testing: Add ikev2/redirect-active scenario
This commit is contained in:
Tobias Brunner
@@ -0,0 +1,8 @@
|
|||||||
|
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each
|
||||||
|
to gateway <b>alice</b>, which identifies itself as <b>mars</b>.
|
||||||
|
Host <b>venus</b> in the subnet behind this gateway uses gateway <b>moon</b> as
|
||||||
|
default gateway, so it is not fully reachable by the two roadwarriors.
|
||||||
|
Then both SAs are actively redirected with the <em>swanctl --redirect</em>
|
||||||
|
command to gateway <b>moon</b> (also identified as <b>mars</b>) using the
|
||||||
|
mechanism described in <b>RFC 5685</b> enabling the roadwarriors to
|
||||||
|
ping <b>venus</b>.
|
||||||
@@ -0,0 +1,28 @@
|
|||||||
|
alice::ipsec status 2> /dev/null::rw\[1].*ESTABLISHED.*mars.strongswan.org.*[email protected]::YES
|
||||||
|
alice::ipsec status 2> /dev/null::rw\[2].*ESTABLISHED.*mars.strongswan.org.*[email protected]::YES
|
||||||
|
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*mars.strongswan.org::YES
|
||||||
|
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*mars.strongswan.org::YES
|
||||||
|
carol::ping -c 1 -W 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO
|
||||||
|
dave:: ping -c 1 -W 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO
|
||||||
|
alice::swanctl --redirect --peer-ip PH_IP_CAROL --gateway 192.168.0.1::redirect completed successfully::YES
|
||||||
|
alice::swanctl --redirect --peer-id [email protected] --gateway moon.strongswan.org::redirect completed successfully::YES
|
||||||
|
carol::sleep 1::No output expected::NO
|
||||||
|
carol::cat /var/log/daemon.log::redirected to 192.168.0.1::YES
|
||||||
|
dave::cat /var/log/daemon.log::redirected to moon.strongswan.org::YES
|
||||||
|
moon::cat /var/log/daemon.log::client got redirected from 192.168.0.5::YES
|
||||||
|
moon::ipsec status 2> /dev/null::rw\[1].*ESTABLISHED.*mars.strongswan.org.*[email protected]::YES
|
||||||
|
moon::ipsec status 2> /dev/null::rw\[2].*ESTABLISHED.*mars.strongswan.org.*[email protected]::YES
|
||||||
|
carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
|
||||||
|
dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
|
||||||
|
carol::tcpdump::IP carol.strongswan.org > mars.strongswan.org: ESP::YES
|
||||||
|
carol::tcpdump::IP mars.strongswan.org > carol.strongswan.org: ESP::NO
|
||||||
|
carol::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
|
||||||
|
carol::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
|
||||||
|
dave::tcpdump::IP dave.strongswan.org > mars.strongswan.org: ESP::YES
|
||||||
|
dave::tcpdump::IP mars.strongswan.org > dave.strongswan.org: ESP::NO
|
||||||
|
dave::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
|
||||||
|
dave::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
|
||||||
|
venus::tcpdump::IP carol.strongswan.org > venus.strongswan.org: ICMP echo request::YES
|
||||||
|
venus::tcpdump::IP venus.strongswan.org > carol.strongswan.org: ICMP echo reply::YES
|
||||||
|
venus::tcpdump::IP dave.strongswan.org > venus.strongswan.org: ICMP echo request::YES
|
||||||
|
venus::tcpdump::IP venus.strongswan.org > dave.strongswan.org: ICMP echo reply::YES
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||||
|
|
||||||
|
config setup
|
||||||
|
|
||||||
|
conn %default
|
||||||
|
ikelifetime=60m
|
||||||
|
keylife=20m
|
||||||
|
rekeymargin=3m
|
||||||
|
keyingtries=1
|
||||||
|
|
||||||
|
conn rw
|
||||||
|
left=192.168.0.5
|
||||||
|
leftcert=marsCert.pem
|
||||||
|
leftid=mars.strongswan.org
|
||||||
|
leftsubnet=10.1.0.0/16
|
||||||
|
leftfirewall=yes
|
||||||
|
right=%any
|
||||||
|
keyexchange=ikev2
|
||||||
|
auto=add
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIIEQDCCAyigAwIBAgIBNDANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJDSDEZ
|
||||||
|
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||||
|
b290IENBMB4XDTE1MTEyNjA4MjQ1M1oXDTE5MDkwNjA4MjQ1M1owZDELMAkGA1UE
|
||||||
|
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xHDAaBgNVBAsTE1ZpcnR1
|
||||||
|
YWwgVlBOIEdhdGV3YXkxHDAaBgNVBAMTE21hcnMuc3Ryb25nc3dhbi5vcmcwggEi
|
||||||
|
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCxTvcinIErfzu8YZKl+a2MNTVY
|
||||||
|
+qjG83OkweWjWed/egAugxRjTyWeKjrSNf6DWpXC0pNhzja+Sj0njz4Kq8VczkFB
|
||||||
|
/yYEkFKpdpFQHXvbQo5h7wn1i3Omhvou5x0rRfddRpLGl7Z/Xg8gnHsZMHHN60hI
|
||||||
|
qiLZdRSu5QF25WNcy9tO58gz8Hvo5jsk8YDu6eGYolaygQo3cqxx/r8yWzehju0F
|
||||||
|
oWm4sLOrq+OTegeCQYI8PsOALAwLWgWdGfMPMT0ntq9tD97AcUD0EilvcXVdmwUW
|
||||||
|
44/hM9BZ0JS7N7Wv6fgIChC7xhZj1yo6vY+FDsmNMhz7vdeulKx2dqRJkn0XAgMB
|
||||||
|
AAGjggEaMIIBFjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIDqDAdBgNVHQ4EFgQUvo44
|
||||||
|
06FQwLI8P6VqNehTNHa2LNMwbQYDVR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOou
|
||||||
|
Te+hSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2Fu
|
||||||
|
MRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3QgQ0GCAQAwHgYDVR0RBBcwFYITbWFy
|
||||||
|
cy5zdHJvbmdzd2FuLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATA5BgNVHR8EMjAw
|
||||||
|
MC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3JnL3N0cm9uZ3N3YW4uY3Js
|
||||||
|
MA0GCSqGSIb3DQEBCwUAA4IBAQCWvHc0v5BhxsLRxPvcOu1bVoeexzA/5nftfRly
|
||||||
|
PumU2hYFQ8p7soJiT/jYPmnfNvl6halnmS0FrqLdTMNfXj/6WCZ3w4Xnokc5PYW4
|
||||||
|
oL1VqdEgR7jyQjifZuzRkuPw+yAFoT+HbMttLdRMVTq9NXlPXtGaJTWbx5Z/gGP3
|
||||||
|
1Ry47WhvzJyRSysPh/+9WJFOwS6nf6DFbNuyVtNXQRzXjpsGefZgN9ysntNRFMMZ
|
||||||
|
V0j+zFIkLBLh2WBkJsuLQM9EFAlZrpQZ7iwHuz7gU0jATxN6Qxnn9AemNPl4k8T3
|
||||||
|
igPXeVhDbZFeTc+u/Z7X5i1HXhks2QGz/zGee6no54XOnBWB
|
||||||
|
-----END CERTIFICATE-----
|
||||||
@@ -0,0 +1,27 @@
|
|||||||
|
-----BEGIN RSA PRIVATE KEY-----
|
||||||
|
MIIEpAIBAAKCAQEAsU73IpyBK387vGGSpfmtjDU1WPqoxvNzpMHlo1nnf3oALoMU
|
||||||
|
Y08lnio60jX+g1qVwtKTYc42vko9J48+CqvFXM5BQf8mBJBSqXaRUB1720KOYe8J
|
||||||
|
9Ytzpob6LucdK0X3XUaSxpe2f14PIJx7GTBxzetISKoi2XUUruUBduVjXMvbTufI
|
||||||
|
M/B76OY7JPGA7unhmKJWsoEKN3Kscf6/Mls3oY7tBaFpuLCzq6vjk3oHgkGCPD7D
|
||||||
|
gCwMC1oFnRnzDzE9J7avbQ/ewHFA9BIpb3F1XZsFFuOP4TPQWdCUuze1r+n4CAoQ
|
||||||
|
u8YWY9cqOr2PhQ7JjTIc+73XrpSsdnakSZJ9FwIDAQABAoIBAQCe+TYMClamMUXV
|
||||||
|
+YYK2noIJAzY4qVA/DbLmi3S8GDnovNWwKAfCm+oCCUFJPQ1wZpVO4h5QPNEWjvK
|
||||||
|
pFv0JV6nfyZzjdkAboYu+uf+9PB//oS6uiAr0AS5YnweYYl9qxXGw+gFtzEhsavO
|
||||||
|
iX61bwIapsIApMrqPld1GE7f03vrTjyqYeJC+V5WEVZe1fkZtKFFJiHN1boPwoWt
|
||||||
|
VRQ4UGlq9eto5pddmMcPl/uR9/TItdMC8AZ7fcRYP9RdYFEp8jS+tx3CDNs0XrlF
|
||||||
|
qKlroDSdwBt475Ud5irtNwjGoohl3xCHvEne9l+fjlmQFynfRNeOb9rgVIsT3OoO
|
||||||
|
MFSeW9HBAoGBAOiAjYCWoQHSlbi3Nkd5fsfTd4iZOkeeZi+2PJOhDByH1Hsq87CP
|
||||||
|
KoYejjYUQ6QvJY2WDJCU8qXxPJkDuI6XZ6QbTDPad2xXDkA4pxuPi/c+Hb/eqLQ+
|
||||||
|
24ebIzauC5iLdddp22oQXQOngKwUMihYggKs9cIpem8G99bcMfq1OeaDAoGBAMM6
|
||||||
|
Z790eySPDIaKZZ/KVOu4hJe1s5vIJqN9xtV0o55PTR2wFCgwCogiXQchyhF8Qo6q
|
||||||
|
BEpcKpY1bAivmL8T2PBsLUuKC4LAr8uzW8rVFbG3HfC62RoaVOZWmH+yBABi6eej
|
||||||
|
Lh8KNhal+HzVOlMsw78FAkhq9aubWBywxfULFyrdAoGAPmnsEn3dIPkf+iMsrgk+
|
||||||
|
cHQjHYdMrtclxV8daeAMuUf5UUsZeeck2jYvpPLRqayCXzzNiK6DaOqWgtkN3TFl
|
||||||
|
wBcX4L+f2XSRPco3id2CDFAfeldSYHiTRBbwYAhe0od1jes73IAiCA4aK5eMU2pX
|
||||||
|
FFLL8mBiHpX3SDV6MTwfG/MCgYEApgLXUC3LvVXLL+kl65ARUHUSgzNmrNSxTptY
|
||||||
|
5hCORcNnbxRYv6fCfOrDspngC6hfrJMUnOrs59g7qtMvD2TgN+m1RqP3j9Msagp1
|
||||||
|
xvAVx45QbnFkxdaYVVpTyVpmHrH99xSC1rBHOFEgEX78XtgVCC1JOK2DhM7PSW5k
|
||||||
|
lzA8Hh0CgYBVXNnQsy4x+9D09zeFP2TKXsk7N154yUP6oxXu6OjZC+cfxHOGyi/g
|
||||||
|
PVe8ukBIknZkFRz+ZXdfZzXXuJslENOVeFEInqVAu2W55KeCPc/3SU6hB2lj6MBl
|
||||||
|
WIZ7yrUmtdalU3cPkFnHkQTL2glYAzjB2z22AxyXNzy37ZhtFpovtg==
|
||||||
|
-----END RSA PRIVATE KEY-----
|
||||||
@@ -0,0 +1,3 @@
|
|||||||
|
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||||
|
|
||||||
|
: RSA marsKey.pem
|
||||||
@@ -0,0 +1,34 @@
|
|||||||
|
*filter
|
||||||
|
|
||||||
|
# default policy is DROP
|
||||||
|
-P INPUT DROP
|
||||||
|
-P OUTPUT DROP
|
||||||
|
-P FORWARD DROP
|
||||||
|
|
||||||
|
# forward ESP-tunneled traffic
|
||||||
|
-A FORWARD -i eth1 -m policy --dir in --pol ipsec --proto esp -s PH_IP_CAROL -j ACCEPT
|
||||||
|
-A FORWARD -i eth1 -m policy --dir in --pol ipsec --proto esp -s PH_IP_DAVE -j ACCEPT
|
||||||
|
-A FORWARD -o eth1 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
|
||||||
|
|
||||||
|
# allow esp
|
||||||
|
-A INPUT -p 50 -j ACCEPT
|
||||||
|
-A OUTPUT -p 50 -d PH_IP_CAROL -j ACCEPT
|
||||||
|
-A OUTPUT -p 50 -d PH_IP_DAVE -j ACCEPT
|
||||||
|
|
||||||
|
# allow IKE
|
||||||
|
-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
|
||||||
|
-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
|
||||||
|
|
||||||
|
# allow MobIKE
|
||||||
|
-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
|
||||||
|
-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
||||||
|
|
||||||
|
# allow crl fetch from winnetou
|
||||||
|
-A INPUT -i eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||||
|
-A OUTPUT -o eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||||
|
|
||||||
|
# allow ssh
|
||||||
|
-A INPUT -p tcp --dport 22 -j ACCEPT
|
||||||
|
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||||
|
|
||||||
|
COMMIT
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
# /etc/strongswan.conf - strongSwan configuration file
|
||||||
|
|
||||||
|
charon {
|
||||||
|
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown vici
|
||||||
|
}
|
||||||
|
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||||
|
|
||||||
|
config setup
|
||||||
|
charondebug="knl 2"
|
||||||
|
conn %default
|
||||||
|
ikelifetime=60m
|
||||||
|
keylife=20m
|
||||||
|
rekeymargin=3m
|
||||||
|
keyingtries=1
|
||||||
|
|
||||||
|
conn home
|
||||||
|
leftcert=carolCert.pem
|
||||||
|
[email protected]
|
||||||
|
leftfirewall=yes
|
||||||
|
right=192.168.0.5
|
||||||
|
rightid=mars.strongswan.org
|
||||||
|
rightsubnet=10.1.0.0/16
|
||||||
|
keyexchange=ikev2
|
||||||
|
auto=add
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
# /etc/strongswan.conf - strongSwan configuration file
|
||||||
|
|
||||||
|
charon {
|
||||||
|
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc ctr ccm gcm stroke kernel-netlink socket-default updown
|
||||||
|
}
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||||
|
|
||||||
|
config setup
|
||||||
|
|
||||||
|
conn %default
|
||||||
|
ikelifetime=60m
|
||||||
|
keylife=20m
|
||||||
|
rekeymargin=3m
|
||||||
|
keyingtries=1
|
||||||
|
|
||||||
|
conn home
|
||||||
|
leftcert=daveCert.pem
|
||||||
|
[email protected]
|
||||||
|
leftfirewall=yes
|
||||||
|
right=192.168.0.5
|
||||||
|
rightid=mars.strongswan.org
|
||||||
|
rightsubnet=10.1.0.0/16
|
||||||
|
keyexchange=ikev2
|
||||||
|
auto=add
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
# /etc/strongswan.conf - strongSwan configuration file
|
||||||
|
|
||||||
|
charon {
|
||||||
|
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc ctr ccm gcm stroke kernel-netlink socket-default updown
|
||||||
|
}
|
||||||
|
|
||||||
@@ -0,0 +1,18 @@
|
|||||||
|
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||||
|
|
||||||
|
config setup
|
||||||
|
|
||||||
|
conn %default
|
||||||
|
ikelifetime=60m
|
||||||
|
keylife=20m
|
||||||
|
rekeymargin=3m
|
||||||
|
keyingtries=1
|
||||||
|
|
||||||
|
conn rw
|
||||||
|
leftcert=marsCert.pem
|
||||||
|
leftid=mars.strongswan.org
|
||||||
|
leftsubnet=10.1.0.0/16
|
||||||
|
leftfirewall=yes
|
||||||
|
right=%any
|
||||||
|
keyexchange=ikev2
|
||||||
|
auto=add
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIIEQDCCAyigAwIBAgIBNDANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJDSDEZ
|
||||||
|
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||||
|
b290IENBMB4XDTE1MTEyNjA4MjQ1M1oXDTE5MDkwNjA4MjQ1M1owZDELMAkGA1UE
|
||||||
|
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xHDAaBgNVBAsTE1ZpcnR1
|
||||||
|
YWwgVlBOIEdhdGV3YXkxHDAaBgNVBAMTE21hcnMuc3Ryb25nc3dhbi5vcmcwggEi
|
||||||
|
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCxTvcinIErfzu8YZKl+a2MNTVY
|
||||||
|
+qjG83OkweWjWed/egAugxRjTyWeKjrSNf6DWpXC0pNhzja+Sj0njz4Kq8VczkFB
|
||||||
|
/yYEkFKpdpFQHXvbQo5h7wn1i3Omhvou5x0rRfddRpLGl7Z/Xg8gnHsZMHHN60hI
|
||||||
|
qiLZdRSu5QF25WNcy9tO58gz8Hvo5jsk8YDu6eGYolaygQo3cqxx/r8yWzehju0F
|
||||||
|
oWm4sLOrq+OTegeCQYI8PsOALAwLWgWdGfMPMT0ntq9tD97AcUD0EilvcXVdmwUW
|
||||||
|
44/hM9BZ0JS7N7Wv6fgIChC7xhZj1yo6vY+FDsmNMhz7vdeulKx2dqRJkn0XAgMB
|
||||||
|
AAGjggEaMIIBFjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIDqDAdBgNVHQ4EFgQUvo44
|
||||||
|
06FQwLI8P6VqNehTNHa2LNMwbQYDVR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOou
|
||||||
|
Te+hSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2Fu
|
||||||
|
MRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3QgQ0GCAQAwHgYDVR0RBBcwFYITbWFy
|
||||||
|
cy5zdHJvbmdzd2FuLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATA5BgNVHR8EMjAw
|
||||||
|
MC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3JnL3N0cm9uZ3N3YW4uY3Js
|
||||||
|
MA0GCSqGSIb3DQEBCwUAA4IBAQCWvHc0v5BhxsLRxPvcOu1bVoeexzA/5nftfRly
|
||||||
|
PumU2hYFQ8p7soJiT/jYPmnfNvl6halnmS0FrqLdTMNfXj/6WCZ3w4Xnokc5PYW4
|
||||||
|
oL1VqdEgR7jyQjifZuzRkuPw+yAFoT+HbMttLdRMVTq9NXlPXtGaJTWbx5Z/gGP3
|
||||||
|
1Ry47WhvzJyRSysPh/+9WJFOwS6nf6DFbNuyVtNXQRzXjpsGefZgN9ysntNRFMMZ
|
||||||
|
V0j+zFIkLBLh2WBkJsuLQM9EFAlZrpQZ7iwHuz7gU0jATxN6Qxnn9AemNPl4k8T3
|
||||||
|
igPXeVhDbZFeTc+u/Z7X5i1HXhks2QGz/zGee6no54XOnBWB
|
||||||
|
-----END CERTIFICATE-----
|
||||||
@@ -0,0 +1,27 @@
|
|||||||
|
-----BEGIN RSA PRIVATE KEY-----
|
||||||
|
MIIEpAIBAAKCAQEAsU73IpyBK387vGGSpfmtjDU1WPqoxvNzpMHlo1nnf3oALoMU
|
||||||
|
Y08lnio60jX+g1qVwtKTYc42vko9J48+CqvFXM5BQf8mBJBSqXaRUB1720KOYe8J
|
||||||
|
9Ytzpob6LucdK0X3XUaSxpe2f14PIJx7GTBxzetISKoi2XUUruUBduVjXMvbTufI
|
||||||
|
M/B76OY7JPGA7unhmKJWsoEKN3Kscf6/Mls3oY7tBaFpuLCzq6vjk3oHgkGCPD7D
|
||||||
|
gCwMC1oFnRnzDzE9J7avbQ/ewHFA9BIpb3F1XZsFFuOP4TPQWdCUuze1r+n4CAoQ
|
||||||
|
u8YWY9cqOr2PhQ7JjTIc+73XrpSsdnakSZJ9FwIDAQABAoIBAQCe+TYMClamMUXV
|
||||||
|
+YYK2noIJAzY4qVA/DbLmi3S8GDnovNWwKAfCm+oCCUFJPQ1wZpVO4h5QPNEWjvK
|
||||||
|
pFv0JV6nfyZzjdkAboYu+uf+9PB//oS6uiAr0AS5YnweYYl9qxXGw+gFtzEhsavO
|
||||||
|
iX61bwIapsIApMrqPld1GE7f03vrTjyqYeJC+V5WEVZe1fkZtKFFJiHN1boPwoWt
|
||||||
|
VRQ4UGlq9eto5pddmMcPl/uR9/TItdMC8AZ7fcRYP9RdYFEp8jS+tx3CDNs0XrlF
|
||||||
|
qKlroDSdwBt475Ud5irtNwjGoohl3xCHvEne9l+fjlmQFynfRNeOb9rgVIsT3OoO
|
||||||
|
MFSeW9HBAoGBAOiAjYCWoQHSlbi3Nkd5fsfTd4iZOkeeZi+2PJOhDByH1Hsq87CP
|
||||||
|
KoYejjYUQ6QvJY2WDJCU8qXxPJkDuI6XZ6QbTDPad2xXDkA4pxuPi/c+Hb/eqLQ+
|
||||||
|
24ebIzauC5iLdddp22oQXQOngKwUMihYggKs9cIpem8G99bcMfq1OeaDAoGBAMM6
|
||||||
|
Z790eySPDIaKZZ/KVOu4hJe1s5vIJqN9xtV0o55PTR2wFCgwCogiXQchyhF8Qo6q
|
||||||
|
BEpcKpY1bAivmL8T2PBsLUuKC4LAr8uzW8rVFbG3HfC62RoaVOZWmH+yBABi6eej
|
||||||
|
Lh8KNhal+HzVOlMsw78FAkhq9aubWBywxfULFyrdAoGAPmnsEn3dIPkf+iMsrgk+
|
||||||
|
cHQjHYdMrtclxV8daeAMuUf5UUsZeeck2jYvpPLRqayCXzzNiK6DaOqWgtkN3TFl
|
||||||
|
wBcX4L+f2XSRPco3id2CDFAfeldSYHiTRBbwYAhe0od1jes73IAiCA4aK5eMU2pX
|
||||||
|
FFLL8mBiHpX3SDV6MTwfG/MCgYEApgLXUC3LvVXLL+kl65ARUHUSgzNmrNSxTptY
|
||||||
|
5hCORcNnbxRYv6fCfOrDspngC6hfrJMUnOrs59g7qtMvD2TgN+m1RqP3j9Msagp1
|
||||||
|
xvAVx45QbnFkxdaYVVpTyVpmHrH99xSC1rBHOFEgEX78XtgVCC1JOK2DhM7PSW5k
|
||||||
|
lzA8Hh0CgYBVXNnQsy4x+9D09zeFP2TKXsk7N154yUP6oxXu6OjZC+cfxHOGyi/g
|
||||||
|
PVe8ukBIknZkFRz+ZXdfZzXXuJslENOVeFEInqVAu2W55KeCPc/3SU6hB2lj6MBl
|
||||||
|
WIZ7yrUmtdalU3cPkFnHkQTL2glYAzjB2z22AxyXNzy37ZhtFpovtg==
|
||||||
|
-----END RSA PRIVATE KEY-----
|
||||||
@@ -0,0 +1,3 @@
|
|||||||
|
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||||
|
|
||||||
|
: RSA marsKey.pem
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
# /etc/strongswan.conf - strongSwan configuration file
|
||||||
|
|
||||||
|
charon {
|
||||||
|
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown
|
||||||
|
}
|
||||||
|
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
carol::ipsec stop
|
||||||
|
dave::ipsec stop
|
||||||
|
moon::ipsec stop
|
||||||
|
alice::ipsec stop
|
||||||
|
moon::iptables-restore < /etc/iptables.flush
|
||||||
|
alice::iptables-restore < /etc/iptables.flush
|
||||||
|
carol::iptables-restore < /etc/iptables.flush
|
||||||
|
dave::iptables-restore < /etc/iptables.flush
|
||||||
|
alice::ip addr del 192.168.0.5/24 dev eth1
|
||||||
|
alice::ifdown eth1
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
alice::ifup eth1
|
||||||
|
alice::ip addr add 192.168.0.5/24 dev eth1
|
||||||
|
moon::iptables-restore < /etc/iptables.rules
|
||||||
|
alice::iptables-restore < /etc/iptables.rules
|
||||||
|
carol::iptables-restore < /etc/iptables.rules
|
||||||
|
dave::iptables-restore < /etc/iptables.rules
|
||||||
|
moon::ipsec start
|
||||||
|
alice::ipsec start
|
||||||
|
carol::ipsec start
|
||||||
|
dave::ipsec start
|
||||||
|
carol::sleep 1
|
||||||
|
carol::ipsec up home
|
||||||
|
dave::ipsec up home
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# This configuration file provides information on the
|
||||||
|
# guest instances used for this test
|
||||||
|
|
||||||
|
# All guest instances that are required for this test
|
||||||
|
#
|
||||||
|
VIRTHOSTS="alice venus moon carol winnetou dave"
|
||||||
|
|
||||||
|
# Corresponding block diagram
|
||||||
|
#
|
||||||
|
DIAGRAM="a-v-m-c-w-d.png"
|
||||||
|
|
||||||
|
# Guest instances on which tcpdump is to be started
|
||||||
|
#
|
||||||
|
TCPDUMPHOSTS="venus carol dave"
|
||||||
|
|
||||||
|
# Guest instances on which IPsec is started
|
||||||
|
# Used for IPsec logging purposes
|
||||||
|
#
|
||||||
|
IPSECHOSTS="alice moon carol dave"
|
||||||
Reference in New Issue
Block a user