
<refsect1 id='oe_conns'><title>OPPORTUNISTIC CONNS</title>
<para>For Opportunistic connections, the system requires creating special named conns that are
used to implement the default policy groups. Currently, these names cannot be changed. </para>

<!-- .ne 8 -->
<literallayout remap='.nf'>
<!-- .ta 1c -->
<emphasis remap='B'>
conn clear
	type=passthrough
	authby=never
	left=%defaultroute
	right=%group
	auto=route

conn clear-or-private
	type=passthrough
	left=%defaultroute
	leftid=%myid
	right=%opportunisticgroup
	failureshunt=passthrough
	keyingtries=3
	ikelifetime=1h
	salifetime=1h
	rekey=no
	auto=route

conn private-or-clear
	type=tunnel
	left=%defaultroute
	leftid=%myid
	right=%opportunisticgroup
	failureshunt=passthrough
	keyingtries=3
	ikelifetime=1h
	salifetime=1h
	rekey=no
	auto=route

conn private
	type=tunnel
	left=%defaultroute
	leftid=%myid
	right=%opportunisticgroup
	failureshunt=drop
	keyingtries=3
	ikelifetime=1h
	salifetime=1h
	rekey=no
	auto=route

conn block
	type=reject
	authby=never
	left=%defaultroute
	right=%group
	auto=route

</emphasis>
</literallayout> <!-- .fi -->

<para>These conns will only work if <emphasis remap='B'>%defaultroute</emphasis> works.
The <emphasis remap='B'>leftid</emphasis> will be the interfaces IP address by default,
but it can also be set to <emphasis remap='B'>%fromcert</emphasis> or use a DNS name.  </para>

</refsect1>

<refsect1 id='policy_group_files'><title>POLICY GROUP FILES</title>
<para>The optional files under
<filename>/etc/ipsec.d/policies</filename>,
including</para>
<literallayout remap='.nf'>

/etc/ipsec.d/policies/clear
/etc/ipsec.d/policies/clear-or-private
/etc/ipsec.d/policies/private-or-clear
/etc/ipsec.d/policies/private
/etc/ipsec.d/policies/block

</literallayout> <!-- .fi -->
<para>may contain policy group configuration information to
supplement
<emphasis remap='I'>ipsec.conf</emphasis>.
Their contents are not security-sensitive.</para>

<para>These files are text files.
Each consists of a list of CIDR blocks, one per line.
White space followed by # followed by anything to the end of the line
is a comment and is ignored, as are empty lines.</para>

<para>A connection in
<filename>ipsec.conf</filename>
that has
<emphasis remap='B'>right=%group</emphasis>
or
<emphasis remap='B'>right=%opportunisticgroup</emphasis>
is a policy group connection.
When a policy group file of the same name is loaded at system start,
the connection is instantiated such that each CIDR block serves as an instance's
<emphasis remap='B'>right</emphasis>
value. The system treats the resulting instances as normal connections.</para>

<para>For example, given a suitable connection definition
<emphasis remap='B'>private</emphasis>,
and the file
<filename>/etc/ipsec.d/policies/private</filename>
with an entry 192.0.2.3,
the system creates a connection instance
<emphasis remap='B'>private#192.0.2.3.</emphasis>
This connection inherits all details from
<emphasis remap='B'>private</emphasis>,
except that its right client is 192.0.2.3.</para>
</refsect1>

<refsect1 id='default_policy_groups'><title>DEFAULT POLICY GROUPS</title>
<para>The standard Libreswan install includes several policy groups
which provide a way of classifying possible peers into IPsec security classes:
<emphasis remap='B'>private</emphasis>
(talk encrypted only),
<emphasis remap='B'>private-or-clear</emphasis>
(prefer encryption),
<emphasis remap='B'>clear-or-private</emphasis>
(respond to requests for encryption),
<emphasis remap='B'>clear</emphasis>
and
<emphasis remap='B'>block</emphasis>.
</para>
</refsect1>

