A connection between the subnets behind the gateways moon and sun is set up via the gateway carol. The authentication is based on X.509 certificates. Upon the successful establishment of the IPsec tunnels, the updown script automatically inserts iptables-based firewall rules that let pass the tunneled traffic. In order to test tunnels and firewall, client alice behind gateway moon pings client bob located behind gateway sun.