Martin Willi
f27fb58ae0
As we now reuse the reqid for identical SAs, the behavior changes for transport connections to multiple peers behind the same NAT. Instead of rejecting the SA, we now have two valid SAs active. For the reverse path, however, sun sends traffic always over the newer SA, resembling the behavior before we introduced explicit SA conflicts for different reqids.
14 lines
506 B
Plaintext
14 lines
506 B
Plaintext
alice::iptables-restore < /etc/iptables.rules
|
|
moon::iptables-restore < /etc/iptables.rules
|
|
sun::iptables-restore < /etc/iptables.rules
|
|
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -j MASQUERADE
|
|
moon::iptables -A FORWARD -i eth1 -o eth0 -s 10.1.0.0/16 -j ACCEPT
|
|
moon::iptables -A FORWARD -i eth0 -o eth1 -d 10.1.0.0/16 -j ACCEPT
|
|
alice::ipsec start
|
|
venus::ipsec start
|
|
sun::ipsec start
|
|
alice::expect-connection nat-t
|
|
venus::expect-connection nat-t
|
|
alice::ipsec up nat-t
|
|
venus::ipsec up nat-t
|