shorewall and IPSec traffic monitoring

Vieri Di Paola <[email protected]> Wed, 6 Apr 2022 12:49:06 +0200

Newsgroups	gmane.comp.security.shorewall
Message-ID	<CABLYT9jW3ah5E=nw=DuwBPJYXWnr6q60fBo=J=uZt5hqPsqwgw@mail.gmail.com>

Hi,

What's the best way to translate these iptables rules to Shorewall?

iptables -I INPUT -m addrtype --dst-type LOCAL -m policy --pol ipsec
--dir in -j NFLOG --nflog-group 5
iptables -I OUTPUT -m policy --pol ipsec --dir out -j NFLOG --nflog-group 5

The idea is to be able to monitor IPSec traffic with tools such as
tcpdump -i nflog:5.

Ref. https://docs.strongswan.org/strongswan-docs/5.9/install/trafficDumps.html

Regards,

Vieri