[strongSwan] Isolate clients and force local network traffic toan interface
ncore at nic.fi
Wed Nov 29 20:15:37 CET 2017
I have 3 interfaces:
WAN, where clients are connecting.
LAN/10.11.0.0/16, this is network where clients get IP address.
FILTER/eth2, where all clients traffic are routed here.
I have 2 clients, client 1 IP 10.11.0.55 and client 2 IP 10.11.0.56.
Here are ip route and iptables rules.
ip rule add from 10.11.0.0/16 table FILTER
ip route add default dev eth2 table FILTER
When client 1 ping 188.8.131.52, I see the traffic go to eth2 interface.
But when client 1 ping client 2, I don’t see the traffic go to eth2 interface. How do I force also local network 10.11.0.0/16 traffic to eth2 interface for filtering.
From: Noel Kuntze
Sent: Wednesday, November 29, 2017 10:56 AM
To: Loc Nguyen; users at lists.strongswan.org
Subject: Re: [strongSwan] Isolate clients and force local network traffic toan interface
I can't tell what exactly you want. You can tell if traffic was protected with ipsec by using the iptables policy match module.
You can use a VTI, too.
On 28.11.2017 20:37, Loc Nguyen wrote:
> I create an IPsec network 10.11.0.0/16 and using dnsmasq to assign IP addresses.
> I able to route all 10.11.0.0/16 network traffic to an interface. I would like also route local network 10.11.0.0/16 between client to client to that interface too.
> I can use iptables FORWARD to block client to client. Instead of blocking I want the traffic to the interface.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Users