Re: new iptables policy match

[Patrick McHardy <kaber@trash.net>]

Greg Scott wrote:
>>No, the tunnel endpoints are the hosts using the 
>>tunnel-mode SA, so in this case both firewalls.
> 
> 
> OK, so now I'm confused.  And admittedly, IPSEC has made
> me crazy for several years.  Which NICs on the firewalls
> are the endpoints?  Is this picture better and more accurate?
> 
> 
>   LAN             Internet             LAN
>  <----+--FW---+-------------+--FW---+----->
>       |       |             |       |
> NIC with  NIC with      NIC with  NIC with
> private    public        public   private
>   IP        IP <---------> IP       IP
>                    SA
>           Tunnel          Tunnel
>          endpoint        endpoint
> 
> So the public NICs are the tunnel endpoints?

Yes. Its very simple, the endpoints are the addresses you specify
in the policy in the tunnel section (x.x.x.x and y.y.y.y):

spdadd net/mask net/mask any ipsec out
	tunnel/x.x.x.x-y.y.y.y/require;