273 lines
7.9 KiB
Plaintext
273 lines
7.9 KiB
Plaintext
.TH IPSEC_EROUTE 5 "20 Sep 2001"
|
|
.\"
|
|
.\" RCSID $Id: eroute.5,v 1.1 2004/03/15 20:35:27 as Exp $
|
|
.\"
|
|
.SH NAME
|
|
ipsec_eroute \- list of existing eroutes
|
|
.SH SYNOPSIS
|
|
.B ipsec
|
|
.B eroute
|
|
.PP
|
|
.B cat
|
|
.B /proc/net/ipsec_eroute
|
|
.SH DESCRIPTION
|
|
.I /proc/net/ipsec_eroute
|
|
lists the IPSEC extended routing tables,
|
|
which control what (if any) processing is applied
|
|
to non-encrypted packets arriving for IPSEC processing and forwarding.
|
|
At this point it is a read-only file.
|
|
.PP
|
|
A table entry consists of:
|
|
.IP + 3
|
|
packet count,
|
|
.IP +
|
|
source address with mask and source port (0 if all ports or not applicable)
|
|
.IP +
|
|
a '->' separator for visual and automated parsing between src and dst
|
|
.IP +
|
|
destination address with mask and destination port (0 if all ports or
|
|
not applicable)
|
|
.IP +
|
|
a '=>' separator for visual and automated parsing between selection
|
|
criteria and SAID to use
|
|
.IP +
|
|
SAID (Security Association IDentifier), comprised of:
|
|
.IP + 6
|
|
protocol
|
|
(\fIproto\fR),
|
|
.IP +
|
|
address family
|
|
(\fIaf\fR),
|
|
where '.' stands for IPv4 and ':' for IPv6
|
|
.IP +
|
|
Security Parameters Index
|
|
(\fISPI\fR),
|
|
.IP +
|
|
effective destination
|
|
(\fIedst\fR),
|
|
where the packet should be forwarded after processing
|
|
(normally the other security gateway)
|
|
together indicate which Security Association should be used to process
|
|
the packet,
|
|
.IP + 3
|
|
a ':' separating the SAID from the transport protocol (0 if all protocols)
|
|
.IP +
|
|
source identity text string with no whitespace, in parens,
|
|
.IP +
|
|
destination identity text string with no whitespace, in parens
|
|
.PP
|
|
Addresses are written as IPv4 dotted quads or IPv6 coloned hex,
|
|
protocol is one of "ah", "esp", "comp" or "tun"
|
|
and
|
|
SPIs are prefixed hexadecimal numbers where the prefix '.' is for IPv4 and the prefix ':' is for IPv6
|
|
.
|
|
.PP
|
|
SAIDs are written as "protoafSPI@edst". There are also 5
|
|
"magic" SAIDs which have special meaning:
|
|
.IP + 3
|
|
.B %drop
|
|
means that matches are to be dropped
|
|
.IP +
|
|
.B %reject
|
|
means that matches are to be dropped and an ICMP returned, if
|
|
possible to inform
|
|
.IP +
|
|
.B %trap
|
|
means that matches are to trigger an ACQUIRE message to the Key
|
|
Management daemon(s) and a hold eroute will be put in place to
|
|
prevent subsequent packets also triggering ACQUIRE messages.
|
|
.IP +
|
|
.B %hold
|
|
means that matches are to stored until the eroute is replaced or
|
|
until that eroute gets reaped
|
|
.IP +
|
|
.B %pass
|
|
means that matches are to allowed to pass without IPSEC processing
|
|
.br
|
|
.ne 5
|
|
.SH EXAMPLES
|
|
.LP
|
|
.B "1867 172.31.252.0/24:0 -> 0.0.0.0/0:0 => tun0x130@192.168.43.1:0 "
|
|
.br
|
|
.B " () ()"
|
|
.LP
|
|
means that 1,867 packets have been sent to an
|
|
.BR eroute
|
|
that has been set up to protect traffic between the subnet
|
|
.BR 172.31.252.0
|
|
with a subnet mask of
|
|
.BR 24
|
|
bits and the default address/mask represented by an address of
|
|
.BR 0.0.0.0
|
|
with a subnet mask of
|
|
.BR 0
|
|
bits using the local machine as a security gateway on this end of the
|
|
tunnel and the machine
|
|
.BR 192.168.43.1
|
|
on the other end of the tunnel with a Security Association IDentifier of
|
|
.BR tun0x130@192.168.43.1
|
|
which means that it is a tunnel mode connection (4, IPPROTO_IPIP) with a
|
|
Security Parameters Index of
|
|
.BR 130
|
|
in hexadecimal with no identies defined for either end.
|
|
.LP
|
|
.B "746 192.168.2.110/32:0 -> 192.168.2.120/32:25 => esp0x130@192.168.2.120:6 "
|
|
.br
|
|
.B " () ()"
|
|
.LP
|
|
means that 746 packets have been sent to an
|
|
.BR eroute
|
|
that has been set up to protect traffic sent from any port on the host
|
|
.BR 192.168.2.110
|
|
to the SMTP (TCP, port 25) port on the host
|
|
.BR 192.168.2.120
|
|
with a Security Association IDentifier of
|
|
.BR tun0x130@192.168.2.120
|
|
which means that it is a transport mode connection with a
|
|
Security Parameters Index of
|
|
.BR 130
|
|
in hexadecimal with no identies defined for either end.
|
|
.LP
|
|
.B 125 3049:1::/64 -> 0:0/0 => tun:130@3058:4::5 () ()
|
|
.LP
|
|
means that 125 packets have been sent to an
|
|
.BR eroute
|
|
that has been set up to protect traffic between the subnet
|
|
.BR 3049:1::
|
|
with a subnet mask of
|
|
.BR 64
|
|
bits and the default address/mask represented by an address of
|
|
.BR 0:0
|
|
with a subnet mask of
|
|
.BR 0
|
|
bits using the local machine as a security gateway on this end of the
|
|
tunnel and the machine
|
|
.BR 3058:4::5
|
|
on the other end of the tunnel with a Security Association IDentifier of
|
|
.BR tun:130@3058:4::5
|
|
which means that it is a tunnel mode connection with a
|
|
Security Parameters Index of
|
|
.BR 130
|
|
in hexadecimal with no identies defined for either end.
|
|
.LP
|
|
.B 42 192.168.6.0/24:0 -> 192.168.7.0/24:0 => %passthrough
|
|
.LP
|
|
means that 42 packets have been sent to an
|
|
.BR eroute
|
|
that has been set up to pass the traffic from the subnet
|
|
.BR 192.168.6.0
|
|
with a subnet mask of
|
|
.BR 24
|
|
bits and to subnet
|
|
.BR 192.168.7.0
|
|
with a subnet mask of
|
|
.BR 24
|
|
bits without any IPSEC processing with no identies defined for either end.
|
|
.LP
|
|
.B 2112 192.168.8.55/32:0 -> 192.168.9.47/24:0 => %hold (east) ()
|
|
.LP
|
|
means that 2112 packets have been sent to an
|
|
.BR eroute
|
|
that has been set up to hold the traffic from the host
|
|
.BR 192.168.8.55
|
|
and to host
|
|
.BR 192.168.9.47
|
|
until a key exchange from a Key Management daemon
|
|
succeeds and puts in an SA or fails and puts in a pass
|
|
or drop eroute depending on the default configuration with the local client
|
|
defined as "east" and no identy defined for the remote end.
|
|
.LP
|
|
.B "2001 192.168.2.110/32:0 -> 192.168.2.120/32:0 => "
|
|
.br
|
|
.B " esp0xe6de@192.168.2.120:0 () ()"
|
|
.LP
|
|
means that 2001 packets have been sent to an
|
|
.BR eroute
|
|
that has been set up to protect traffic between the host
|
|
.BR 192.168.2.110
|
|
and the host
|
|
.BR 192.168.2.120
|
|
using
|
|
.BR 192.168.2.110
|
|
as a security gateway on this end of the
|
|
connection and the machine
|
|
.BR 192.168.2.120
|
|
on the other end of the connection with a Security Association IDentifier of
|
|
.BR esp0xe6de@192.168.2.120
|
|
which means that it is a transport mode connection with a Security
|
|
Parameters Index of
|
|
.BR e6de
|
|
in hexadecimal using Encapsuation Security Payload protocol (50,
|
|
IPPROTO_ESP) with no identies defined for either end.
|
|
.LP
|
|
.B "1984 3049:1::110/128 -> 3049:1::120/128 => "
|
|
.br
|
|
.B " ah:f5ed@3049:1::120 () ()"
|
|
.LP
|
|
means that 1984 packets have been sent to an
|
|
.BR eroute
|
|
that has been set up to authenticate traffic between the host
|
|
.BR 3049:1::110
|
|
and the host
|
|
.BR 3049:1::120
|
|
using
|
|
.BR 3049:1::110
|
|
as a security gateway on this end of the
|
|
connection and the machine
|
|
.BR 3049:1::120
|
|
on the other end of the connection with a Security Association IDentifier of
|
|
.BR ah:f5ed@3049:1::120
|
|
which means that it is a transport mode connection with a Security
|
|
Parameters Index of
|
|
.BR f5ed
|
|
in hexadecimal using Authentication Header protocol (51,
|
|
IPPROTO_AH) with no identies defined for either end.
|
|
.SH FILES
|
|
/proc/net/ipsec_eroute, /usr/local/bin/ipsec
|
|
.SH "SEE ALSO"
|
|
ipsec(8), ipsec_manual(8), ipsec_tncfg(5), ipsec_spi(5),
|
|
ipsec_spigrp(5), ipsec_klipsdebug(5), ipsec_eroute(8), ipsec_version(5),
|
|
ipsec_pf_key(5)
|
|
.SH HISTORY
|
|
Written for the Linux FreeS/WAN project
|
|
<http://www.freeswan.org/>
|
|
by Richard Guy Briggs.
|
|
.\"
|
|
.\" $Log: eroute.5,v $
|
|
.\" Revision 1.1 2004/03/15 20:35:27 as
|
|
.\" added files from freeswan-2.04-x509-1.5.3
|
|
.\"
|
|
.\" Revision 1.9 2002/04/24 07:35:38 mcr
|
|
.\" Moved from ./klips/utils/eroute.5,v
|
|
.\"
|
|
.\" Revision 1.8 2001/09/20 15:33:13 rgb
|
|
.\" PF_KEYv2 ident extension output documentation.
|
|
.\"
|
|
.\" Revision 1.7 2001/05/29 05:15:31 rgb
|
|
.\" Added packet count field at beginning of line.
|
|
.\"
|
|
.\" Revision 1.6 2001/02/26 19:58:32 rgb
|
|
.\" Put SAID elements in order they appear in SAID.
|
|
.\" Implement magic SAs %drop, %reject, %trap, %hold, %pass as part
|
|
.\" of the new SPD and to support opportunistic.
|
|
.\"
|
|
.\" Revision 1.5 2000/09/17 18:56:48 rgb
|
|
.\" Added IPCOMP support.
|
|
.\"
|
|
.\" Revision 1.4 2000/09/13 15:54:31 rgb
|
|
.\" Added Gerhard's ipv6 updates.
|
|
.\"
|
|
.\" Revision 1.3 2000/06/30 18:21:55 rgb
|
|
.\" Update SEE ALSO sections to include ipsec_version(5) and ipsec_pf_key(5)
|
|
.\" and correct FILES sections to no longer refer to /dev/ipsec which has
|
|
.\" been removed since PF_KEY does not use it.
|
|
.\"
|
|
.\" Revision 1.2 2000/06/28 12:44:11 henry
|
|
.\" format touchup
|
|
.\"
|
|
.\" Revision 1.1 2000/06/28 05:43:00 rgb
|
|
.\" Added manpages for all 5 klips utils.
|
|
.\"
|
|
.\"
|
|
.\"
|