The roadwarriors carol and dave set up a connection each to gateway moon. The authentication is based on X.509 certificates. Instead of the certificates themselves, "Hash and URL" certificate payloads are transferred and the certificates are fetched via http from web server winnetou.

Upon the successful establishment of the IPsec tunnels, leftfirewall=yes automatically inserts iptables-based firewall rules that let pass the tunneled traffic. In order to test both tunnel and firewall, both carol and dave ping the client alice behind the gateway moon.