testing: Speed up ifdown calls in ikev2/mobike scenarios

ifdown calls bind's rndc, which tries to access TCP port 953 on lo.
If these packets are dropped by the firewall we have to wait for the TCP
connections to time out, which takes quite a while.

diff --git a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/iptables.rules b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/iptables.rules
index 6dd261f2070cdfae995421eedb6aeda9239be9fa..450e7cef6d13e3466d4cafbf45024215f3659978 100644 (file)
--- a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/iptables.rules
+++ b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/iptables.rules
@@ -5,11 +5,15 @@
 -P OUTPUT DROP
 -P FORWARD DROP
 
+# allow traffic on lo as ifup/ifdown call bind's rndc which accesses TCP 953
+-A OUTPUT -o lo -j ACCEPT
+-A INPUT -i lo -j ACCEPT
+
 # allow IPsec tunnel traffic
 -A INPUT  -m policy --dir in  --pol ipsec --proto esp -j ACCEPT
 -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
 
-# allow ESP 
+# allow ESP
 -A INPUT  -i eth0 -p 50 -j ACCEPT
 -A INPUT  -i eth1 -p 50 -j ACCEPT
 -A OUTPUT -o eth0 -p 50 -j ACCEPT

diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/iptables.rules b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/iptables.rules
index a238c8d19cf6a8248c13867f2a9c8abf369fb61e..450e7cef6d13e3466d4cafbf45024215f3659978 100644 (file)
--- a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/iptables.rules
+++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/iptables.rules
@@ -5,6 +5,10 @@
 -P OUTPUT DROP
 -P FORWARD DROP
 
+# allow traffic on lo as ifup/ifdown call bind's rndc which accesses TCP 953
+-A OUTPUT -o lo -j ACCEPT
+-A INPUT -i lo -j ACCEPT
+
 # allow IPsec tunnel traffic
 -A INPUT  -m policy --dir in  --pol ipsec --proto esp -j ACCEPT
 -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT

diff --git a/testing/tests/ikev2/mobike/hosts/alice/etc/iptables.rules b/testing/tests/ikev2/mobike/hosts/alice/etc/iptables.rules
index a238c8d19cf6a8248c13867f2a9c8abf369fb61e..450e7cef6d13e3466d4cafbf45024215f3659978 100644 (file)
--- a/testing/tests/ikev2/mobike/hosts/alice/etc/iptables.rules
+++ b/testing/tests/ikev2/mobike/hosts/alice/etc/iptables.rules
@@ -5,6 +5,10 @@
 -P OUTPUT DROP
 -P FORWARD DROP
 
+# allow traffic on lo as ifup/ifdown call bind's rndc which accesses TCP 953
+-A OUTPUT -o lo -j ACCEPT
+-A INPUT -i lo -j ACCEPT
+
 # allow IPsec tunnel traffic
 -A INPUT  -m policy --dir in  --pol ipsec --proto esp -j ACCEPT
 -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT