Content-type: text/html
ipsec eroute --add --eraf (inet | inet6) --src src/srcmaskbits|srcmask --dst dst/dstmaskbits|dstmask <SAID>
ipsec eroute --replace --eraf (inet | inet6) --src src/srcmaskbits|srcmask --dst dst/dstmaskbits|dstmask <SAID>
ipsec eroute --del --eraf (inet | inet6) --src src/srcmaskbits|srcmask --dst dst/dstmaskbits|dstmask
ipsec eroute --clear
ipsec eroute --help
ipsec eroute --version
Where <SAID> is --af (inet | inet6) --edst edst --spi spi --proto proto OR --said said OR --said (%passthrough | %passthrough4 | %passthrough6)
A table entry consists of:
Addresses are written as IPv4 dotted quads or IPv6 coloned hex, protocol is one of "ah", "esp", "comp" or "tun" and SPIs are prefixed hexadecimal numbers where '.' represents IPv4 and ':' stands for IPv6.
SAIDs are written as "protoafSPI@address". There are also 5 "magic" SAIDs which have special meaning:
The format of /proc/net/ipsec_eroute is listed in ipsec_eroute(5).
ipsec eroute --add --eraf inet --src 192.168.0.1/32 \
--dst 192.168.2.0/24 --af inet --edst 192.168.0.2 \
--spi 0x135 --proto tun
sets up an eroute on a Security Gateway to protect traffic between the host 192.168.0.1 and the subnet 192.168.2.0 with 24 bits of subnet mask via Security Gateway 192.168.0.2 using the Security Association with address 192.168.0.2, Security Parameters Index 0x135 and protocol tun (50, IPPROTO_ESP).
ipsec eroute --add --eraf inet6 --src 3049:1::1/128 \
--dst 3049:2::/64 --af inet6 --edst 3049:1::2 \
--spi 0x145 --proto tun
sets up an eroute on a Security Gateway to protect traffic between the host 3049:1::1 and the subnet 3049:2:: with 64 bits of subnet mask via Security Gateway 3049:1::2 using the Security Association with address 3049:1::2, Security Parameters Index 0x145 and protocol tun (50, IPPROTO_ESP).
ipsec eroute --replace --eraf inet --src company.com/24 \
--dst ftp.ngo.org/32 --said tun.135@gw.ngo.org
replaces an eroute on a Security Gateway to protect traffic between the subnet company.com with 24 bits of subnet mask and the host ftp.ngo.org via Security Gateway gw.ngo.org using the Security Association with Security Association ID tun0x135@gw.ngo.org
ipsec eroute --del --eraf inet --src company.com/24 \
--dst www.ietf.org/32 --said %passthrough4
deletes an eroute on a Security Gateway that allowed traffic between the subnet company.com with 24 bits of subnet mask and the host www.ietf.org to pass in the clear, unprocessed.