diff options
| author | Andreas Steffen <andreas.steffen@strongswan.org> | 2013-01-06 08:43:51 +0100 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2013-01-17 16:55:00 +0100 |
| commit | d815235d17a0391fa5f72bb61a37b3a9fc57cdc7 (patch) | |
| tree | f890eab0bb94ae133809a471e2f3b3e363cfcae0 /testing/tests/ikev2/nat-rw-psk | |
| parent | 28b7db2b3c09acb617d38dae07611a9b833aee33 (diff) | |
| download | strongswan-d815235d17a0391fa5f72bb61a37b3a9fc57cdc7.tar.bz2 strongswan-d815235d17a0391fa5f72bb61a37b3a9fc57cdc7.tar.xz | |
use iptables-restore in all ikev2 firewall scenarios
Diffstat (limited to 'testing/tests/ikev2/nat-rw-psk')
| -rw-r--r-- | testing/tests/ikev2/nat-rw-psk/hosts/sun/etc/iptables.rules | 24 | ||||
| -rw-r--r-- | testing/tests/ikev2/nat-rw-psk/posttest.dat | 6 | ||||
| -rw-r--r-- | testing/tests/ikev2/nat-rw-psk/pretest.dat | 6 |
3 files changed, 30 insertions, 6 deletions
diff --git a/testing/tests/ikev2/nat-rw-psk/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/nat-rw-psk/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..ae8f9a61e --- /dev/null +++ b/testing/tests/ikev2/nat-rw-psk/hosts/sun/etc/iptables.rules @@ -0,0 +1,24 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow IKE +-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + +COMMIT diff --git a/testing/tests/ikev2/nat-rw-psk/posttest.dat b/testing/tests/ikev2/nat-rw-psk/posttest.dat index 52572ece8..4643a3a7b 100644 --- a/testing/tests/ikev2/nat-rw-psk/posttest.dat +++ b/testing/tests/ikev2/nat-rw-psk/posttest.dat @@ -1,8 +1,8 @@ sun::ipsec stop alice::ipsec stop venus::ipsec stop -alice::/etc/init.d/iptables stop 2> /dev/null -venus::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null +alice::iptables-restore < /etc/iptables.flush +venus::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush moon::iptables -t nat -F moon::conntrack -F diff --git a/testing/tests/ikev2/nat-rw-psk/pretest.dat b/testing/tests/ikev2/nat-rw-psk/pretest.dat index 6a542ec8f..3a768578e 100644 --- a/testing/tests/ikev2/nat-rw-psk/pretest.dat +++ b/testing/tests/ikev2/nat-rw-psk/pretest.dat @@ -1,6 +1,6 @@ -alice::/etc/init.d/iptables start 2> /dev/null -venus::/etc/init.d/iptables start 2> /dev/null -sun::/etc/init.d/iptables start 2> /dev/null +alice::iptables-restore < /etc/iptables.rules +venus::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules moon::echo 1 > /proc/sys/net/ipv4/ip_forward moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 |