I have two Ubuntu-server boxes, as gateways on two different networks: each one has two NIC, eth0 to the LAN, eth1 to the Internet. I set up OpenSWAN on both machines and iptables like this:
iptables -A INPUT -p esp -i eth1 -j ACCEPT iptables -A OUTPUT -p esp -o eth1 -j ACCEPT iptables -A INPUT -p udp -m udp -i eth1 --dport 500 -j ACCEPT iptables -A INPUT -p udp -m udp -i eth1 --dport 4500 -j ACCEPT
The tunnel is established correctly, but I cannot ping. I guess it is because a drop all ping requests from the Internet on eth1, so I wonder if I can tell OpenSWAN to create a virtual interface to use for the tunnel and use that interface to make iptables rules and accept traffic. I tried to set on "conn setup": interfaces="ipsec0=eth1" but I can no see a ipsec0 interface on my machine...