <b>sun</b> uses Source NAT
after ESP decryption to map these subnets to 10.3.0.10 and 10.3.0.20, respectively.
<p/>
In order to differentiate between the tunnels to <b>alice</b> and <b>venus</b>, respectively,
<b>XFRM marks</b> are defined for both the inbound and outbound IPsec SAs and policies using
the <b>mark</b> parameter in ipsec.conf.
<p/>
<b>iptables -t mangle</b> rules are then used in the PREROUTING chain to mark the traffic to
and from <b>alice</b> and <b>venus</b>, respectively.
<p/>
The script designated by <b>leftupdown=/etc/mark_updown</b> automatically inserts
iptables mangle rules that mark the inbound ESP_IN_UDP packets as well as iptables IPsec-policy rules
that let pass the tunneled traffic. In order to test the tunnel, the NAT-ed hosts <b>alice</b>
and <b>venus</b> ping the client <b>bob</b> behind the gateway <b>sun</b>.