diff options
| author | Rene Mayrhofer <rene@mayrhofer.eu.org> | 2010-08-09 09:43:35 +0000 |
|---|---|---|
| committer | Rene Mayrhofer <rene@mayrhofer.eu.org> | 2010-08-09 09:43:35 +0000 |
| commit | 9e7fb8577802de2abf191d783be5b6b953c22271 (patch) | |
| tree | e6818532d3a85a8a840652f6dfc0d58d42c89a69 /testing/tests/ikev2/nat-two-rw-mark/description.txt | |
| parent | 20e652eab94f898365fdde046ed11a2dda2f165e (diff) | |
| download | vyos-strongswan-9e7fb8577802de2abf191d783be5b6b953c22271.tar.gz vyos-strongswan-9e7fb8577802de2abf191d783be5b6b953c22271.zip | |
New upstream release.
Diffstat (limited to 'testing/tests/ikev2/nat-two-rw-mark/description.txt')
| -rw-r--r-- | testing/tests/ikev2/nat-two-rw-mark/description.txt | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/testing/tests/ikev2/nat-two-rw-mark/description.txt b/testing/tests/ikev2/nat-two-rw-mark/description.txt new file mode 100644 index 000000000..2a93d11d8 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-mark/description.txt @@ -0,0 +1,16 @@ +The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> set up +tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router. +Since both roadwarriors possess the same 10.1.0.0/25 subnet, gateway <b>sun</b> uses Source NAT +after ESP decryption to map these subnets to 10.3.0.10 and 10.3.0.20, respectively. +<p/> +In order to differentiate between the tunnels to <b>alice</b> and <b>venus</b>, respectively, +<b>XFRM marks</b> are defined for both the inbound and outbound IPsec SAs and policies using +the <b>mark</b> parameter in ipsec.conf. +<p/> +<b>iptables -t mangle</b> rules are then used in the PREROUTING chain to mark the traffic to +and from <b>alice</b> and <b>venus</b>, respectively. +<p/> +The script designated by <b>leftupdown=/etc/mark_updown</b> automatically inserts +iptables mangle rules that mark the inbound ESP_IN_UDP packets as well as iptables IPsec-policy rules +that let pass the tunneled traffic. In order to test the tunnel, the NAT-ed hosts <b>alice</b> +and <b>venus</b> ping the client <b>bob</b> behind the gateway <b>sun</b>. |