Subject: Re: Question about xfrm by MARK feature

From: jamal <[email-masked]>
Date: Fri, 25 Jun 2010 08:43:15 -0400

Hi Gerd,

On Fri, 2010-06-25 at 09:35 +0200, Gerd v. Egidy wrote:

> I planned to avoid looking at the remote gateway ip (to even allow two 
> different remote gateways hiding natted behind the same ip) but that would be 
> a good fallback solution if my other ideas don't work out.
> 

Doesnt have to be a remote IP...
If you can somehow even map a remote to some MAC address or incoming
virtual interface (such as a VLAN) that would do it as well.
Alternatively, you should probably look at namespaces  - i just find it
more usable when you have overlapping/conflicting ip addresses. You
of course will have to run strongswan per namespace if you dont want to
hack strongswan.

cheers,
jamal