[strongSwan] Rule Priorities Across Connections

Jafar Al-Gharaibeh jafar at atcorp.com
Thu Oct 5 18:24:51 CEST 2017


     I know that the most specific rule is applied a given traffic if 
multiple overlapping rules exist. But How is the priority determined 
when rules are specific in different ways Like the cases below. Not sure 
if this is a strongSwan question or a OS Kernel question  as it seems 
this is more of how the Linux  kernel handles it for example, but I hope 
someone here can shed some light on this subject.

Example 1:

Connection 1 :

Connection 2 :

If a udp packet is going to, which connection config will be 
use? Does the priority starts with subnet where the most specific subnet 
takes precedence before moving to protocols/ports?

What is the priority between the protocols and ports themselves?

Example 2:

Connection 1 :

Connection 2 :

For a packet going from to,  based on the source 
connection 1 has higher priority, but based on the destination 
connection 2 has a higher priority. How is this handled?


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20171005/4dd3488c/attachment.html>

More information about the Users mailing list