TCPDUMP moon# tcpdump -i eth0 not port ssh and not port domain and not arp > /tmp/tcpdump.log 2>&1 & alice# tcpdump -i eth0 not port ssh and not port domain and not arp > /tmp/tcpdump.log 2>&1 & PRE-TEST moon# /etc/init.d/iptables start 2> /dev/null * Caching service dependencies ... [ ok ] * Starting firewall ... [ ok ] carol# /etc/init.d/iptables start 2> /dev/null * Caching service dependencies ... [ ok ] * Starting firewall ... [ ok ] carol# ipsec start Starting strongSwan 4.3.6 IPsec [starter]... moon# ipsec start Starting strongSwan 4.3.6 IPsec [starter]... moon# sleep 4 TEST moon# ipsec status | grep 'STATE_MAIN_I4 (ISAKMP SA established)' [YES] 000 #1: "carol"[1] 192.168.0.100 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 3267s; newest ISAKMP carol# iptables -I INPUT 1 -i eth0 -s 192.168.0.1 -j DROP | grep 'no output expected' [NO] moon# sleep 35 | grep 'no output expected' [NO] carol# iptables -D INPUT 1 | grep 'no output expected' [NO] moon# cat /var/log/auth.log | grep 'inserting event EVENT_DPD' [YES] Feb 27 22:51:12 moon pluto[10435]: | inserting event EVENT_DPD, timeout in 4 seconds for #2 Feb 27 22:51:16 moon pluto[10435]: | inserting event EVENT_DPD, timeout in 5 seconds for #2 Feb 27 22:51:16 moon pluto[10435]: | inserting event EVENT_DPD_TIMEOUT, timeout in 25 seconds for #1 Feb 27 22:51:21 moon pluto[10435]: | inserting event EVENT_DPD, timeout in 5 seconds for #2 Feb 27 22:51:26 moon pluto[10435]: | inserting event EVENT_DPD, timeout in 5 seconds for #2 Feb 27 22:51:31 moon pluto[10435]: | inserting event EVENT_DPD, timeout in 5 seconds for #2 Feb 27 22:51:36 moon pluto[10435]: | inserting event EVENT_DPD, timeout in 5 seconds for #2 Feb 27 22:51:41 moon pluto[10435]: | inserting event EVENT_DPD, timeout in 5 seconds for #2 moon# cat /var/log/auth.log | grep 'DPD: No response from peer - declaring peer dead' [YES] Feb 27 22:51:41 moon pluto[10435]: "carol"[1] 192.168.0.100 #1: DPD: No response from peer - declaring peer dead moon# cat /var/log/auth.log | grep 'DPD: Terminating all SAs using this connection' [YES] Feb 27 22:51:41 moon pluto[10435]: "carol"[1] 192.168.0.100 #1: DPD: Terminating all SAs using this connection moon# cat /var/log/auth.log | grep 'DPD: Restarting connection' [YES] Feb 27 22:51:42 moon pluto[10435]: DPD: Restarting connection "carol" moon# sleep 10 | grep 'no output expected' [NO] moon# ipsec status | grep 'STATE_MAIN_I4 (ISAKMP SA established)' [YES] 000 #3: "carol"[2] 192.168.0.100 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 3272s; newest ISAKMP POST-TEST carol# ipsec stop Stopping strongSwan IPsec... moon# ipsec stop Stopping strongSwan IPsec... moon# /etc/init.d/iptables stop 2> /dev/null * Stopping firewall ... [ ok ] carol# /etc/init.d/iptables stop 2> /dev/null * Stopping firewall ... [ ok ] carol# ip addr del 10.3.0.1/32 dev eth0 moon# killall tcpdump alice# killall tcpdump