From: Stephen Rozzo (stephensonn.com)
Date: Sat Apr 03 2004 - 13:01:56 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hello,

        I have given myself quite the headache trying to make this VPN work correctly. I am attempting to use racoon to establish keys and construct an encrypted tunnel between one host(A.A.A.A) with a routable IP address and another that has a private address(10.0.0.2) with a cable modem(B.B.B.B) forwarding all ports to the private address(10.0.0.2). Here is a quick topographic dipiction of the infastructure:

                     
                     192.168.121.0/24
                    ------------------
                            |
                            |
                       _____|_____
                      | |priv_int 192.168.121.253
       VPN Gateway(1) | |
                      |___________|pub_int A.A.A.A
                            |
                      ~~~~~~~~~~~~~
                         Internet
                      ~~~~~~~~~~~~~
                       _____|_____
                      | |
         Cable Modem | |pub_int B.B.B.B(forwarded to 10.0.0.2)
                      |___________|
                       _____|_____
                      | |pub/priv_int 10.0.0.2
       VPN Gateway(2) | |
                      |___________|priv_int 192.168.122.254
                            |
                            |
                            |
                    ------------------
                     192.168.122.0/24

Here is what I have in ipsec.conf on VPN Gateway (1):
flush;
spdflsuh;
spdadd A.A.A.A/32 B.B.B.B/32 ipencap -P out ipsec esp/tunnel/A.A.A.A-B.B.B.B/require;
spdadd B.B.B.B/32 A.A.A.A/32 ipencap -P in ipsec esp/tunnel/B.B.B.B-A.A.A.A/require;

ifconfig output:

dc0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        inet 192.168.121.253 netmask 0xffffff00 broadcast 192.168.121.255
        ether 00:a0:cc:d1:a2:df
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
dc1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        inet A.A.A.A netmask 0xfffffff8 broadcast 216.160.154.159
        ether 00:a0:cc:62:f0:6a
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
gif1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1280
        tunnel inet A.A.A.A --> B.B.B.B
        inet 192.168.121.253 --> 192.168.122.254 netmask 0xffffffff

VPN Gateway 2(10.0.0.1) ipsec.conf:
spdadd 0.0.0.0/0 A.A.A.A/32 ipencap -P out ipsec esp/tunnel/10.0.0.2-A.A.A.A/require;
spdadd A.A.A.A/32 0.0.0.0/0 ipencap -P in ipsec esp/tunnel/A.A.A.A-10.0.0.2/require;

ifconfig output:
bge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        options=3<RXCSUM,TXCSUM>
        inet 10.0.0.2 netmask 0xffffff00 broadcast 10.0.0.255
        ether 00:0e:7f:ff:0e:0c
        media: Ethernet autoselect (10baseT/UTP <half-duplex>)
        status: active
xl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        options=3<RXCSUM,TXCSUM>
        inet 192.168.122.254 netmask 0xffffff00 broadcast 192.168.122.255
        ether 00:04:75:8b:80:ce
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
gif0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1280
        tunnel inet 10.0.0.2 --> A.A.A.A
        inet 192.168.122.254 --> 192.168.121.253 netmask 0xffffffff

Until I instate a SP for these two hosts I can pass traffic back and forth to both private subnets (192.168.X.X) just fine. Once I read in these ipsec policies I can not get any traffic back and forth.. Any suggestions? I looked numerous places and found no one else documenting problems or success.

Thanks
_______________________________________________
freebsd-securityfreebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribefreebsd.org"

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]