Mention ingress flows.

1 files changed, 80 insertions, 14 deletions

diff --git a/share/man/man8/vpn.8 b/share/man/man8/vpn.8
index a37b46c155d..1efa6af7e7f 100644
--- a/share/man/man8/vpn.8
+++ b/share/man/man8/vpn.8
@@ -1,4 +1,4 @@
-.\" $OpenBSD: vpn.8,v 1.27 2000/01/11 01:07:55 angelos Exp $
+.\" $OpenBSD: vpn.8,v 1.28 2000/01/13 05:15:42 angelos Exp $
 .\" Copyright 1998 Niels Provos <provos@physnet.uni-hamburg.de>
 .\" All rights reserved.
 .\"
@@ -121,6 +121,13 @@ sysctl -w net.inet.esp.enable=1
 sysctl -w net.inet.ah.enable=1
 .Ed
 .Pp
+and
+.Bd -literal
+sysctl -w net.inet.ip.ipsec-acl=1
+.Ed.
+.Pp
+if inbound packet verification is desired (strongly recommended).
+.Pp
 For more permanent operation, these options should be enabled in your
 .Xr sysctl.conf 5 .
 .Pp
@@ -151,32 +158,58 @@ On the security gateway of subnet A:
 .Bd -literal
 ipsecadm flow -dst B_EXTERNAL_IP -spi SPI_OUT -proto esp
          -addr A_EXTERNAL_IP 255.255.255.255
-               B_EXTERNAL_IP 255.255.255.255 -local
+               B_EXTERNAL_IP 255.255.255.255
 ipsecadm flow -dst B_EXTERNAL_IP -spi SPI_OUT -proto esp
          -addr A_INTERNAL_NETWORK A_INTERNAL_NETMASK
                B_INTERNAL_NETWORK B_INTERNAL_NETMASK
 ipsecadm flow -dst B_EXTERNAL_IP -spi SPI_OUT -proto esp
          -addr A_EXTERNAL_IP 255.255.255.255
-               B_INTERNAL_NETWORK B_INTERNAL_NETMASK -local
+               B_INTERNAL_NETWORK B_INTERNAL_NETMASK
 ipsecadm flow -dst B_EXTERNAL_IP -spi SPI_OUT -proto esp
          -addr A_INTERNAL_NETWORK A_INTERNAL_NETMASK
                B_EXTERNAL_IP 255.255.255.255
+
+ipsecadm flow -dst A_EXTERNAL_IP -spi SPI_IN -proto esp
+         -addr B_EXTERNAL_IP 255.255.255.255
+               A_EXTERNAL_IP 255.255.255.255 -ingress
+ipsecadm flow -dst A_EXTERNAL_IP -spi SPI_IN -proto esp
+         -addr B_INTERNAL_NETWORK B_INTERNAL_NETMASK
+               A_INTERNAL_NETWORK A_INTERNAL_NETMASK -ingress
+ipsecadm flow -dst A_EXTERNAL_IP -spi SPI_OUT -proto esp
+         -addr B_EXTERNAL_IP 255.255.255.255
+               A_INTERNAL_NETWORK A_INTERNAL_NETMASK -ingress
+ipsecadm flow -dst A_EXTERNAL_IP -spi SPI_OUT -proto esp
+         -addr B_INTERNAL_NETWORK B_INTERNAL_NETMASK
+               A_EXTERNAL_IP 255.255.255.255 -ingress
 .Ed
 .Pp
 and on the security gateway of subnet B:
 .Bd -literal
 ipsecadm flow -dst A_EXTERNAL_IP -spi SPI_IN -proto esp
          -addr B_EXTERNAL_IP 255.255.255.255
-               A_EXTERNAL_IP 255.255.255.255 -local
+               A_EXTERNAL_IP 255.255.255.255
 ipsecadm flow -dst A_EXTERNAL_IP -spi SPI_IN -proto esp
          -addr B_INTERNAL_NETWORK B_INTERNAL_NETMASK
                A_INTERNAL_NETWORK A_INTERNAL_NETMASK
 ipsecadm flow -dst A_EXTERNAL_IP -spi SPI_OUT -proto esp
          -addr B_EXTERNAL_IP 255.255.255.255
-               A_INTERNAL_NETWORK A_INTERNAL_NETMASK -local
+               A_INTERNAL_NETWORK A_INTERNAL_NETMASK
 ipsecadm flow -dst A_EXTERNAL_IP -spi SPI_OUT -proto esp
          -addr B_INTERNAL_NETWORK B_INTERNAL_NETMASK
                A_EXTERNAL_IP 255.255.255.255
+
+ipsecadm flow -dst B_EXTERNAL_IP -spi SPI_OUT -proto esp
+         -addr A_EXTERNAL_IP 255.255.255.255
+               B_EXTERNAL_IP 255.255.255.255 -ingress
+ipsecadm flow -dst B_EXTERNAL_IP -spi SPI_OUT -proto esp
+         -addr A_INTERNAL_NETWORK A_INTERNAL_NETMASK
+               B_INTERNAL_NETWORK B_INTERNAL_NETMASK -ingress
+ipsecadm flow -dst B_EXTERNAL_IP -spi SPI_OUT -proto esp
+         -addr A_EXTERNAL_IP 255.255.255.255
+               B_INTERNAL_NETWORK B_INTERNAL_NETMASK -ingress
+ipsecadm flow -dst B_EXTERNAL_IP -spi SPI_OUT -proto esp
+         -addr A_INTERNAL_NETWORK A_INTERNAL_NETMASK
+               B_EXTERNAL_IP 255.255.255.255 -ingress
 .Ed
 .Pp
 Furthermore, unless manual keying is used,
@@ -192,11 +225,13 @@ authentication).
 needs to be configured such that all packets from the outside are blocked
 by default. Only successfully IPSec-processed packets (from the
 .Xr enc0 4
-interface), or
-key management packets (for
+interface), or key management packets (for
 .Xr photurisd 8 ,
 .Tn UDP
-packets with source and destination ports of 468) should be allowed to pass.
+packets with source and destination ports of 468, and for
+.Xr isakmpd 8 ,
+.Tn UDP
+packets with source and destination ports of 500) should be allowed to pass.
 .Pp
 The
 .Xr ipf 5
@@ -266,39 +301,70 @@ Create the Security Associations (on both endpoints):
 .Ed
 .Pp
 .It
-Create the ipsec route on machine A:
+Create the IPsec flows on machine A (the first four are the
+outbound flows, the latter four are the ingress filters for the
+incoming security association):
 .Pp
 .Bd -literal
 # /sbin/ipsecadm flow -dst 192.168.2.1 -spi 1001 -proto esp \e\ 
     -addr 192.168.1.254 255.255.255.255 \e\ 
-          192.168.2.1 255.255.255.255 -local
+          192.168.2.1 255.255.255.255
 
 # /sbin/ipsecadm flow -dst 192.168.2.1 -spi 1001 -proto esp \e\ 
     -addr 10.0.50.0 255.255.255.0 10.0.99.0 255.255.255.0
 
 # /sbin/ipsecadm flow -dst 192.168.2.1 -spi 1001 -proto esp \e\ 
     -addr 192.168.1.254 255.255.255.255 \e\ 
-          10.0.99.0 255.255.255.0 -local
+          10.0.99.0 255.255.255.0
 
 # /sbin/ipsecadm flow -dst 192.168.2.1 -spi 1001 -proto esp \e\ 
     -addr 10.0.50.0 255.255.255.0 192.168.2.1 255.255.255.255
+
+# /sbin/ipsecadm flow -dst 192.168.1.254 -spi 1000 -proto esp \e\ 
+    -addr 192.168.2.1 255.255.255.255 \e\ 
+          192.168.1.254 255.255.255.255 -ingress
+
+# /sbin/ipsecadm flow -dst 192.168.1.254 -spi 1000 -proto esp \e\ 
+    -addr 10.0.99.0 255.255.255.0 10.0.50.0 255.255.255.0 -ingress
+
+# /sbin/ipsecadm flow -dst 192.168.1.254 -spi 1000 -proto esp \e\ 
+     -addr 192.168.2.1 255.255.255.255 \e\ 
+           10.0.50.0 255.255.255.0 -ingress
+
+# /sbin/ipsecadm flow -dst 192.168.1.254 -spi 1000 -proto esp \e\ 
+     -addr 10.0.99.0 255.255.255.0 \e\
+	   192.168.1.254 255.255.255.255 -ingress
 .Ed
 .It
-Create the ipsec flow on machine B:
+Create the ipsec flows on machine B:
 .Bd -literal
 # /sbin/ipsecadm flow -dst 192.168.1.254 -spi 1000 -proto esp \e\ 
     -addr 192.168.2.1 255.255.255.255 \e\ 
-          192.168.1.254 255.255.255.255 -local
+          192.168.1.254 255.255.255.255
 
 # /sbin/ipsecadm flow -dst 192.168.1.254 -spi 1000 -proto esp \e\ 
     -addr 10.0.99.0 255.255.255.0 10.0.50.0 255.255.255.0
 
 # /sbin/ipsecadm flow -dst 192.168.1.254 -spi 1000 -proto esp \e\ 
      -addr 192.168.2.1 255.255.255.255 \e\ 
-           10.0.50.0 255.255.255.0 -local
+           10.0.50.0 255.255.255.0
 
 # /sbin/ipsecadm flow -dst 192.168.1.254 -spi 1000 -proto esp \e\ 
      -addr 10.0.99.0 255.255.255.0 192.168.1.254 255.255.255.255
+
+# /sbin/ipsecadm flow -dst 192.168.2.1 -spi 1001 -proto esp \e\ 
+    -addr 192.168.1.254 255.255.255.255 \e\ 
+          192.168.2.1 255.255.255.255 -ingress
+
+# /sbin/ipsecadm flow -dst 192.168.2.1 -spi 1001 -proto esp \e\ 
+    -addr 10.0.50.0 255.255.255.0 10.0.99.0 255.255.255.0 -ingress
+
+# /sbin/ipsecadm flow -dst 192.168.2.1 -spi 1001 -proto esp \e\ 
+    -addr 192.168.1.254 255.255.255.255 \e\ 
+          10.0.99.0 255.255.255.0 -ingress
+
+# /sbin/ipsecadm flow -dst 192.168.2.1 -spi 1001 -proto esp \e\ 
+    -addr 10.0.50.0 255.255.255.0 192.168.2.1 255.255.255.255 -ingress
 .Ed
 .It
 Configure the firewall rules on machine A: