Content-type: text/html Manpage of IPSEC_EROUTE

IPSEC_EROUTE

Section: Maintenance Commands (8)
Updated: 21 Jun 2000
Index Return to Main Contents

NAME

ipsec eroute - manipulate IPSEC extended routing tables

SYNOPSIS

ipsec eroute

ipsec eroute --add --src src/srcmaskbits|srcmask --dst dst/dstmaskbits|dstmask <SAID>

ipsec eroute --replace --src src/srcmaskbits|srcmask --dst dst/dstmaskbits|dstmask <SAID>

ipsec eroute --del --src src/srcmaskbits|srcmask --dst dst/dstmaskbits|dstmask

ipsec eroute --clear

ipsec eroute --help

ipsec eroute --version

Where <SAID> is --edst edst --spi spi --proto proto OR --said said OR --said %passthrough

DESCRIPTION

Eroute manages the IPSEC extended routing tables, which control what (if any) processing is applied to non-encrypted packets arriving for IPSEC processing and forwarding. The form with no additional arguments lists the contents of /proc/net/ipsec_eroute. The --add form adds a table entry, the --replace form replaces a table entry, while the --del form deletes one. The --clear form deletes the entire table.

A table entry consists of:

+: source and destination addresses, with masks, for selection of packets
+: Security Association IDentifier, comprised of:
+: effective destination (edst), where the packet should be forwarded after processing (normally the other security gateway)
+: Security Parameters Index (spi), indicating (together with the effective destination and protocol) which Security Association should be used to process the packet
+: protocol (proto), indicating (together with the effective destination and the security parameters index) which Security Association should be used to process the packet
+: OR
+: SAID (said), indicating which Security Association should be used to process the packet

Addresses are written as IPv4 dotted quads, SPIs are '0x'-prefixed hexadecimal numbers and protocol is one of "ah", "esp" or "tun".

SAIDs are written as "proto0xSPI@address".

The format of /proc/net/ipsec_eroute is listed in ipsec_eroute(5).

EXAMPLES

ipsec eroute --add --src 192.168.0.1/32 \
--dst 192.168.2.0/24 --edst 192.168.0.2 \
--spi 0x135 --proto tun

sets up an eroute on a Security Gateway to protect traffic between the host 192.168.0.1 and the subnet 192.168.2.0 with 24 bits of subnet mask via Security Gateway 192.168.0.2 using the Security Association with address 192.168.0.2, Security Parameters Index 0x135 and protocol tun (50, IPPROTO_ESP).

ipsec eroute --replace --src company.com/24 \
--dst ftp.ngo.org/32 --said tun0x135@gw.ngo.org

replaces an eroute on a Security Gateway to protect traffic between the subnet company.com with 24 bits of subnet mask and the host ftp.ngo.org via Security Gateway gw.ngo.org using the Security Association with Security Association ID tun0x135@gw.ngo.org

ipsec eroute --del --src company.com/24 \
--dst www.ietf.org/32 --said %passthrough

deletes an eroute on a Security Gateway that allowed traffic between the subnet company.com with 24 bits of subnet mask and the host www.ietf.org to pass in the clear, unprocessed.

FILES

/proc/net/ipsec_eroute, /usr/local/bin/ipsec

HISTORY

Written for the Linux FreeS/WAN project <http://www.freeswan.org/> by Richard Guy Briggs.

This document was created by man2html, using the manual pages.
Time: 02:46:47 GMT, July 02, 2000