Annotation of embedaddon/strongswan/testing/tests/ikev2/nat-rw-mark/description.txt, revision 1.1.1.1
1.1 misho 1: The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> set up
2: tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router.
3: Since both roadwarriors possess the same 10.1.0.0/25 subnet, gateway <b>sun</b> uses Source NAT
4: after ESP decryption to map these subnets to PH_IP_CAROL10 and PH_IP_DAVE10, respectively.
5: <p/>
6: In order to differentiate between the tunnels to <b>alice</b> and <b>venus</b>, respectively,
7: <b>XFRM marks</b> are defined for both the inbound and outbound IPsec SAs and policies using
8: the <b>mark</b> parameter in ipsec.conf.
9: <p/>
10: <b>iptables -t mangle</b> rules are then used in the PREROUTING chain to mark the traffic to
11: and from <b>alice</b> and <b>venus</b>, respectively.
12: <p/>
13: The script designated by <b>leftupdown=/etc/mark_updown</b> automatically inserts
14: iptables mangle rules that mark the inbound ESP_IN_UDP packets as well as iptables IPsec-policy rules
15: that let pass the tunneled traffic. In order to test the tunnel, the NAT-ed hosts <b>alice</b>
16: and <b>venus</b> ping the client <b>bob</b> behind the gateway <b>sun</b>.
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>