Martin Willi
9ed09d5f77
In this test two hosts establish a transport mode connection from behind moon. sun uses the connmark plugin to distinguish the flows. This is an example that shows how one can terminate L2TP/IPsec connections from two hosts behind the same NAT. For simplification of the test, we use an SSH connection instead, but this works for any connection initiated flow that conntrack can track.
8 lines
515 B
Plaintext
8 lines
515 B
Plaintext
sun:: ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*sun.strongswan.org.*venus.strongswan.org::YES
|
|
sun:: ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*sun.strongswan.org.*[email protected]::YES
|
|
alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TRANSPORT, reqid 1::YES
|
|
venus::ipsec status 2> /dev/null::nat-t.*INSTALLED, TRANSPORT, reqid 1::YES
|
|
alice::ssh 192.168.0.2 'echo alice-echo && exit'::alice-echo::YES
|
|
venus::ssh 192.168.0.2 'echo venus-echo && exit'::venus-echo::YES
|
|
sun::iptables -t mangle -L -n -v
|