enabled firewall support

testing/tests/ikev2/host2host-cert/description.txt

@@ -1,3 +1,4 @@
 A connection between the hosts <b>moon</b> and <b>sun</b> is successfully set up.
-The authentication is based on X.509 certificates.
+The authentication is based on X.509 certificates. <b>leftfirewall=yes</b> automatically
+inserts iptables-based firewall rules that let pass the tunneled traffic.
 In order to test the host-to-host tunnel <b>moon</b> pings <b>sun</b>.

testing/tests/ikev2/host2host-cert/hosts/moon/etc/ipsec.conf

@@ -9,13 +9,14 @@ conn %default
 	keylife=20m
 	rekeymargin=3m
 	keyingtries=1
+	keyexchange=ikev2
 
 conn host-host
 	left=PH_IP_MOON
 	leftnexthop=%direct
 	leftcert=moonCert.pem
 	leftid=@moon.strongswan.org
+	leftfirewall=yes
 	right=PH_IP_SUN
 	rightid=@sun.strongswan.org
-	keyexchange=ikev2
 	auto=add

testing/tests/ikev2/host2host-cert/hosts/sun/etc/ipsec.conf

@@ -9,13 +9,14 @@ conn %default
 	keylife=20m
 	rekeymargin=3m
 	keyingtries=1
+	keyexchange=ikev2
 
 conn host-host
 	left=PH_IP_SUN
 	leftnexthop=%direct
 	leftcert=sunCert.pem
 	leftid=@sun.strongswan.org
+	leftfirewall=yes
 	right=PH_IP_MOON
 	rightid=@moon.strongswan.org
-	keyexchange=ikev2
 	auto=add

testing/tests/ikev2/host2host-cert/posttest.dat

@@ -1,2 +1,6 @@
+moon::iptables -v -n -L
+sun::iptables -v -n -L
 moon::ipsec stop
 sun::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null

testing/tests/ikev2/host2host-cert/pretest.dat

@@ -1,3 +1,5 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+sun::/etc/init.d/iptables start 2> /dev/null
 moon::ipsec start
 sun::ipsec start
 moon::sleep 1