(racoon 749) Re: make sure remote uses correct subnet

* Sascha Hüdepohl ([email protected]) wrote:
> Hello,
> 
> what i mean is:
> 
> I have multiple remote and sainfo entries in my racoon.conf. All for
> ipsec-tunnel.
> 
> Now one remote authenticates correctly and claims to be subnet
> 10.0.0.0/24. So the appropriate sainfo will match and the connection
> gets established.
> 
> The subnet 10.0.0.0/24 is aktually meant for an other remote and now the
> connected remote has rights in the local net (by packetfilter) it
> shouldnt have.
> 
> I hope this is not to confusing.
> 
> My problem:
> The to connectet subnets are defined in an sainfo. How can i link an
> sainfo with a remote?

from man racoon.conf:
sainfo (source_id destination_id | anonymous) [from idtype [string]] {
statements }

sainfo address 10.0.1.0/24 any address 10.0.2.0/24 any from fqdn
"otherdomain.tld" { ... }

does not work.