use static IPsec policy iptables rule for alice in mobike scenario

diff --git a/testing/tests/ikev2/mobike/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/mobike/hosts/alice/etc/init.d/iptables
index db18182a3f40b30be803b4a71bc415fc0854cb1b..cf0d65c58256242bd9e80b74ec3bbeed98b6578f 100755 (executable)
--- a/testing/tests/ikev2/mobike/hosts/alice/etc/init.d/iptables
+++ b/testing/tests/ikev2/mobike/hosts/alice/etc/init.d/iptables
@@ -17,6 +17,10 @@ start() {
        /sbin/iptables -P OUTPUT DROP
        /sbin/iptables -P FORWARD DROP
 
+        # allow IPsec tunnel traffic
+        iptables -A INPUT  -m policy --dir in  --pol ipsec --proto esp -j ACCEPT
+        iptables -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
+
        # allow esp
        iptables -A INPUT  -i eth0 -p 50 -j ACCEPT
        iptables -A INPUT  -i eth1 -p 50 -j ACCEPT

diff --git a/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf
index 37e92cf5b68b1f012b7a6ec271848837e9c084a2..6c87468bb61f2cdabe3ebf5af2d40eabb92c0028 100755 (executable)
--- a/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf
+++ b/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf
@@ -16,7 +16,6 @@ conn mobike
        left=PH_IP_ALICE1
        leftcert=aliceCert.pem
        leftid=alice@strongswan.org
-       leftfirewall=yes
        right=PH_IP_SUN
        rightid=@sun.strongswan.org
        rightsubnet=10.2.0.0/16