1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
# /etc/ipsec.d/oe-upgrade-authnull.conf
#
# Example file for Opportunstic Encryption using Auth NULL
# Traffic should flow in the clear until IKE succeeds. Fail open.
# This makes IPsec encryption "nice to have - not required"
# Because it uses Auth NULL, there is no protection against active MITM attacks
#
# See also oe.authnull.conf
conn clear
type=passthrough
# temp workaround
#authby=never
authby=null
leftid=%null
rightid=%null
left=%defaultroute
right=%group
auto=route
conn clear-or-private
type=tunnel
authby=null
leftid=%null
rightid=%null
left=%defaultroute
right=%opportunisticgroup
negotiationshunt=passthrough
failureshunt=passthrough
ikev2=insist
# add, not route - because this policy is only for incoming IKE packets
auto=add
conn private-or-clear
type=tunnel
authby=null
leftid=%null
rightid=%null
left=%defaultroute
right=%opportunisticgroup
negotiationshunt=passthrough
failureshunt=passthrough
ikev2=insist
auto=route
keyingtries=1
retransmit-timeout=2s
# To support being behind NAT
leftmodecfgclient=yes
leftcat=yes
narrowing=yes
conn private
type=tunnel
authby=null
leftid=%null
rightid=%null
left=%defaultroute
right=%opportunisticgroup
# if we fail hard, we might as well hold traffic during IKE too
negotiationshunt=hold
failureshunt=drop
ikev2=insist
auto=route
conn block
type=reject
# temp workaround
#authby=never
authby=null
leftid=%null
rightid=%null
left=%defaultroute
right=%group
auto=route
|
