Tobias Brunner
1454bd7bcf
This ensures that packets on sun are processed on a particular CPU and not randomly on one, which causes expected SAs not to get created or other weird things.
19 lines
897 B
Plaintext
Executable File
19 lines
897 B
Plaintext
Executable File
# make sure forwarded responses trigger IRQ on the right CPU
|
|
sun::set-cpu-affinity eth1 0
|
|
sun::iptables-restore < /etc/iptables.rules
|
|
moon::iptables-restore < /etc/iptables.rules
|
|
sun::systemctl start strongswan
|
|
moon::systemctl start strongswan
|
|
sun::expect-connection gw-gw
|
|
moon::expect-connection gw-gw
|
|
# allow UDP encap from any source to 4500
|
|
moon::iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
|
|
moon::iptables -A OUTPUT -o eth0 -p udp --dport 4500 -j ACCEPT
|
|
sun:: iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
|
|
sun:: iptables -A OUTPUT -o eth0 -p udp --dport 4500 -j ACCEPT
|
|
# triggering packet apparently goes via lo
|
|
moon::iptables -A OUTPUT -o lo -d 10.2.0.0/16 -j ACCEPT
|
|
# trigger the creation of the fallback SA, use -I so no UDP socket is used to
|
|
# determine the source address and trigger the acqurie (this packet is lost)
|
|
moon::ping -c 1 -W 1 -I PH_IP_MOON1 PH_IP_BOB
|