deleted
This commit is contained in:
Andreas Steffen
@@ -1,6 +0,0 @@
|
|||||||
The roadwarrior <b>alice</b> sets up a connection to host <b>bob</b> using IKEv2. The hosts
|
|
||||||
sit behind NAT router <b>moon</b> (SNAT) and <b>sun</b> (DNAT) respectively.
|
|
||||||
UDP encapsulation is used to traverse the NAT router.
|
|
||||||
The authentication is based on locally loaded <b>X.509 certificates</b>.
|
|
||||||
In order to test the tunnel the NAT-ed host <b>alice</b> pings the host
|
|
||||||
<b>bob</b>.
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
bob::ipsec statusall::rw-alice.*ESTABLISHED::YES
|
|
||||||
alice::ipsec statusall::home.*ESTABLISHED::YES
|
|
||||||
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
|
|
||||||
moon::tcpdumpcount::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::2
|
|
||||||
moon::tcpdumpcount::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::2
|
|
||||||
@@ -1,17 +0,0 @@
|
|||||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
|
||||||
|
|
||||||
version 2.0 # conforms to second version of ipsec.conf specification
|
|
||||||
|
|
||||||
config setup
|
|
||||||
plutostart=no
|
|
||||||
|
|
||||||
conn home
|
|
||||||
left=PH_IP_ALICE
|
|
||||||
leftcert=aliceCert.pem
|
|
||||||
[email protected]
|
|
||||||
right=PH_IP_SUN
|
|
||||||
rightcert=bobCert.pem
|
|
||||||
[email protected]
|
|
||||||
rightsubnet=10.2.0.0/16
|
|
||||||
keyexchange=ikev2
|
|
||||||
auto=add
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIEHjCCAwagAwIBAgIBBjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
|
||||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
|
||||||
b290IENBMB4XDTA0MDkxMDExMjUzNFoXDTA5MDkwOTExMjUzNFowWDELMAkGA1UE
|
|
||||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh
|
|
||||||
cmNoMRswGQYDVQQDFBJib2JAc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEB
|
|
||||||
AQUAA4IBDwAwggEKAoIBAQDAJaejS3/lJfQHgw0nzvotgSQS8ey/6tvbx7s5RsWY
|
|
||||||
27x9K5xd44aPrvP2Qpyq34IXRY6uPlIqeUTQN7EKpLrWCxMOT36x5N0Co9J5UWRB
|
|
||||||
fJC141D+8+1RwJ9/baEIecpCvb0GfDOX0GXN5ltcJk82hZjE4y1yHC1FN7V3zdRg
|
|
||||||
xmloupPuon+X3bTmyMQ93NKkg48CQGtqtfwQ0MqPiOWu8MBhdztfOyu6aW3EgviF
|
|
||||||
ithLc02SeNzlpqB3M8GDfX+mr3OVDhhhC2OI+VRlZzz7KxJ13DUR2KkvLZR8Ak4E
|
|
||||||
5lRjkUnTYd/f3OQYxfjC8idUmj5ojR6Fb0x1tsV/glzXAgMBAAGjggEEMIIBADAJ
|
|
||||||
BgNVHRMEAjAAMAsGA1UdDwQEAwIDqDAdBgNVHQ4EFgQUaLN5EPOkOkVU3J1Ud0sl
|
|
||||||
+27OOHswbQYDVR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJ
|
|
||||||
BgNVBAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJz
|
|
||||||
dHJvbmdTd2FuIFJvb3QgQ0GCAQAwHQYDVR0RBBYwFIESYm9iQHN0cm9uZ3N3YW4u
|
|
||||||
b3JnMDkGA1UdHwQyMDAwLqAsoCqGKGh0dHA6Ly9jcmwuc3Ryb25nc3dhbi5vcmcv
|
|
||||||
c3Ryb25nc3dhbi5jcmwwDQYJKoZIhvcNAQEEBQADggEBAIyQLLxdeO8clplzRW9z
|
|
||||||
TRR3J0zSedvi2XlIZ/XCsv0ZVfoBLLWcDp3QrxNiVZXvXXtzjPsDs+DAveZF9LGq
|
|
||||||
0tIw1uT3JorbgNNrmWvxBvJoQTtSw4LQBuV7vF27jrposx3Hi5qtUXUDS6wVnDUI
|
|
||||||
5iORqsrddnoDuMN+Jt7oRcvKfYSNwTV+m0ZAHdB5a/ARWO5UILOrxEA/N72NcDYN
|
|
||||||
NdAd+bLaB38SbkSbh1xj/AGnrHxdJBF4h4mx4btc9gtBSh+dwBHOsn4TheqJ6bbw
|
|
||||||
7FlXBowQDCJIswKNhWfnIepQlM1KEzmq5YX43uZO2b7amRaIKqy2vNE7+UNFYBpE
|
|
||||||
Mto=
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
@@ -1,20 +0,0 @@
|
|||||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
|
||||||
|
|
||||||
version 2.0 # conforms to second version of ipsec.conf specification
|
|
||||||
|
|
||||||
config setup
|
|
||||||
plutostart=no
|
|
||||||
|
|
||||||
conn %default
|
|
||||||
left=PH_IP_BOB
|
|
||||||
leftcert=bobCert.pem
|
|
||||||
[email protected]
|
|
||||||
leftsubnet=10.2.0.10/32
|
|
||||||
keyexchange=ikev2
|
|
||||||
|
|
||||||
conn rw-alice
|
|
||||||
right=%any
|
|
||||||
rightcert=aliceCert.pem
|
|
||||||
[email protected]
|
|
||||||
rightsubnet=10.1.0.0/16
|
|
||||||
auto=add
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIEHzCCAwegAwIBAgIBBTANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
|
||||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
|
||||||
b290IENBMB4XDTA0MDkxMDExMjQzOVoXDTA5MDkwOTExMjQzOVowVzELMAkGA1UE
|
|
||||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsTBVNhbGVz
|
|
||||||
MR0wGwYDVQQDFBRhbGljZUBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEB
|
|
||||||
BQADggEPADCCAQoCggEBAK7FyvkE18/oujCaTd8GXBNOH+Cvoy0ibJ8j2sNsBrer
|
|
||||||
GS1lgxRs8zaVfK9fosadu0UZeWIHsOKkew5469sPvkKK2SGGH+pu+x+xO/vuaEG4
|
|
||||||
FlkAu8iGFWLQycLt6BJfcqw7FT8rwNuD18XXBXmP7hRavi/TEElbVYHbO7lm8T5W
|
|
||||||
6hTr/sYddiSB7X9/ba7JBy6lxmBcUAx5bjiiHLaW/llefkqyhc6dw5nvPZ2DchvH
|
|
||||||
v/HWvLF9bsvxbBkHU0/z/CEsRuMBI7EPEL4rx3UqmuCUAqiMJTS3IrDaIlfJOLWc
|
|
||||||
KlbsnE6hHpwmt9oDB9iWBY9WeZUSAtJGFw4b7FCZvQ0CAwEAAaOCAQYwggECMAkG
|
|
||||||
A1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRZmh0JtiNTjBsQsfD7ECNa
|
|
||||||
60iG2jBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkG
|
|
||||||
A1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0
|
|
||||||
cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRhbGljZUBzdHJvbmdzd2Fu
|
|
||||||
Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn
|
|
||||||
L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQADdQIlJkFtmHEjtuyo
|
|
||||||
2aIcrsUx98FtvVgB7RpQB8JZlly7UEjvX0CIIvW/7Al5/8h9s1rhrRffX7nXQKAQ
|
|
||||||
AmPnvD2Pp47obDnHqm/L109S1fcL5BiPN1AlgsseUBwzdqBpyRncPXZoAuBh/BU5
|
|
||||||
D/1Dip0hXgB/X6+QymSzRJoSKfpeXVICj1kYH1nIkn0YXthYF3BTrCheCzBlKn0S
|
|
||||||
CixbCUYsUjtSqld0nG76jyGb/gnWntNettH+RXWe1gm6qREJwfEFdeYviTqx2Uxi
|
|
||||||
6sBKG/XjNAcMArXb7V6w0YAwCyjwCl49B+mLZaFH+9izzBJ7NyVqhH8ToB1gt0re
|
|
||||||
JGhV
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
alice::ipsec stop
|
|
||||||
bob::ipsec stop
|
|
||||||
alice::rm /etc/ipsec.d/certs/*
|
|
||||||
bob::rm /etc/ipsec.d/certs/*
|
|
||||||
moon::iptables -t nat -F
|
|
||||||
sun::iptables -t nat -F
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
sun::echo 1 > /proc/sys/net/ipv4/ip_forward
|
|
||||||
sun::iptables -m multiport -t nat -A PREROUTING -i eth0 -p udp --dports 500,4500 -j DNAT --to 10.2.0.10
|
|
||||||
moon::echo 1 > /proc/sys/net/ipv4/ip_forward
|
|
||||||
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
|
|
||||||
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
|
|
||||||
bob::ipsec start
|
|
||||||
alice::ipsec start
|
|
||||||
alice::sleep 1
|
|
||||||
alice::ipsec up home
|
|
||||||
alice::sleep 1
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
#
|
|
||||||
# This configuration file provides information on the
|
|
||||||
# UML instances used for this test
|
|
||||||
|
|
||||||
# All UML instances that are required for this test
|
|
||||||
#
|
|
||||||
UMLHOSTS="alice moon winnetou sun bob"
|
|
||||||
|
|
||||||
# Corresponding block diagram
|
|
||||||
#
|
|
||||||
DIAGRAM="a-m-w-s-b.png"
|
|
||||||
|
|
||||||
# UML instances on which tcpdump is to be started
|
|
||||||
#
|
|
||||||
TCPDUMPHOSTS="moon"
|
|
||||||
|
|
||||||
# UML instances on which IPsec is started
|
|
||||||
# Used for IPsec logging purposes
|
|
||||||
#
|
|
||||||
IPSECHOSTS="alice bob"
|
|
||||||
Reference in New Issue
Block a user