diff options
| author | Yves-Alexis Perez <corsac@corsac.net> | 2012-06-28 21:16:07 +0200 |
|---|---|---|
| committer | Yves-Alexis Perez <corsac@corsac.net> | 2012-06-28 21:16:07 +0200 |
| commit | b34738ed08c2227300d554b139e2495ca5da97d6 (patch) | |
| tree | 62f33b52820f2e49f0e53c0f8c636312037c8054 /testing/tests/pfkey/shunt-policies/description.txt | |
| parent | 0a9d51a49042a68daa15b0c74a2b7f152f52606b (diff) | |
| download | vyos-strongswan-b34738ed08c2227300d554b139e2495ca5da97d6.tar.gz vyos-strongswan-b34738ed08c2227300d554b139e2495ca5da97d6.zip | |
Imported Upstream version 4.6.4
Diffstat (limited to 'testing/tests/pfkey/shunt-policies/description.txt')
| -rw-r--r-- | testing/tests/pfkey/shunt-policies/description.txt | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/testing/tests/pfkey/shunt-policies/description.txt b/testing/tests/pfkey/shunt-policies/description.txt new file mode 100644 index 000000000..ad98eb8d5 --- /dev/null +++ b/testing/tests/pfkey/shunt-policies/description.txt @@ -0,0 +1,11 @@ +All traffic from the clients <b>alice</b> and <b>venus</b> is tunneled +by default gateway <b>moon</b> to VPN gateway <b>sun</b>. In order to +prevent local traffic within the <b>10.1.0.0/16</b> subnet to enter the +tunnel, a <b>local-net</b> shunt policy with <b>type=pass</b> is set up. +In order for the shunt to work, automatic route insertion must be disabled +by adding <b>install_routes = no</b> to the charon section of <b>strongswan.conf</b>. +<p/> +In order to demonstrate the use of <b>type=drop</b> shunt policies, the +<b>venus-icmp</b> connection prevents ICMP traffic to and from <b>venus</b> +to use the IPsec tunnel by dropping such packets. Since this policy does not +apply to the local net, <b>venus</b> and <b>moon</b> can still ping each other. |