denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

some changes to the ikev2/nat-two-rw-mark scenario

Browse Source
This commit is contained in:
Andreas Steffen
2010-07-09 09:35:02 +02:00
parent 26c4d0102a
commit bcf608c848
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/nat-two-rw-mark/description.txt
+4 -2
View File
@@ -5,8 +5,10 @@ after ESP decryption to map these subnets to 10.3.0.10 and 10.3.0.20, respective
<p/>
In order to differentiate between the tunnels to <b>alice</b> and <b>venus</b>, respectively,
<b>XFRM marks</b> are defined for both the inbound and outbound IPsec SAs and policies using
the <b>mark=</b> ipsec.conf parameter. <b>iptables -t mangle</b> rules are then used in the PREROUTING
chain to mark the traffic to and from <b>alice</b> and <b>venus</b>, respectively.
the <b>mark</b> parameter in ipsec.conf.
<p/>
<b>iptables -t mangle</b> rules are then used in the PREROUTING chain to mark the traffic to
and from <b>alice</b> and <b>venus</b>, respectively.
<p/>
<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that let pass
the tunneled traffic. In order to test the tunnel, the NAT-ed hosts <b>alice</b> and <b>venus</b>
testing/tests/ikev2/nat-two-rw-mark/posttest.dat
-2
View File
@@ -6,6 +6,4 @@ venus::/etc/init.d/iptables stop 2> /dev/null
sun::/etc/init.d/iptables stop 2> /dev/null
moon::iptables -t nat -F
moon::conntrack -F
sun::iptables -t mangle -F
sun::iptables -t nat -F
sun::conntrack -F