Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have 2 Linux hosts and each has 2 services, X and Y.
The X services communicate between them on UDP port x.
The Y services communicate between them on UDP port y.
I would like to encrypted the communication.

I know how to set-up a single UDP encapsulated IPsec tunnel between the 2 hosts with ipsec-tools (my network does not allow IPSec on IP...).

But how do I set-up 2 IPsec tunnels with different SPIs and keys - one for the X services and the other for the Y services?

share|improve this question
Why on earth would you wish to do such a thing? – MadHatter Dec 6 '12 at 7:27
ipsec doesn't really work like that. ipsec is host-to-host, network-to-network, or host-to-network. it doesn't have a service-to-service mode. – cha0site Dec 6 '12 at 7:57
I know what IPSec supports. Let's say I have 2 networks: X and Y. Both have 2 sides: Xa/Xb and Ya/Yb. I have a single Gateway for each side: Ga for Xa and Ya and Gb for Xb and Yb. How do I configure Ga and Gb to have 2 tunnels between them - one for X and the other for Y? – borfig Dec 6 '12 at 8:07
Rather than clarifying in the comments, you may wish to expand the question with that detail. – EightBitTony Dec 6 '12 at 8:08
@cha0site This is not correct. IPsec policies can cover protocols and/or ports. – ecdsa Dec 6 '12 at 8:23

I don't know how exactly you would configure it with ipsec-tools but with strongSwan you may use the left|rightprotoport options to specify a single UDP port that is to be secured.

Example ipsec.conf file:

conn base
    ... (other options)

conn serviceX

conn serviceY

Where x and y are the ports of your services. With forceencaps UDP encapsulation is enforced.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.