iptables -t nat -F
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# iptables -F
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# # NAT
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# iptables -t nat -A POSTROUTING --source 192.1.3.0/24 --destination 0.0.0.0/0 -j SNAT --to-source 192.1.2.254
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# # make sure that we never acidentially let ESP through.
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# iptables -N LOGDROP
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# iptables -A LOGDROP -j LOG
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# iptables -A LOGDROP -j DROP
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# #
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# iptables -I FORWARD 1 --proto 50 -j LOGDROP
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# iptables -I FORWARD 2 --destination 192.0.2.0/24 -j LOGDROP
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# iptables -I FORWARD 3 --source 192.0.2.0/24 -j LOGDROP
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# # route
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# iptables -I INPUT 1 --destination 192.0.2.0/24 -j LOGDROP
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# # Display the table, so we know it is correct.
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# iptables -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
SNAT       all  --  192.1.3.0/24         0.0.0.0/0            to:192.1.2.254
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
LOGDROP    all  --  0.0.0.0/0            192.0.2.0/24        

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
LOGDROP    esp  --  0.0.0.0/0            0.0.0.0/0           
LOGDROP    all  --  0.0.0.0/0            192.0.2.0/24        
LOGDROP    all  --  192.0.2.0/24         0.0.0.0/0           

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain LOGDROP (4 references)
target     prot opt source               destination         
LOG        all  --  0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 4
DROP       all  --  0.0.0.0/0            0.0.0.0/0           
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# echo initdone
initdone
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# : ==== end ====
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# ../../pluto/bin/ipsec-look.sh
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# : ==== cut ====
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# ipsec auto --status
whack: Pluto is not running (no "/run/pluto/pluto.ctl")
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18 33]# >>>>>>>>>>cutnonzeroexit>>>>>>>>>> exit status 33 final.sh 'ipsec auto --status' <<<<<<<<<<tuc<<<<<<<<<<: ==== tuc ====
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# ../bin/check-for-core.sh
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# if [ -f /sbin/ausearch ]; then ausearch -r -m avc -ts recent ; fi
type=AVC msg=audit(1566825998.703:222687): avc:  denied  { write } for  pid=12760 comm="ip" path="/tmp/pluto.log" dev="dm-0" ino=580008722 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:object_r:container_file_t:s0:c718,c778 tclass=file permissive=1
type=AVC msg=audit(1566825999.171:222729): avc:  denied  { write } for  pid=13418 comm="ip" path="/tmp/pluto.log" dev="dm-0" ino=579933979 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:object_r:container_file_t:s0:c718,c778 tclass=file permissive=1
type=AVC msg=audit(1566825999.616:222772): avc:  denied  { write } for  pid=13789 comm="ip" path="/tmp/pluto.log" dev="dm-0" ino=64099268 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:object_r:container_file_t:s0:c718,c778 tclass=file permissive=1
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]# : ==== end ====
kroot@swantest:/home/build/libreswan/testing/pluto/xauth-pluto-18\[root@nic xauth-pluto-18]#