summaryrefslogtreecommitdiff
path: root/testing/tests/ikev2/rw-mark-in-out/description.txt
diff options
context:
space:
mode:
Diffstat (limited to 'testing/tests/ikev2/rw-mark-in-out/description.txt')
-rw-r--r--testing/tests/ikev2/rw-mark-in-out/description.txt16
1 files changed, 16 insertions, 0 deletions
diff --git a/testing/tests/ikev2/rw-mark-in-out/description.txt b/testing/tests/ikev2/rw-mark-in-out/description.txt
new file mode 100644
index 000000000..4c35081b1
--- /dev/null
+++ b/testing/tests/ikev2/rw-mark-in-out/description.txt
@@ -0,0 +1,16 @@
+The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the router <b>moon</b> set up
+tunnels to gateway <b>sun</b>. Since both roadwarriors possess the same 10.1.0.0/25 subnet,
+gateway <b>sun</b> uses Source NAT after ESP decryption to map these subnets to 10.3.0.10
+and 10.3.0.20, respectively.
+<p/>
+In order to differentiate between the tunnels to <b>alice</b> and <b>venus</b>, respectively,
+<b>XFRM marks</b> are defined for both the inbound and outbound IPsec SAs and policies using
+the <b>mark_in</b> and <b>mark_out</b> parameters in ipsec.conf.
+<p/>
+<b>iptables -t mangle</b> rules are then used in the PREROUTING chain to mark the traffic to
+and from <b>alice</b> and <b>venus</b>, respectively.
+<p/>
+The script designated by <b>leftupdown=/etc/mark_updown</b> automatically inserts
+iptables mangle rules that mark the inbound ESP packets as well as iptables IPsec-policy rules
+that let pass the tunneled traffic. In order to test the tunnel, the hosts <b>alice</b>
+and <b>venus</b> ping the client <b>bob</b> behind the gateway <b>sun</b>.