For a given list of internet server (example):
S001 - 45.67.89.12
S002 - 67.78.90.34
S...
S999 - 98.76.65.54
I want to talk from each server to any other server to any TCP service using the public IP of the server, but the connection must be encrypted and authenticated with IPSec (PSK or own PKI, non-IPSec requests should be blocked). Instead of manual maintaining a list of hosts and individual IPSec configs for each host, I want to automate this process.
If this requires an explicit list of IP-adresses for which IPSec should be used, my preferred solution would be a reverse DNS lookup. For example, if a connection attempt to 67.78.90.34 is done, it should first resolve the reverse name. If it matches *.srvhosts.example.com, IPSec must be used.
Exists any linux based software solution to realize this?
Another solution - if possible - may enable IPsec globally just for every connection and a blacklist tells the system for which hosts IPSec should not be used (debian update mirror, dns, ntp, ...).