Tobias Brunner
3b2f8cf282
Basically the same as the one without UDP encapsulation, but here the outbound SAs use random source ports.
17 lines
807 B
Plaintext
Executable File
17 lines
807 B
Plaintext
Executable File
sun::iptables-restore < /etc/iptables.rules
|
|
moon::iptables-restore < /etc/iptables.rules
|
|
sun::systemctl start strongswan
|
|
moon::systemctl start strongswan
|
|
sun::expect-connection gw-gw
|
|
moon::expect-connection gw-gw
|
|
# allow UDP encap from any source to 4500
|
|
moon::iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
|
|
moon::iptables -A OUTPUT -o eth0 -p udp --dport 4500 -j ACCEPT
|
|
sun:: iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
|
|
sun:: iptables -A OUTPUT -o eth0 -p udp --dport 4500 -j ACCEPT
|
|
# triggering packet apparently goes via lo
|
|
moon::iptables -A OUTPUT -o lo -d 10.2.0.0/16 -j ACCEPT
|
|
# trigger the creation of the fallback SA, use -I so no UDP socket is used to
|
|
# determine the source address and trigger the acqurie (this packet is lost)
|
|
moon::ping -c 1 -W 1 -I PH_IP_MOON1 PH_IP_BOB
|