<p dir="ltr">I was more asking about the host to host transport mode and not tunneling.</p>
<div class="gmail_quote">On May 26, 2015 11:08 PM, "Paul Wouters" <<a href="mailto:paul@nohats.ca">paul@nohats.ca</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Tue, 26 May 2015, Brandon Enochs wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Isn't the subnet extraneous in that example since the right IP is fully specified?<br>
</blockquote>
<br>
the diagram is like:<br>
<br>
[leftsubnet -[left] ----internet---[right]----[rightsubnet]<br>
<br>
Your IPsec gateway IP's are left= and right=. If you are building a<br>
tunnel that should cover more than just the gateways itself, so a<br>
subnet to subnet tunnel, you need to specify that via leftsubnet=<br>
and rightsubnet=<br>
<br>
Remember IPsec tunnels are not virtual wires, you cannot just "route"<br>
anything in to them. You need to tell exactly what src-dst of packets<br>
are allowed to go through.<br>
<br>
Paul<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On May 26, 2015 11:04 PM, "Paul Wouters" <<a href="mailto:paul@nohats.ca" target="_blank">paul@nohats.ca</a>> wrote:<br>
On Tue, 26 May 2015, Brandon Enochs wrote:<br>
<br>
Are IPv6 host to host connections with right specified as a subnet supported?<br>
<br>
<br>
Yes, for example:<br>
<br>
ipsec.conf:<br>
<br>
conn ipv6<br>
left=2001:db8:1:2::45<br>
leftid="@west"<br>
right=2001:db8:1:2::23<br>
rightsubnet=2001:db8:0:2::/64<br>
rightid="@east"<br>
auto=ondemand<br>
authby=secret<br>
<br>
ipsec.secrets:<br>
<br>
2001:db8:1:2::45 2001:db8:1:2::23 : PSK "secret"<br>
<br>
If your endpoints (left/right) are IPv4, and your subnet is IPv6, then<br>
you need a leftsubnet as well (with an ipv6 range) because both need to<br>
be of the same IP address family, and you need to add connaddrfamily=6<br>
<br>
Paul<br>
<br>
<br>
<br>
</blockquote>
</blockquote></div>