testing: Add scenarios to test ICMP forwarding

2026-02-12 16:21:37 +01:00
parent 22e502b286
commit a7c03a415e
26 changed files with 692 additions and 0 deletions
@@ -0,0 +1,48 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT  -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT  -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT  -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT  -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT  -i eth0 -p tcp --sport 80 -s 192.168.0.150 -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d 192.168.0.150 -j ACCEPT
+
+# allow decrypted ICMPs from any source IP (updown script is too specific)
+-A INPUT -p icmp --icmp-type destination-unreachable -m policy --dir in -j ACCEPT
+-A FORWARD -p icmp --icmp-type destination-unreachable -m policy --dir in -j ACCEPT
+
+# allow venus to connect and fetch crls
+-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
+-A INPUT -i eth1 -p 50 -j ACCEPT
+-A OUTPUT -o eth1 -p 50 -j ACCEPT
+-A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s 192.168.0.150 -j ACCEPT
+-A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d 192.168.0.150 -j ACCEPT
+
+# forward specific errors to venus
+-A FORWARD -d 10.1.0.20/32 -p icmp --icmp-type time-exceeded -j ACCEPT
+-A FORWARD -d 10.1.0.20/32 -p icmp --icmp-type fragmentation-needed -j ACCEPT
+
+# log dropped packets
+-A INPUT  -j LOG --log-prefix " IN: "
+-A OUTPUT -j LOG --log-prefix " OUT: "
+
+COMMIT
@@ -0,0 +1,9 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+swanctl {
+  load = pem pkcs1 pubkey openssl random
+}
+
+charon-systemd {
+  load = random nonce openssl pem pkcs1 revocation curl kernel-netlink socket-default updown vici
+}
@@ -0,0 +1,48 @@
+connections {
+
+   gw-gw {
+      local_addrs  = PH_IP_MOON
+      remote_addrs = PH_IP_SUN
+
+      local {
+         auth = pubkey
+         certs = moonCert.pem
+         id = moon.strongswan.org
+      }
+      remote {
+         auth = pubkey
+         id = sun.strongswan.org
+      }
+      children {
+         net-net {
+            local_ts  = 10.1.0.0/16
+            remote_ts = 10.2.0.0/16
+            icmp = yes
+
+            updown = /usr/local/libexec/ipsec/_updown iptables
+            hostaccess = yes
+            esp_proposals = aes128gcm128-x25519
+         }
+      }
+      version = 2
+      mobike = no
+      proposals = aes128-sha256-x25519
+   }
+
+   venus : connections.gw-gw {
+      local_addrs = PH_IP_MOON1
+      remote_addrs = PH_IP_VENUS
+
+      remote {
+         id = venus.strongswan.org
+      }
+      children {
+         net-net {
+            # only include bob
+            local_ts = 10.2.0.8/30
+            remote_ts = dynamic
+            hostaccess = no
+         }
+      }
+   }
+}
@@ -0,0 +1,42 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT  -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT  -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT  -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT  -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT  -i eth0 -p tcp --sport 80 -s 192.168.0.150 -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d 192.168.0.150 -j ACCEPT
+
+# explicitly allow ICMP responses we don't actually want to see as they should get encrypted
+-A OUTPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
+-A FORWARD -p icmp --icmp-type destination-unreachable -j ACCEPT
+
+# allow only specific ICMPs from/to venus for this scenario
+-A FORWARD -s 10.1.0.20/32 -p icmp --icmp-type echo-request -j ACCEPT
+-A FORWARD -d 10.1.0.20/32 -p icmp --icmp-type echo-reply -j ACCEPT
+-A OUTPUT -d 10.1.0.20/32 -p icmp --icmp-type time-exceeded -j ACCEPT
+-A OUTPUT -d 10.1.0.20/32 -p icmp --icmp-type fragmentation-needed -j ACCEPT
+
+# log dropped packets
+-A INPUT  -j LOG --log-prefix " IN: "
+-A OUTPUT -j LOG --log-prefix " OUT: "
+
+COMMIT
@@ -0,0 +1,9 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+swanctl {
+  load = pem pkcs1 pubkey openssl random
+}
+
+charon-systemd {
+  load = random nonce openssl pem pkcs1 revocation curl kernel-netlink socket-default updown vici
+}
@@ -0,0 +1,31 @@
+connections {
+
+   gw-gw {
+      local_addrs  = PH_IP_SUN
+      remote_addrs = PH_IP_MOON
+
+      local {
+         auth = pubkey
+         certs = sunCert.pem
+         id = sun.strongswan.org
+      }
+      remote {
+         auth = pubkey
+         id = moon.strongswan.org
+      }
+      children {
+         net-net {
+            # exclude sun's and bob's IPs
+            local_ts  = 10.2.0.16/28
+            remote_ts = 10.1.0.0/16
+            icmp = yes
+
+            updown = /usr/local/libexec/ipsec/_updown iptables
+            esp_proposals = aes128gcm128-x25519
+         }
+      }
+      version = 2
+      mobike = no
+      proposals = aes128-sha256-x25519
+   }
+}
@@ -0,0 +1,9 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+swanctl {
+  load = pem pkcs1 pubkey openssl random
+}
+
+charon-systemd {
+  load = random nonce openssl pem pkcs1 revocation curl kernel-netlink socket-default updown vici
+}
@@ -0,0 +1,29 @@
+connections {
+
+   rw {
+      remote_addrs = PH_IP_MOON1
+
+      local {
+         auth = pubkey
+         certs = venusCert.pem
+         id = venus.strongswan.org
+      }
+      remote {
+         auth = pubkey
+         id = moon.strongswan.org
+      }
+      children {
+         rw {
+            remote_ts = 10.2.0.0/16
+            icmp = yes
+
+            updown = /usr/local/libexec/ipsec/_updown iptables
+            hostaccess = yes
+            esp_proposals = aes128gcm128-x25519
+         }
+      }
+      version = 2
+      mobike = no
+      proposals = aes128-sha256-x25519
+   }
+}