diff options
| author | Rene Mayrhofer <rene@mayrhofer.eu.org> | 2010-08-09 08:09:54 +0000 |
|---|---|---|
| committer | Rene Mayrhofer <rene@mayrhofer.eu.org> | 2010-08-09 08:09:54 +0000 |
| commit | b8064f4099997a9e2179f3ad4ace605f5ccac3a1 (patch) | |
| tree | 81778e976b476374c48b4fe83d084b986b890421 /testing/tests/ikev2/nat-two-rw-mark/description.txt | |
| parent | 1ac70afcc1f7d6d2738a34308810719b0976d29f (diff) | |
| download | vyos-strongswan-b8064f4099997a9e2179f3ad4ace605f5ccac3a1.tar.gz vyos-strongswan-b8064f4099997a9e2179f3ad4ace605f5ccac3a1.zip | |
[svn-upgrade] new version strongswan (4.4.1)
Diffstat (limited to 'testing/tests/ikev2/nat-two-rw-mark/description.txt')
| -rw-r--r-- | testing/tests/ikev2/nat-two-rw-mark/description.txt | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/testing/tests/ikev2/nat-two-rw-mark/description.txt b/testing/tests/ikev2/nat-two-rw-mark/description.txt new file mode 100644 index 000000000..2a93d11d8 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-mark/description.txt @@ -0,0 +1,16 @@ +The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> set up +tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router. +Since both roadwarriors possess the same 10.1.0.0/25 subnet, gateway <b>sun</b> uses Source NAT +after ESP decryption to map these subnets to 10.3.0.10 and 10.3.0.20, respectively. +<p/> +In order to differentiate between the tunnels to <b>alice</b> and <b>venus</b>, respectively, +<b>XFRM marks</b> are defined for both the inbound and outbound IPsec SAs and policies using +the <b>mark</b> parameter in ipsec.conf. +<p/> +<b>iptables -t mangle</b> rules are then used in the PREROUTING chain to mark the traffic to +and from <b>alice</b> and <b>venus</b>, respectively. +<p/> +The script designated by <b>leftupdown=/etc/mark_updown</b> automatically inserts +iptables mangle rules that mark the inbound ESP_IN_UDP packets as well as iptables IPsec-policy rules +that let pass the tunneled traffic. In order to test the tunnel, the NAT-ed hosts <b>alice</b> +and <b>venus</b> ping the client <b>bob</b> behind the gateway <b>sun</b>. |