From owner-freebsd-security  Wed Oct 25 15:34: 8 2000
Delivered-To: freebsd-security@freebsd.org
Received: from icebox.venux.net (icebox.venux.net [216.120.166.10])
	by hub.freebsd.org (Postfix) with ESMTP id 3B81D37B479
	for <freebsd-security@FreeBSD.ORG>; Wed, 25 Oct 2000 15:34:06 -0700 (PDT)
Received: from thunder.venux.net (net-216-93-125-061.hcv.com [216.93.125.61])
	by icebox.venux.net (Postfix) with ESMTP id C73EC26209
	for <freebsd-security@FreeBSD.ORG>; Wed, 25 Oct 2000 18:43:50 -0400 (EDT)
Message-Id: <5.0.0.25.2.20001025174629.02b0fbd0@pop3.venux.net>
X-Sender: mhagerty@pop3.venux.net
X-Mailer: QUALCOMM Windows Eudora Version 5.0
Date: Wed, 25 Oct 2000 18:33:55 -0400
To: freebsd-security@FreeBSD.ORG
From: Matthew Hagerty <matthew@venux.net>
Subject: IPsec requires FreeBSD-4.??
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Greetings,

I am trying desperately to get a simple network-to-network VPN working with 
FreeBSD.  I am having no luck and would like to know what version of 4.x I 
need?  I am currently using 4.0 release on both sides.  Is that going to 
work or do I need to upgrade to 4.1.1 or something?

Also, while I'm here, this is the whole procedure I'm using (that does not 
seem to be working.)  Is there something wrong with this?

In the kernel I added these and recompiled:

options         IPSEC
options         IPSEC_ESP


Then I modified the IPv4 tunnel example in the handbook (the example as 
written did not work either... long lines wrap)

10.0.0.0/24--24.7.242.61<------->216.93.125.61--10.0.1.0/24

setkey -c <<EOF
spdadd 10.0.1.0/24 10.0.0.0/24 any -P out ipsec 
esp/tunnel/216.93.125.61-24.7.242.61/require ;
spdadd 10.0.0.0/24 10.0.1.0/24 any -P in  ipsec 
esp/tunnel/24.7.242.61-216.93.125.61/require ;
add 216.93.125.61 24.7.242.61 esp 0x10001 -E des-cbc "ESP with" -A hmac-md5 
"authentication!!" ;
add 24.7.242.61 216.93.125.61 esp 0x10002 -E des-cbc "ESP with" -A hmac-md5 
"authentication!!" ;
EOF

setkey -c <<EOF
spdadd 10.0.0.0/24 10.0.1.0/24 any -P out ipsec 
esp/tunnel/24.7.242.61-216.93.125.61/require ;
spdadd 10.0.1.0/24 10.0.0.0/24 any -P in  ipsec 
esp/tunnel/216.93.125.61-24.7.242.61/require ;
add 216.93.125.61 24.7.242.61 esp 0x10001 -E des-cbc "ESP with" -A hmac-md5 
"authentication!!" ;
add 24.7.242.61 216.93.125.61 esp 0x10002 -E des-cbc "ESP with" -A hmac-md5 
"authentication!!" ;
EOF


I am running NATd on both sides, but I shut it off and still no 
good.  There was a post a few weeks ago about running NATd with IPsec, 
something to the effect of having to set a route to the loopback interface:

route add 172.16.0.0 -netmask 0xffffff00 -interface lo0

I tried that as well, but in my case I was not sure which of my IP 
addresses I should be using to replace the 172.16.0.0...

Any insight would be greatly appreciated!!

Thank you,
Matthew Hagerty



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message