use static IPsec policy netfilter rules in MOBIKE scenarios

diff --git a/testing/tests/ikev2/mobike-nat/description.txt b/testing/tests/ikev2/mobike-nat/description.txt
index ba8fc5bf0970ee301a879852d44d1fb492470ec3..428ac08830d4db8cc5493e7cd9ab27d9c2fae16a 100644 (file)
--- a/testing/tests/ikev2/mobike-nat/description.txt
+++ b/testing/tests/ikev2/mobike-nat/description.txt
@@ -1,5 +1,5 @@
 The roadwarrior <b>alice</b> is sitting behind the NAT router <b>moon</b> but
-at the outset of the scenariou is also directly connected to the 192.168.0.0/24 network
+at the outset of the scenario is also directly connected to the 192.168.0.0/24 network
 via an additional <b>eth1</b> interface. <b>alice</b> builds up a tunnel to gateway <b>sun</b>
 in order to reach <b>bob</b> in the subnet behind. When the <b>eth1</b> interface
 goes away, <b>alice</b> switches to <b>eth0</b> and signals the IP address change 

diff --git a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/init.d/iptables
index db18182a3f40b30be803b4a71bc415fc0854cb1b..cf0d65c58256242bd9e80b74ec3bbeed98b6578f 100755 (executable)
--- a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/init.d/iptables
+++ b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/init.d/iptables
@@ -17,6 +17,10 @@ start() {
        /sbin/iptables -P OUTPUT DROP
        /sbin/iptables -P FORWARD DROP
 
+        # allow IPsec tunnel traffic
+        iptables -A INPUT  -m policy --dir in  --pol ipsec --proto esp -j ACCEPT
+        iptables -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
+
        # allow esp
        iptables -A INPUT  -i eth0 -p 50 -j ACCEPT
        iptables -A INPUT  -i eth1 -p 50 -j ACCEPT

diff --git a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/ipsec.conf
index 5c93d1462ab0082bbbb498c06d822e6b5444a4ab..ed670efb1e1bd4db4c8210f523b88ffc80580ed0 100755 (executable)
--- a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/ipsec.conf
+++ b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/ipsec.conf
@@ -17,7 +17,6 @@ conn mobike
        leftsourceip=%config
        leftcert=aliceCert.pem
        leftid=alice@strongswan.org
-       leftfirewall=yes
        right=PH_IP_SUN
        rightid=@sun.strongswan.org
        rightsubnet=10.2.0.0/16

diff --git a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/strongswan.conf b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/strongswan.conf
index 06b1e9f4892f3fb4db4496be7c0f3c0c49c2e5f3..572cf39cbca66dce76b7c68180d9303d4d11e7f3 100644 (file)
--- a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/strongswan.conf
+++ b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/strongswan.conf
@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink updown
+  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink
 }

diff --git a/testing/tests/ikev2/mobike-nat/hosts/sun/etc/init.d/iptables b/testing/tests/ikev2/mobike-nat/hosts/sun/etc/init.d/iptables
new file mode 100755 (executable)
index 0000000..642c414
--- /dev/null
+++ b/testing/tests/ikev2/mobike-nat/hosts/sun/etc/init.d/iptables
@@ -0,0 +1,84 @@
+#!/sbin/runscript
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+opts="start stop reload"
+
+depend() {
+       before net
+       need logger
+}
+
+start() {
+       ebegin "Starting firewall"
+
+       # enable IP forwarding
+       echo 1 > /proc/sys/net/ipv4/ip_forward
+       
+       # default policy is DROP
+       /sbin/iptables -P INPUT DROP
+       /sbin/iptables -P OUTPUT DROP
+       /sbin/iptables -P FORWARD DROP
+
+       # allow IPsec tunnel traffic
+       iptables -A FORWARD -m policy --dir in  --pol ipsec --proto esp -j ACCEPT
+       iptables -A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT
+
+       # allow esp
+       iptables -A INPUT  -i eth0 -p 50 -j ACCEPT
+       iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+       # allow IKE
+       iptables -A INPUT  -i eth0 -p udp --dport 500 -j ACCEPT
+       iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+        # allow NAT-T 
+       iptables -A INPUT  -i eth0 -p udp --dport 4500 -j ACCEPT
+       iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+       # allow crl fetch from winnetou
+       iptables -A INPUT  -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+       iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+       # allow ssh
+       iptables -A INPUT  -p tcp --dport 22 -j ACCEPT
+       iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+       eend $?
+}
+
+stop() {
+       ebegin "Stopping firewall"
+               for a in `cat /proc/net/ip_tables_names`; do
+                       /sbin/iptables -F -t $a
+                       /sbin/iptables -X -t $a
+       
+                       if [ $a == nat ]; then
+                               /sbin/iptables -t nat -P PREROUTING ACCEPT
+                               /sbin/iptables -t nat -P POSTROUTING ACCEPT
+                               /sbin/iptables -t nat -P OUTPUT ACCEPT
+                       elif [ $a == mangle ]; then
+                               /sbin/iptables -t mangle -P PREROUTING ACCEPT
+                               /sbin/iptables -t mangle -P INPUT ACCEPT
+                               /sbin/iptables -t mangle -P FORWARD ACCEPT
+                               /sbin/iptables -t mangle -P OUTPUT ACCEPT
+                               /sbin/iptables -t mangle -P POSTROUTING ACCEPT
+                       elif [ $a == filter ]; then
+                               /sbin/iptables -t filter -P INPUT ACCEPT
+                               /sbin/iptables -t filter -P FORWARD ACCEPT
+                               /sbin/iptables -t filter -P OUTPUT ACCEPT
+                       fi
+               done
+       eend $?
+}
+
+reload() {
+       ebegin "Flushing firewall"
+               for a in `cat /proc/net/ip_tables_names`; do
+                       /sbin/iptables -F -t $a
+                       /sbin/iptables -X -t $a
+               done;
+        eend $?
+       start
+}
+

diff --git a/testing/tests/ikev2/mobike-nat/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/mobike-nat/hosts/sun/etc/ipsec.conf
index d6121511edd65716750d3168695ab983432b028c..ca4d84e16e472d0e5af42e8e16544cf16fc84c11 100755 (executable)
--- a/testing/tests/ikev2/mobike-nat/hosts/sun/etc/ipsec.conf
+++ b/testing/tests/ikev2/mobike-nat/hosts/sun/etc/ipsec.conf
@@ -16,7 +16,6 @@ conn mobike
        left=PH_IP_SUN
        leftcert=sunCert.pem
        leftid=@sun.strongswan.org
-       leftfirewall=yes
        leftsubnet=10.2.0.0/16
        right=%any
        rightsourceip=10.3.0.3

diff --git a/testing/tests/ikev2/mobike-nat/hosts/sun/etc/strongswan.conf b/testing/tests/ikev2/mobike-nat/hosts/sun/etc/strongswan.conf
index 06b1e9f4892f3fb4db4496be7c0f3c0c49c2e5f3..572cf39cbca66dce76b7c68180d9303d4d11e7f3 100644 (file)
--- a/testing/tests/ikev2/mobike-nat/hosts/sun/etc/strongswan.conf
+++ b/testing/tests/ikev2/mobike-nat/hosts/sun/etc/strongswan.conf
@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink updown
+  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink
 }

diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/init.d/iptables
index db18182a3f40b30be803b4a71bc415fc0854cb1b..cf0d65c58256242bd9e80b74ec3bbeed98b6578f 100755 (executable)
--- a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/init.d/iptables
+++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/init.d/iptables
@@ -17,6 +17,10 @@ start() {
        /sbin/iptables -P OUTPUT DROP
        /sbin/iptables -P FORWARD DROP
 
+        # allow IPsec tunnel traffic
+        iptables -A INPUT  -m policy --dir in  --pol ipsec --proto esp -j ACCEPT
+        iptables -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
+
        # allow esp
        iptables -A INPUT  -i eth0 -p 50 -j ACCEPT
        iptables -A INPUT  -i eth1 -p 50 -j ACCEPT

diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/ipsec.conf
index 5c93d1462ab0082bbbb498c06d822e6b5444a4ab..ed670efb1e1bd4db4c8210f523b88ffc80580ed0 100755 (executable)
--- a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/ipsec.conf
+++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/ipsec.conf
@@ -17,7 +17,6 @@ conn mobike
        leftsourceip=%config
        leftcert=aliceCert.pem
        leftid=alice@strongswan.org
-       leftfirewall=yes
        right=PH_IP_SUN
        rightid=@sun.strongswan.org
        rightsubnet=10.2.0.0/16

diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/strongswan.conf b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/strongswan.conf
index 06b1e9f4892f3fb4db4496be7c0f3c0c49c2e5f3..572cf39cbca66dce76b7c68180d9303d4d11e7f3 100644 (file)
--- a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/strongswan.conf
+++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/strongswan.conf
@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink updown
+  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink
 }

diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/init.d/iptables b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/init.d/iptables
new file mode 100755 (executable)
index 0000000..642c414
--- /dev/null
+++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/init.d/iptables
@@ -0,0 +1,84 @@
+#!/sbin/runscript
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+opts="start stop reload"
+
+depend() {
+       before net
+       need logger
+}
+
+start() {
+       ebegin "Starting firewall"
+
+       # enable IP forwarding
+       echo 1 > /proc/sys/net/ipv4/ip_forward
+       
+       # default policy is DROP
+       /sbin/iptables -P INPUT DROP
+       /sbin/iptables -P OUTPUT DROP
+       /sbin/iptables -P FORWARD DROP
+
+       # allow IPsec tunnel traffic
+       iptables -A FORWARD -m policy --dir in  --pol ipsec --proto esp -j ACCEPT
+       iptables -A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT
+
+       # allow esp
+       iptables -A INPUT  -i eth0 -p 50 -j ACCEPT
+       iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+       # allow IKE
+       iptables -A INPUT  -i eth0 -p udp --dport 500 -j ACCEPT
+       iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+        # allow NAT-T 
+       iptables -A INPUT  -i eth0 -p udp --dport 4500 -j ACCEPT
+       iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+       # allow crl fetch from winnetou
+       iptables -A INPUT  -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+       iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+       # allow ssh
+       iptables -A INPUT  -p tcp --dport 22 -j ACCEPT
+       iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+       eend $?
+}
+
+stop() {
+       ebegin "Stopping firewall"
+               for a in `cat /proc/net/ip_tables_names`; do
+                       /sbin/iptables -F -t $a
+                       /sbin/iptables -X -t $a
+       
+                       if [ $a == nat ]; then
+                               /sbin/iptables -t nat -P PREROUTING ACCEPT
+                               /sbin/iptables -t nat -P POSTROUTING ACCEPT
+                               /sbin/iptables -t nat -P OUTPUT ACCEPT
+                       elif [ $a == mangle ]; then
+                               /sbin/iptables -t mangle -P PREROUTING ACCEPT
+                               /sbin/iptables -t mangle -P INPUT ACCEPT
+                               /sbin/iptables -t mangle -P FORWARD ACCEPT
+                               /sbin/iptables -t mangle -P OUTPUT ACCEPT
+                               /sbin/iptables -t mangle -P POSTROUTING ACCEPT
+                       elif [ $a == filter ]; then
+                               /sbin/iptables -t filter -P INPUT ACCEPT
+                               /sbin/iptables -t filter -P FORWARD ACCEPT
+                               /sbin/iptables -t filter -P OUTPUT ACCEPT
+                       fi
+               done
+       eend $?
+}
+
+reload() {
+       ebegin "Flushing firewall"
+               for a in `cat /proc/net/ip_tables_names`; do
+                       /sbin/iptables -F -t $a
+                       /sbin/iptables -X -t $a
+               done;
+        eend $?
+       start
+}
+

diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/ipsec.conf
index 18a67cde09f0ca9dc18adfa0e6d310d597f3abcc..1c8be1db420a8073c7389f54bea189b1c4953590 100755 (executable)
--- a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/ipsec.conf
+++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/ipsec.conf
@@ -16,7 +16,6 @@ conn mobike
        left=PH_IP_SUN
        leftcert=sunCert.pem
        leftid=@sun.strongswan.org
-       leftfirewall=yes
        leftsubnet=10.2.0.0/16
        right=PH_IP_ALICE1
        rightsourceip=10.3.0.3

diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/strongswan.conf b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/strongswan.conf
index 06b1e9f4892f3fb4db4496be7c0f3c0c49c2e5f3..572cf39cbca66dce76b7c68180d9303d4d11e7f3 100644 (file)
--- a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/strongswan.conf
+++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/strongswan.conf
@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink updown
+  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink
 }

diff --git a/testing/tests/ikev2/mobike/hosts/alice/etc/strongswan.conf b/testing/tests/ikev2/mobike/hosts/alice/etc/strongswan.conf
index 06b1e9f4892f3fb4db4496be7c0f3c0c49c2e5f3..572cf39cbca66dce76b7c68180d9303d4d11e7f3 100644 (file)
--- a/testing/tests/ikev2/mobike/hosts/alice/etc/strongswan.conf
+++ b/testing/tests/ikev2/mobike/hosts/alice/etc/strongswan.conf
@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink updown
+  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink
 }

diff --git a/testing/tests/ikev2/mobike/hosts/sun/etc/init.d/iptables b/testing/tests/ikev2/mobike/hosts/sun/etc/init.d/iptables
new file mode 100755 (executable)
index 0000000..6934b19
--- /dev/null
+++ b/testing/tests/ikev2/mobike/hosts/sun/etc/init.d/iptables
@@ -0,0 +1,90 @@
+#!/sbin/runscript
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+opts="start stop reload"
+
+depend() {
+       before net
+       need logger
+}
+
+start() {
+       ebegin "Starting firewall"
+
+        # enable IP forwarding
+        echo 1 > /proc/sys/net/ipv4/ip_forward
+
+       # default policy is DROP
+       /sbin/iptables -P INPUT DROP
+       /sbin/iptables -P OUTPUT DROP
+       /sbin/iptables -P FORWARD DROP
+
+        # allow IPsec tunnel traffic
+        iptables -A FORWARD -m policy --dir in  --pol ipsec --proto esp -j ACCEPT
+        iptables -A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT
+
+       # allow esp
+       iptables -A INPUT  -i eth0 -p 50 -j ACCEPT
+       iptables -A INPUT  -i eth1 -p 50 -j ACCEPT
+       iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
+       iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT
+
+       # allow IKE
+       iptables -A INPUT  -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+       iptables -A INPUT  -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
+       iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+       iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
+
+       # allow MobIKE
+       iptables -A INPUT  -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+       iptables -A INPUT  -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
+       iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+       iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+       # allow crl fetch from winnetou
+       iptables -A INPUT  -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+       iptables -A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+       # allow ssh
+       iptables -A INPUT  -p tcp --dport 22 -j ACCEPT
+       iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+       eend $?
+}
+
+stop() {
+       ebegin "Stopping firewall"
+               for a in `cat /proc/net/ip_tables_names`; do
+                       /sbin/iptables -F -t $a
+                       /sbin/iptables -X -t $a
+       
+                       if [ $a == nat ]; then
+                               /sbin/iptables -t nat -P PREROUTING ACCEPT
+                               /sbin/iptables -t nat -P POSTROUTING ACCEPT
+                               /sbin/iptables -t nat -P OUTPUT ACCEPT
+                       elif [ $a == mangle ]; then
+                               /sbin/iptables -t mangle -P PREROUTING ACCEPT
+                               /sbin/iptables -t mangle -P INPUT ACCEPT
+                               /sbin/iptables -t mangle -P FORWARD ACCEPT
+                               /sbin/iptables -t mangle -P OUTPUT ACCEPT
+                               /sbin/iptables -t mangle -P POSTROUTING ACCEPT
+                       elif [ $a == filter ]; then
+                               /sbin/iptables -t filter -P INPUT ACCEPT
+                               /sbin/iptables -t filter -P FORWARD ACCEPT
+                               /sbin/iptables -t filter -P OUTPUT ACCEPT
+                       fi
+               done
+       eend $?
+}
+
+reload() {
+       ebegin "Flushing firewall"
+               for a in `cat /proc/net/ip_tables_names`; do
+                       /sbin/iptables -F -t $a
+                       /sbin/iptables -X -t $a
+               done;
+        eend $?
+       start
+}
+

diff --git a/testing/tests/ikev2/mobike/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/mobike/hosts/sun/etc/ipsec.conf
index 1367e784f3a8768372a925288ee5f58983de539f..4806cd9c87b8729b3dbe34dddf5adc43c03b3d6c 100755 (executable)
--- a/testing/tests/ikev2/mobike/hosts/sun/etc/ipsec.conf
+++ b/testing/tests/ikev2/mobike/hosts/sun/etc/ipsec.conf
@@ -16,7 +16,6 @@ conn mobike
        left=PH_IP_SUN
        leftcert=sunCert.pem
        leftid=@sun.strongswan.org
-       leftfirewall=yes
        leftsubnet=10.2.0.0/16
        right=PH_IP_ALICE1
        rightid=alice@strongswan.org

diff --git a/testing/tests/ikev2/mobike/hosts/sun/etc/strongswan.conf b/testing/tests/ikev2/mobike/hosts/sun/etc/strongswan.conf
index 06b1e9f4892f3fb4db4496be7c0f3c0c49c2e5f3..572cf39cbca66dce76b7c68180d9303d4d11e7f3 100644 (file)
--- a/testing/tests/ikev2/mobike/hosts/sun/etc/strongswan.conf
+++ b/testing/tests/ikev2/mobike/hosts/sun/etc/strongswan.conf
@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink updown
+  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink
 }