diff options
| author | Andreas Steffen <andreas.steffen@strongswan.org> | 2013-01-06 08:43:51 +0100 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2013-01-17 16:55:00 +0100 |
| commit | d815235d17a0391fa5f72bb61a37b3a9fc57cdc7 (patch) | |
| tree | f890eab0bb94ae133809a471e2f3b3e363cfcae0 /testing/tests/ikev2/double-nat-net | |
| parent | 28b7db2b3c09acb617d38dae07611a9b833aee33 (diff) | |
| download | strongswan-d815235d17a0391fa5f72bb61a37b3a9fc57cdc7.tar.bz2 strongswan-d815235d17a0391fa5f72bb61a37b3a9fc57cdc7.tar.xz | |
use iptables-restore in all ikev2 firewall scenarios
Diffstat (limited to 'testing/tests/ikev2/double-nat-net')
| -rw-r--r-- | testing/tests/ikev2/double-nat-net/hosts/bob/etc/iptables.rules | 24 | ||||
| -rw-r--r-- | testing/tests/ikev2/double-nat-net/posttest.dat | 4 | ||||
| -rw-r--r-- | testing/tests/ikev2/double-nat-net/pretest.dat | 4 |
3 files changed, 28 insertions, 4 deletions
diff --git a/testing/tests/ikev2/double-nat-net/hosts/bob/etc/iptables.rules b/testing/tests/ikev2/double-nat-net/hosts/bob/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev2/double-nat-net/hosts/bob/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/double-nat-net/posttest.dat b/testing/tests/ikev2/double-nat-net/posttest.dat index 484297418..63d4f98e7 100644 --- a/testing/tests/ikev2/double-nat-net/posttest.dat +++ b/testing/tests/ikev2/double-nat-net/posttest.dat @@ -1,7 +1,7 @@ bob::ipsec stop alice::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -bob::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +bob::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F sun::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/ikev2/double-nat-net/pretest.dat b/testing/tests/ikev2/double-nat-net/pretest.dat index 41b69aed6..0fe51b9e8 100644 --- a/testing/tests/ikev2/double-nat-net/pretest.dat +++ b/testing/tests/ikev2/double-nat-net/pretest.dat @@ -1,5 +1,5 @@ -alice::/etc/init.d/iptables start 2> /dev/null -bob::/etc/init.d/iptables start 2> /dev/null +alice::iptables-restore < /etc/iptables.rules +bob::iptables-restore < /etc/iptables.rules bob::echo 1 > /proc/sys/net/ipv4/ip_forward moon::echo 1 > /proc/sys/net/ipv4/ip_forward sun::echo 1 > /proc/sys/net/ipv4/ip_forward |