A connection between the subnets behind the gateways moon and sun is set up. The key exchange is based on NTRU encryption with a security strength of 256 bits. The authentication is based on X.509 certificates. Upon the successful establishment of the IPsec tunnel, leftfirewall=yes automatically inserts iptables-based firewall rules that let pass the tunneled traffic. In order to test both tunnel and firewall, client alice behind gateway moon pings client bob located behind gateway sun.