Tobias Brunner
e1ff1eefcf
The manager will allow charon-nm to create XFRM interfaces if supported by the kernel instead of creating an unused dummy TUN interface. The xfrmi tool is mostly obsolete nowadays as iproute2 supports creating XFRM interfaces since 5.1.0 (2019-05). Older Debians don't ship that and early versions didn't list the interface IDs. So there might still be some uses for this tool.
16 lines
643 B
Plaintext
16 lines
643 B
Plaintext
moon::iptables-restore < /etc/iptables.rules
|
|
sun::iptables-restore < /etc/iptables.rules
|
|
moon::ip link add xfrm-moon-out type xfrm dev eth0 if_id 1337
|
|
moon::ip link add xfrm-moon-in type xfrm dev eth0 if_id 42
|
|
moon::ip link set xfrm-moon-out up
|
|
moon::ip link set xfrm-moon-in up
|
|
moon::ip route add 10.2.0.0/16 dev xfrm-moon-out
|
|
moon::iptables -A FORWARD -o xfrm-moon-out -j ACCEPT
|
|
moon::iptables -A FORWARD -i xfrm-moon-in -j ACCEPT
|
|
moon::systemctl start strongswan
|
|
sun::systemctl start strongswan
|
|
moon::expect-connection gw-gw
|
|
sun::expect-connection gw-gw
|
|
moon::swanctl --initiate --child alice-net
|
|
moon::swanctl --initiate --child venus-net
|