Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have 2 Linux hosts and each has 2 services, X and Y.
The X services communicate between them on UDP port x.
The Y services communicate between them on UDP port y.
I would like to encrypted the communication.

I know how to set-up a single UDP encapsulated IPsec tunnel between the 2 hosts with ipsec-tools (my network does not allow IPSec on IP...).

But how do I set-up 2 IPsec tunnels with different SPIs and keys - one for the X services and the other for the Y services?

share|improve this question
1  
Why on earth would you wish to do such a thing? –  MadHatter Dec 6 '12 at 7:27
1  
ipsec doesn't really work like that. ipsec is host-to-host, network-to-network, or host-to-network. it doesn't have a service-to-service mode. –  cha0site Dec 6 '12 at 7:57
    
I know what IPSec supports. Let's say I have 2 networks: X and Y. Both have 2 sides: Xa/Xb and Ya/Yb. I have a single Gateway for each side: Ga for Xa and Ya and Gb for Xb and Yb. How do I configure Ga and Gb to have 2 tunnels between them - one for X and the other for Y? –  borfig Dec 6 '12 at 8:07
1  
Rather than clarifying in the comments, you may wish to expand the question with that detail. –  EightBitTony Dec 6 '12 at 8:08
    
@cha0site This is not correct. IPsec policies can cover protocols and/or ports. –  ecdsa Dec 6 '12 at 8:23

1 Answer 1

I don't know how exactly you would configure it with ipsec-tools but with strongSwan you may use the left|rightprotoport options to specify a single UDP port that is to be secured.

Example ipsec.conf file:

conn base
    right=ip.of.other.host
    forceencaps=yes
    ... (other options)
    auto=start

conn serviceX
    also=base
    leftprotoport=udp/x
    rightprotoport=udp/x

conn serviceY
    also=base
    leftprotoport=udp/y
    rightprotoport=udp/y

Where x and y are the ports of your services. With forceencaps UDP encapsulation is enforced.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.