A connection between the subnets behind the gateways moon and sun is set up. The authentication is based on X.509 certificates and the kernel-libipsec plugin is used for userland IPsec ESP encryption. The negotiated encryption and authentication algorithms are 3DES and SHA-1, respectively.

Upon the successful establishment of the IPsec tunnel, an updown script automatically inserts iptables-based firewall rules that let pass the traffic tunneled via the ipsec0 tun interface. In order to test both tunnel and firewall, client alice behind gateway moon pings client bob located behind gateway sun.