<html><head></head><body dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">I have a use case where we’re connecting a remote subnet to a strongswan 5.3.5 or 5.4.0 gateway running in AWS. Because of the way the hosts are scattered amongst the VPC, we can’t group them in to a small block and advertise just that block (say a /28 worth of hosts out of the subnet).<br><br>What I would like to do is filter the remote network to the hosts we do want to allow access to in the AWS subnet at the gateway via iptables. For example, remote network 192.168.10.0/24 is allowed access to 100.64.7.3 tcp port 3389.<br><br>I’m drawing a blank as to how to properly filter it using iptables. <br><br>There are FORWARDing rules in place installed by strongswan for ipsec for the two respective subnets.<br><br>Which chain, if any, would handle filtering th deencapsulated traffic from the tunnel going out from the gateway to the left subnet?<br><br>Basically, we want to ACL the traffic coming across the tunnel at the GW.<br><br>Any thoughts or pointers appreciated.<br><br>Thanks<br><br>EKG<br><br></body></html>