Can I use policy groups along with explicitly configured connections?
Yes, you can, so long as you pay attention to the selection rule, which can be summarized “the most specific connection wins”. We describe the rule in our policy groups document, and provide a more technical explanation in man ipsec.conf. A good guideline: If you have a regular connection defined in ipsec.conf, ensure that a subset of that connection is not listed in a less restrictive policy group. Otherwise, FreeS/WAN will use the subset, with its more specific source/destination pair. Here’s an example. Suppose you are the system administrator at 192.0.2.2. You have this connection in ipsec.conf: ipsec.
Yes, you can, so long as you pay attention to the selection rule, which can be summarized “the most specific connection wins”. We describe the rule in our policy groups document, and provide a more technical explanation in man ipsec.conf. A good guideline: If you have a regular connection defined in ipsec.conf, ensure that a subset of that connection is not listed in a less restrictive policy group. Otherwise, FreeS/WAN will use the subset, with its more specific source/destination pair. Here’s an example. Suppose you are the system administrator at 192.0.2.2.
