IPSEC_EROUTE(5) IPSEC_EROUTE(5)
NAME
ipsec_eroute - list of existing eroutes
SYNOPSIS
ipsec(5,8) eroute(5,8)
cat /proc(5,n)/net/ipsec_eroute
DESCRIPTION
/proc(5,n)/net/ipsec_eroute lists the IPSEC extended routing tables, which
control what (if(3,n) any) processing is applied to non-encrypted packets
arriving for IPSEC processing and forwarding. At this point it is a
read-only file.
A table entry consists of:
+ packet count,
+ source address with mask,
+ a '->' separator for visual and automated parsing between src and
dst
+ destination address with mask
+ a '=>' separator for visual and automated parsing between selection
criteria and SAID to use
+ SAID (Security Association IDentifier), comprised of:
+ protocol (proto),
+ address family (af), where '.' stands for IPv4 and ':' for IPv6
+ Security Parameters Index (SPI),
+ effective destination (edst), where the packet should be for-
warded after processing (normally the other security gateway)
together indicate which Security Association should be used to
process the packet,
+ source identity text string(3,n) with no whitespace, in(1,8) parens,
+ destination identity text string(3,n) with no whitespace, in(1,8) parens
Addresses are written as IPv4 dotted quads or IPv6 coloned hex, proto-
col is one of "ah", "esp", "comp" or "tun" and SPIs are prefixed hexa-
decimal numbers where the prefix '.' is for IPv4 and the prefix ':' is
for IPv6
SAIDs are written as "protoafSPI@edst". There are also 5 "magic(4,5)" SAIDs
which have special meaning:
+ %drop means that matches are to be dropped
+ %reject means that matches are to be dropped and an ICMP returned,
if(3,n) possible to inform
+ %trap means that matches are to trigger an ACQUIRE message to the
Key Management daemon(s) and a hold eroute(5,8) will be put in(1,8) place to
prevent subsequent packets also triggering ACQUIRE messages.
+ %hold means that matches are to stored until the eroute(5,8) is replaced
or until that eroute(5,8) gets(3,n) reaped
+ %pass means that matches are to allowed to pass without IPSEC pro-
cessing
EXAMPLES
1867 172.31.252.0/24 -> 0.0.0.0/0 =>
tun.130@192.168.43.1
() ()
means that 1,867 packets have been sent to an eroute(5,8) that has been set(7,n,1 builtins)
up to protect traffic between the subnet 172.31.252.0 with a subnet
mask of 24 bits and the default address/mask represented by an address
of 0.0.0.0 with a subnet mask of 0 bits using the local machine as a
security gateway on this end of the tunnel and the machine 192.168.43.1
on the other end of the tunnel with a Security Association IDentifier
of tun0x130@192.168.43.1 which means that it is a tunnel mode connec-
tion (4, IPPROTO_IPIP) with a Security Parameters Index of 130 in(1,8) hexa-
decimal with no identies defined for either end.
125 3049:1::/64 -> 0:0/0 => tun:130@3058:4::5 () ()
means that 125 packets have been sent to an eroute(5,8) that has been set(7,n,1 builtins) up
to protect traffic between the subnet 3049:1:: with a subnet mask of 64
bits and the default address/mask represented by an address of 0:0 with
a subnet mask of 0 bits using the local machine as a security gateway
on this end of the tunnel and the machine 3058:4::5 on the other end of
the tunnel with a Security Association IDentifier of tun:130@3058:4::5
which means that it is a tunnel mode connection with a Security Parame-
ters Index of 130 in(1,8) hexadecimal with no identies defined for either
end.
42 192.168.6.0/24 -> 192.168.7.0/24 => %passthrough
means that 42 packets have been sent to an eroute(5,8) that has been set(7,n,1 builtins) up
to pass the traffic from the subnet 192.168.6.0 with a subnet mask of
24 bits and to subnet 192.168.7.0 with a subnet mask of 24 bits without
any IPSEC processing with no identies defined for either end.
2112 192.168.8.55/32 -> 192.168.9.47/24 => %hold (east) ()
means that 2112 packets have been sent to an eroute(5,8) that has been set(7,n,1 builtins)
up to hold the traffic from the host(1,5) 192.168.8.55 and to host(1,5)
192.168.9.47 until a key exchange from a Key Management daemon succeeds
and puts(3,n) in(1,8) an SA or fails and puts(3,n) in(1,8) a pass or drop eroute(5,8) depending
on the default configuration with the local client defined as "east"
and no identy defined for the remote end.
2001 192.168.2.110/32 -> 192.168.2.120/32 =>
esp.e6de@192.168.2.120 () ()
means that 2001 packets have been sent to an eroute(5,8) that has been set(7,n,1 builtins)
up to protect traffic between the host(1,5) 192.168.2.110 and the host(1,5)
192.168.2.120 using 192.168.2.110 as a security gateway on this end of
the connection and the machine 192.168.2.120 on the other end of the
connection with a Security Association IDentifier of
esp.e6de@192.168.2.120 which means that it is a transport mode connec-
tion with a Security Parameters Index of e6de in(1,8) hexadecimal using
Encapsuation Security Payload protocol (50, IPPROTO_ESP) with no iden-
ties defined for either end.
1984 3049:1::110/128 -> 3049:1::120/128 =>
ah:f5ed@3049:1::120 () ()
means that 1984 packets have been sent to an eroute(5,8) that has been set(7,n,1 builtins)
up to authenticate traffic between the host(1,5) 3049:1::110 and the host(1,5)
3049:1::120 using 3049:1::110 as a security gateway on this end of the
connection and the machine 3049:1::120 on the other end of the connec-
tion with a Security Association IDentifier of ah:f5ed@3049:1::120
which means that it is a transport mode connection with a Security
Parameters Index of f5ed in(1,8) hexadecimal using Authentication Header
protocol (51, IPPROTO_AH) with no identies defined for either end.
FILES
/proc(5,n)/net/ipsec_eroute, /usr/local/bin/ipsec(5,8)
SEE ALSO
ipsec(5,8)(8), ipsec_manual(8), ipsec_tncfg(5), ipsec_spi(5), ipsec_spi-
grp(5), ipsec_klipsdebug(5), ipsec_eroute(8), ipsec_version(5),
ipsec_pf_key(5)
HISTORY
Written for the Linux FreeS/WAN project <http://www.freeswan.org/> by
Richard Guy Briggs.
20 Sep 2001 IPSEC_EROUTE(5)