IPSec VPN: Add support for `port` to associate with protocol for policies
Closed, InvalidPublicFEATURE REQUEST
Actions

Assigned To

None

Authored By

	SrividyaA
	Jun 26 2025, 3:13 PM

Description

Summary

Add support for port to associate with specific protocol for policy-based tunnels (local and remote traffic selectors)

CLI option:
set vpn ipsec site-to-site peer vpn_03 tunnel 0 port <number/range>

Use case

To passthrough traffic from a local service address/port to any remote address/port.

Additional information

Strongswan reference:

Viacheslav triaged this task as Normal priority.Jun 26 2025, 5:06 PM

Looks like it's already been implemented here:

set vpn ipsec site-to-site peer <name> tunnel <number> protocol tcp
set vpn ipsec site-to-site peer <name> tunnel <number> local port 22

This commands will lead to generate: local_ts = dynamic[tcp/22].

And one important thing: it does not support range of ports, but only one. We will probably have to fix this in the future.