Date: Fri, 11 Oct 2002 18:16:33 -0400 (EDT) From: Dru <dlavigne6@cogeco.ca> To: MrWebby <mrwebby@bigfoot.com> Cc: freebsd-questions@FreeBSD.ORG Subject: Re: IPsec Tunneling (VPN) from WIN2K (client) to FreeBSD (Server) Message-ID: <20021011180017.J1552-100000@dhcp-17-14.kico2.on.cogeco.ca> In-Reply-To: <3DA72972.7030706@bigfoot.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, 11 Oct 2002, MrWebby wrote: > Subject: IPsec Tunneling (VPN) from WIN2K (client) to FreeBSD (Server) > > Hello all, > > I hope you can understand how desperate I am to figure out what to do. > > I need to enable tunnels from my laptop running Windows 2000 Pro to > my FreeBSD 4.6. I have a Cable Modem link to the Internet and for my > firewall and NAT router I use a D-Link 707 Residencial Router capable > of allowing VPN using IPsec 'only'. > ---------- > VPN Sever Gateway | | > ----------- ----------- | | > 192.168.0.3 -------- 192.168.0.1 ----------------------- Internet | > ----------- ----------- | | > FreeBSD 4.6 xxx.xxx.xxx.xxx | | > ---------- > -IPsec Enabled IPsec: | > -Running Racoon -ESP mode | > -Setkey -In Tunnel Mode (DUH!) | > -OpenSSL Certificates -DES encryption | > -psk.txt -ESP mode with no encapsulation | > -VPN Sever: PoPToPt -no Integrity | > -Pre-Shared keys | > | > | > | > Client | > ------------- | > 192.168.0.226 ---------------------------------------| > ------------- > Windows 2000 Pro > > -IPsec enabled > -Certificate Install > > As this diagram explains I'm running FreeBSD 4.6 with PoPToP, Racoon > for sharing keys and IPsec enabled in the Kernel. The gateway/NAT > router allows IPsec VPN with DES encryption in ESP mode with no > encapsulation, no Integrity, in Tunnel mode and using a pre-shared > key. > > I don't know what "no Integrity" means neither why ESP > cannot "encapsulate". To add to the information you already received, and address your questions: - "no integrity" means it won't use AH (authentication header). As someone already pointed out, AH will _not_ work with NAT. As for whether or not ESP will work with NAT, the short answer is "it depends". (upon the capabilities of the device and the style of NAT it uses and whether the routing occurs before/after NAT) Usually that short answer turns out to be "no". - "no encapsulation" means it will only understand "transport mode". In "tunnel mode", ESP will add a new encapsulation (header) using the IPs of the two gateways and encrypt the entire original IP packet (original headers and data). In "transport mode", only the data is encrypted and the original headers are kept in clear text so they can be used to route the packet. Now, IIRC, Windows 2000 only supports transport mode?? That's from memory, so do a google search to see if there is any truth to that. If that is the case, your current setup will not work as transport mode requires that the VPN setup occurs directly between the 2 devices (in your case FreeBSD and 2000). If 2000 does support tunnel mode, the VPN tunnel will be between the router and 2000 and it is the responsibility of the router to route the packets to the FreeBSD box and encrypt/decrypt on behalf of that FreeBSD box. That may or may not work depending upon how its NAT interacts with IPSEC. HTH, Dru To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20021011180017.J1552-100000>