# /etc/ipsec.d/oe-upgrade-authnull.conf
#
# Example file for Opportunstic Encryption using Auth NULL
# Traffic should flow in the clear until IKE succeeds. Fail open.
# This makes IPsec encryption "nice to have - not required"
# Because it uses Auth NULL, there is no protection against active MITM attacks
#
# See also oe.authnull.conf

conn clear
	type=passthrough
	# temp workaround
	#authby=never
	authby=null
	leftid=%null
	rightid=%null
	left=%defaultroute
	right=%group
	auto=route

conn clear-or-private
	type=tunnel
	authby=null
	leftid=%null
	rightid=%null
	left=%defaultroute
	right=%opportunisticgroup
	negotiationshunt=passthrough
	failureshunt=passthrough
	ikev2=insist
	# add, not route - because this policy is only for incoming IKE packets
	auto=add

conn private-or-clear
	type=tunnel
	authby=null
	leftid=%null
	rightid=%null
	left=%defaultroute
	right=%opportunisticgroup
	negotiationshunt=passthrough
	failureshunt=passthrough
	ikev2=insist
	auto=route
	keyingtries=1
	retransmit-timeout=2s
	# To support being behind NAT
	leftmodecfgclient=yes
	leftcat=yes
	narrowing=yes

conn private
	type=tunnel
	authby=null
	leftid=%null
	rightid=%null
	left=%defaultroute
	right=%opportunisticgroup
	# if we fail hard, we might as well hold traffic during IKE too
	negotiationshunt=hold
	failureshunt=drop
	ikev2=insist
	auto=route

conn block
	type=reject
	# temp workaround
	#authby=never
	authby=null
	leftid=%null
	rightid=%null
	left=%defaultroute
	right=%group
	auto=route