From 0de7cc50ac420b3a635a342197a0174d5eeb4e1d Mon Sep 17 00:00:00 2001
From: Michael Tremer <michael.tremer@ipfire.org>
Date: Thu, 14 Jan 2021 18:54:03 +0000
Subject: [PATCH] IPsec: Disable XFRM policy lookup for VTI devices

This speeds up throughput slightly

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---
 src/scripts/ipsec-interfaces | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/scripts/ipsec-interfaces b/src/scripts/ipsec-interfaces
index 2546f8927d..f0983dbdc3 100644
--- a/src/scripts/ipsec-interfaces
+++ b/src/scripts/ipsec-interfaces
@@ -228,6 +228,11 @@ main() {
 			ip addr flush dev "${intf}"
 			ip addr add "${interface_address}" dev "${intf}"
 
+			# Disable IPsec policy lookup for VTI
+			if [ "${interface_mode}" = "vti" ]; then
+				sysctl -qw "net.ipv4.conf.${intf}.disable_policy=1"
+			fi
+
 			# Set MTU
 			ip link set dev "${intf}" mtu "${interface_mtu}"
 
-- 
2.39.5