A connection between two identical 10.0.0.0/14 networks behind the gateways moon and sun is set up. In order to make network routing work, the subnet behind moon sees the subnet behind sun as 10.4.0.0/14 whereas the subnet behind sun sees the subnet behind moon as 10.8.0.0/14. The necessary network mappings are done on gateway sun using the iptables MARK and NETMAP targets.

Upon the successful establishment of the IPsec tunnel, on gateway moon the updown script automatically inserts iptables-based firewall rules that let pass the tunneled traffic. On gateway sun, a custom updown script inserts iptables rules that create the necessary NETMAP operations and forward the tunneled traffic.

In order to test both tunnel and firewall, client alice behind gateway moon pings client bob located behind gateway sun and vice versa.