From: Michael Tremer <michael.tremer@ipfire.org>
Date: Thu, 14 Jan 2021 18:54:03 +0000 (+0000)
Subject: IPsec: Disable XFRM policy lookup for VTI devices
X-Git-Tag: v2.25-core155~246
X-Git-Url: http://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff_plain;h=0de7cc50ac420b3a635a342197a0174d5eeb4e1d

IPsec: Disable XFRM policy lookup for VTI devices

This speeds up throughput slightly

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/src/scripts/ipsec-interfaces b/src/scripts/ipsec-interfaces
index 2546f8927d..f0983dbdc3 100644
--- a/src/scripts/ipsec-interfaces
+++ b/src/scripts/ipsec-interfaces
@@ -228,6 +228,11 @@ main() {
 			ip addr flush dev "${intf}"
 			ip addr add "${interface_address}" dev "${intf}"
 
+			# Disable IPsec policy lookup for VTI
+			if [ "${interface_mode}" = "vti" ]; then
+				sysctl -qw "net.ipv4.conf.${intf}.disable_policy=1"
+			fi
+
 			# Set MTU
 			ip link set dev "${intf}" mtu "${interface_mtu}"