Date: Tue, 12 Jun 2007 09:21:35 +0000 From: Poul-Henning Kamp <phk@phk.freebsd.dk> To: doc@freebsd.org Cc: gnn@freebsd.org Subject: HOWTO setup a simple IPSEC tunnel Message-ID: <40691.1181640095@critter.freebsd.dk>
next in thread | raw e-mail | index | archive | help
Feel free to use whereever... How to set up an IPSEC tunnel between two FreeBSD machines. ----------------------------------------------------------- Replace these with your own parameters below: ${MY_IP_ADDRESS} ${OTHER_IP_ADDRESS} ${MYHOSTNAME} ${OTHERHOSTNAME} Do the obvious MY<->OTHER flip in the other end of the tunnel. Install ports/security/ipsec-tools Add kernel options (or kldload): device gif device crypto options FAST_IPSEC If you have a HiFn cryptoboard (ie: Soekris NET14xx) also add: device hifn In your /etc/rc.conf: gif_interfaces="gif0" gifconfig_gif0="${MY_IP_ADDRESS} ${OTHER_IP_ADDRESS}" ifconfig_gif0="192.168.48.22 192.168.48.21 netmask 255.255.255.252" ipsec_enable=YES ipsec_file=/etc/setkey.conf racoon_enable=YES You can use whatever addresses you want instead of 192.168.48.{21,22}, just make sure to select them as the middle two in a /30 network. In other words, the last byte of the IP numbers must be "N * 4 + 1" and "N * 4 + 2". If you do not plan on running a routing daemon (routed(8) and such) you can use any two IP# as long as you remove the "netmask 255..." bit. Create /etc/setkey.conf containing: spdflush; spdadd 0.0.0.0/0 0.0.0.0/0 4 -P out ipsec esp/transport//require; spdadd 0.0.0.0/0 0.0.0.0/0 4 -P in ipsec esp/transport//require; This means: I want IPSEC on all IP-IP protocol packets. IP-IP is what gif tunnels use and it has IP protocol 4 (see /etc/protocols). Create /etc/racoon_psk.txt containing: ${MYHOSTNAME} ${PASSWORD} ${OTHERHOSTNAME} ${PASSWORD} Make sure it has mode r--: chmod 400 /etc/racoon_psk.txt It's ok to use the same password for both hosts, it's easier that way. A good way to find passwords for this kind of stuff is: strings -16 < /dev/random Create /usr/local/etc/racoon/racoon.conf containing: path pre_shared_key "/etc/racoon_psk.txt" ; remote anonymous { exchange_mode aggressive; my_identifier fqdn ${MYHOSTNAME} lifetime time 24 hour ; proposal { encryption_algorithm 3des; hash_algorithm sha1; authentication_method pre_shared_key ; dh_group 2 ; } } sainfo anonymous { pfs_group 2; lifetime time 12 hour ; encryption_algorithm 3des, cast128, blowfish 448, des, rijndael ; authentication_algorithm hmac_sha1, hmac_md5 ; compression_algorithm deflate ; } That should do it... -- Poul-Henning Kamp | UNIX since Zilog Zeus 3.20 phk@FreeBSD.ORG | TCP/IP since RFC 956 FreeBSD committer | BSD since 4.3-tahoe Never attribute to malice what can adequately be explained by incompetence.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?40691.1181640095>