With IPsec tunnels, we can do more than just connect two existing subnets with each other. We can also move a subnet, or a part of a subnet, through an IPsec tunnel to another location. This is called subnet extrusion, as shown in the diagram below:
In this figure, packets for 193.111.228.64/30 that end up on 193.110.157.1 will now be sent further via IPsec to 209.112.44.4. Response packets travel back the same way and once they reach 193.110.157.1 will be sent plaintext onto the subnet.
Imagine we want to move a small part of Sunset, the first 64 addresses, to appear at East. We would use the following conn
definition:
conn sunset-extrude left=193.110.157.131 leftsubnet=0.0.0.0/0 leftrsasigkey=0sAQ1234.... right=205.150.200.209 rightsubnet=193.111.228.0/26 rightrsasigkey=0sAQ5678.... auto=start
The example uses RSA, but you can also use PSK if you want to. The important option is to define the leftsubnet=
as the entire Internet. This will cause all packets on East with...