ipsecDB.Notes

Server must be servergateway mode - need the action script to check this

config show SystemMode
SystemMode=servergateway


#Per connection settings like this

ipsec_connections configs

db ipsec_connections set workToVoip ipsec status disabled leftsourceip 192.168.10.100 leftsubnet 192.168.10.100/24 right 1.2.3.4 rightsubnet 10.0.0.0/24 passwd MyPassWd


[root@test]# db ipsec_connections show
workToVoip=ipsec
    leftsourceip=192.168.10.100
    leftsubnet=192.168.10.0/24
    passwd=MyPassWd
    right=1.2.3.4
    rightsubnet=10.0.0.0/24
    status=disabled


Config Defaults

config set ipsec service status disabled connection type tunnel left %defaultroute ikelifetime 28800s keylife 3600s dpdaction restart dpddelay 30 dpdtimeout 10 pfs yes auto start

----------------------------------------------------------

Also can set the firewall ports and dispense with the masq fragment later.
http://wiki.contribs.org/DB_Variables_Configuration#IPTables_firewall_.28masq.29

Need to add this and remove the masq template :

ipsec only - note that ESP traffic runs on 50 and AH needs 51

config setprop ipsec access public UDPPorts 500,4500 TCPPort 50,51

l2tpd

config setprop ipsec access public UDPPorts 500,4500,1701 TCPPort 50,51

----------------------------------------------------------

[root@test ipsec.d]# config show ipsec
ipsec=service
    auto=start
    connectiontype=tunnel
    dpdaction=restart
    dpddelay=30
    dpdtimeout=10
    ikelifetime=28800s
    keylife=3600s
    left=%defaultroute
    pfs=yes
    status=disabled


Any setting in the db ipsec_connections will override the defualt settings in the config db (or should !) If there is no setting the system will set a default.

There is now a new action script called ipsec-update.

Make your changes and then signal-event ipsec-update to action them.

Note that as it is very difficult currently to detect connections that are up (something libreswan are working on) the script does not try to detect connection status so it will reset them currently.

Just discovered we can probably do this with ipsec whack --status |grep "Ipsec SA established"
https://lists.libreswan.org/pipermail/swan/2015/001083.html

Any question then please ask at forums.contribs.org in the Contribs sections.