The roadwarriors carol and dave set up a connection each to gateway moon. The authentication is based on raw public keys and IKEv2 key IDs. Gateway moon accepts all peers possessing a public key a copy of which is stored in the /etc/swanctl/pubkey directory.

Upon the successful establishment of the IPsec tunnels, the updown script automatically inserts iptables-based firewall rules that let pass the tunneled traffic. In order to test both tunnel and firewall, both carol and dave ping the client alice behind the gateway moon.