IPSEC_EROUTESection: Maintenance Commands (8)
Updated: 30 Nov 1998
Index Return to Main Contents
NAMEipsec eroute - manipulate IPSEC extended routing tables
SYNOPSISipsec eroute --add --src src/srcmaskbits|srcmask --dst dst/dstmaskbits|dstmask <SAID>
ipsec eroute --replace --src src/srcmaskbits|srcmask --dst dst/dstmaskbits|dstmask <SAID>
ipsec eroute --del --src src/srcmaskbits|srcmask --dst dst/dstmaskbits|dstmask
ipsec eroute --clear
ipsec eroute --help
ipsec eroute --version
DESCRIPTIONEroute manages the IPSEC extended routing tables, which control what (if any) processing is applied to non-encrypted packets arriving for IPSEC processing and forwarding. The --add form adds a table entry, the --replace form replaces a table entry, while the --del form deletes one. The --clear form deletes the entire table.
A table entry consists of:
Addresses are written as IPv4 dotted quads, SPIs are '0x'-prefixed hexadecimal numbers and protocol is one of "ah", "esp" or "tun".
SAIDs are written as "proto0xSPI@address".
ipsec eroute --add --src 192.168.0.1/32 \
sets up an eroute on a Security Gateway to protect traffic between the host 192.168.0.1 and the subnet 192.168.2.0 with 24 bits of subnet mask via Security Gateway 192.168.0.2 using the Security Association with address 192.168.0.2, Security Parameters Index 0x135 and protocol tun (50, IPPROTO_ESP).
replaces an eroute on a Security Gateway to protect traffic between the subnet company.com with 24 bits of subnet mask and the host ftp.ngo.org via Security Gateway gw.ngo.org using the Security Association with Security Association ID email@example.com
ipsec eroute --del --src company.com/24 \
deletes an eroute on a Security Gateway that allowed traffic between the subnet company.com with 24 bits of subnet mask and the host www.ietf.org to pass in the clear, unprocessed.
SEE ALSOipsec_tncfg(8), ipsec_spi(8), ipsec_spigrp(8), ipsec_klipsdebug(8)
HISTORYWritten for the Linux FreeS/WAN project <http://www.xs4all.nl/~freeswan/> by Richard Guy Briggs.
This document was created by man2html, using the manual pages.
Time: 04:38:15 GMT, May 22, 2000