A connection between the subnets behind the gateways moon and sun is set up. The authentication is based on X.509 certificates containing Ed25519 keys. moon uses the botan plugin based on the Botan library for all cryptographical functions whereas sun uses the default strongSwan cryptographical plugins.

Upon the successful establishment of the IPsec tunnel, the updown script automatically inserts iptables-based firewall rules that let pass the tunneled traffic. In order to test both tunnel and firewall, client alice behind gateway moon pings client bob located behind gateway sun.