Howto OpenSWAN - Revision history

Admin: /* Client Configuration */

2012-09-03T18:26:27Z

Client Configuration

Admin: /* OpenSwan Setup */

2012-09-03T18:25:34Z

OpenSwan Setup

Admin: /* OpenSwan Setup */

2012-09-03T18:24:47Z

OpenSwan Setup

Admin: /* OpenSwan Setup */

2012-09-03T18:24:22Z

OpenSwan Setup

Admin: /* OpenSwan Setup */

2012-09-03T18:23:52Z

OpenSwan Setup

Admin: /* OpenSwan Setup */

2012-09-03T18:23:00Z

OpenSwan Setup

Admin: /* OpenSwan Setup */

2012-09-03T18:22:18Z

OpenSwan Setup

Admin: /* OpenSwan Setup */

2012-09-03T18:21:31Z

OpenSwan Setup

Admin: /* Server Configuration */

2012-09-03T18:21:15Z

Server Configuration

Admin: /* Introduction */

2012-09-03T18:20:37Z

Introduction

@@ Line 119: / Line 119: @@
 Just take the stanza below and put it into a text file - import it afterwards with the shrew vpn client's import function:
-{{{
+ n:network-ike-port:500
-n:network-ike-port:500
+ n:client-addr-auto:0
-n:client-addr-auto:0
+ n:network-natt-port:4500
-n:network-natt-port:4500
+ n:network-natt-rate:30
-n:network-natt-rate:30
+ n:network-dpd-enable:1
-n:network-dpd-enable:1
+ n:network-frag-enable:1
-n:network-frag-enable:1
+ n:network-frag-size:1300
-n:network-frag-size:1300
+ n:client-banner-enable:0
-n:client-banner-enable:0
+ n:network-notify-enable:1
-n:network-notify-enable:1
+ n:client-wins-used:0
-n:client-wins-used:0
+ n:client-wins-auto:1
-n:client-wins-auto:1
+ n:client-dns-used:0
-n:client-dns-used:0
+ n:client-dns-auto:1
-n:client-dns-auto:1
+ n:client-splitdns-used:1
-n:client-splitdns-used:1
+ n:client-splitdns-auto:1
-n:client-splitdns-auto:1
+ n:phase1-dhgroup:0
-n:phase1-dhgroup:0
+ n:phase1-life-secs:86400
-n:phase1-life-secs:86400
+ n:phase1-life-kbytes:0
-n:phase1-life-kbytes:0
+ n:phase2-life-secs:3600
-n:phase2-life-secs:3600
+ n:phase2-life-kbytes:0
-n:phase2-life-kbytes:0
+ n:policy-list-auto:0
-n:policy-list-auto:0
+ n:phase1-keylen:0
-n:phase1-keylen:0
+ n:phase2-keylen:0
-n:phase2-keylen:0
+ s:network-natt-enable:enable
-s:network-natt-enable:enable
+ s:phase2-compress:none
-s:phase2-compress:none
+ s:policy-list-type:include
-s:policy-list-type:include
+ s:policy-entry-network:192.168.2.0 / 255.255.255.0
-s:policy-entry-network:192.168.2.0 / 255.255.255.0
+ s:network-host:hostname.of.your.company.vpn.srv
-s:network-host:hostname.of.your.company.vpn.srv
+ s:client-auto-mode:pull
-s:client-auto-mode:pull
+ s:client-iface:virtual
-s:client-iface:virtual
+ s:client-ip-addr:192.168.2.23
-s:client-ip-addr:192.168.2.23
+ s:client-ip-mask:255.255.255.0
-s:client-ip-mask:255.255.255.0
+ s:network-natt-mode:enable
-s:network-natt-mode:enable
+ s:network-frag-mode:enable
-s:network-frag-mode:enable
+ s:client-wins-addr:0.0.0.0
-s:client-wins-addr:0.0.0.0
+ s:client-dns-addr:0.0.0.0
-s:client-dns-addr:0.0.0.0
+ s:auth-method:mutual-rsa
-s:auth-method:mutual-rsa
+ s:ident-client-type:asn1dn
-s:ident-client-type:asn1dn
+ s:ident-server-type:asn1dn
-s:ident-server-type:asn1dn
+ s:ident-client-data:C=DE, ST=Bavaria, O=test,CN=Mike/emailAddress=mike@test.net
-s:ident-client-data:C=DE, ST=Bavaria, O=test,CN=Mike/emailAddress=mike@test.net
+ s:ident-server-data:C=DE, ST=Bavaria, O=test,CN=vpn.test.net/emailAddress=vpn-server@test.net
-s:ident-server-data:C=DE, ST=Bavaria, O=test,CN=vpn.test.net/emailAddress=vpn-server@test.net
+ s:auth-server-cert:mikeroadwarrior-rw.p12
-s:auth-server-cert:mikeroadwarrior-rw.p12
+ s:auth-client-cert:mikeroadwarrior-rw.p12
-s:auth-client-cert:mikeroadwarrior-rw.p12
+ s:auth-client-key:mikeroadwarrior-rw.p12
-s:auth-client-key:mikeroadwarrior-rw.p12
+ s:phase1-exchange:main
-s:phase1-exchange:main
+ s:phase1-cipher:3des
-s:phase1-cipher:3des
+ s:phase1-hash:sha1
-s:phase1-hash:sha1
+ s:phase2-transform:esp-aes
-s:phase2-transform:esp-aes
+ s:phase2-hmac:sha1
-s:phase2-hmac:sha1
+ s:ipcomp-transform:disabled
-s:ipcomp-transform:disabled
+ n:phase2-pfsgroup:-1
-n:phase2-pfsgroup:-1
+ s:policy-list-include:192.168.0.0 / 255.255.255.0
 As we prepare the client configurations in this example, the client ip is predefined. The network settings can also be assigned by the

@@ Line 34: / Line 34: @@
 .1. Creating the CA (valid for 10 years)
   openssl req -x509 -days 3650 -newkey rsa:2048 \
-  -keyout /etc/ipsec.d/private/caKey.pem -out /etc/ipsec.d/cacerts/caCert.pem
+  -keyout /etc/ipsec.d/private/caKey.pem \
 .2. Creating a certification-request for our server or/and client:
@@ Line 60: / Line 61: @@
 Hint: we create a p12 container which contains nearly all files for the clients: (we assume that you already created a
 client cert request and signed this by the CA like we explained at point 2.2)
-  openssl pkcs12 -export -inkey roadwarriorKey.pem -in raodwarriorCert.pem -certfile \
+  openssl pkcs12 -export -inkey roadwarriorKey.pem \
- /etc/ipsec.d/cacerts/caCert.pem -out mikeroadwarrior-rw.p12
+ -in raodwarriorCert.pem -certfile /etc/ipsec.d/cacerts/caCert.pem \
 we got a nice and handy .p12 file which can be integrated in shrew net vpn client for the clients through the import function.

@@ Line 60: / Line 60: @@
 Hint: we create a p12 container which contains nearly all files for the clients: (we assume that you already created a
 client cert request and signed this by the CA like we explained at point 2.2)
-{{{
+ openssl pkcs12 -export -inkey roadwarriorKey.pem -in raodwarriorCert.pem -certfile \
-openssl pkcs12 -export -inkey roadwarriorKey.pem -in raodwarriorCert.pem -certfile \
+ /etc/ipsec.d/cacerts/caCert.pem -out mikeroadwarrior-rw.p12
 we got a nice and handy .p12 file which can be integrated in shrew net vpn client for the clients through the import function.

@@ Line 33: / Line 33: @@
 .1. Creating the CA (valid for 10 years)
-  openssl req -x509 -days 3650 -newkey rsa:2048 -keyout /etc/ipsec.d/private/caKey.pem -out /etc/ipsec.d/cacerts/caCert.pem
+  openssl req -x509 -days 3650 -newkey rsa:2048 \
 .2. Creating a certification-request for our server or/and client:
@@ Line 44: / Line 45: @@
   echo "01" >> demoCA/serial
 Now the certification-request for our server:
-  openssl req -newkey rsa:1024 -keyout /etc/ipsec.d/private/serverKey.pem -out /etc/ipsec.d/private/serverReq.pem
+  openssl req -newkey rsa:1024 \
 .3. Signing the certification-request with our just created

@@ Line 48: / Line 48: @@
 .3. Signing the certification-request with our just created
 certification-authority (CA) (valid for 2 years)
-  openssl ca -in /etc/ipsec.d/private/serverReq.pem -days 730 -out /etc/ipsec.d/private/serverCert.pem -notext -cert /etc/ipsec.d/cacerts/caCert.pem -keyfile /etc/ipsec.d/private/caKey.pem
+  openssl ca -in /etc/ipsec.d/private/serverReq.pem -days 730 \
 .4. Creating client-certs

@@ Line 33: / Line 33: @@
 .1. Creating the CA (valid for 10 years)
-  openssl req -x509 -days 3650 -newkey rsa:2048 -keyout /etc/ipsec.d/private/caKey.pem \
+  openssl req -x509 -days 3650 -newkey rsa:2048 -keyout /etc/ipsec.d/private/caKey.pem -out /etc/ipsec.d/cacerts/caCert.pem
 .2. Creating a certification-request for our server or/and client:
 Openssl is fussy about a directory structure so we create it here:
-{{{
+ cd /etc/openssl/
-cd /etc/openssl/
+ mkdir demoCA
-mkdir demoCA
+ mkdir demoCA/newcerts
-mkdir demoCA/newcerts
+ mkdir demoCA/private
-mkdir demoCA/private
+ touch demoCA/index.txt
-touch demoCA/index.txt
+ echo "01" >> demoCA/serial
 Now the certification-request for our server:
-{{{
+ openssl req -newkey rsa:1024 -keyout /etc/ipsec.d/private/serverKey.pem -out /etc/ipsec.d/private/serverReq.pem
 .3. Signing the certification-request with our just created

@@ Line 76: / Line 76: @@
 == Server Configuration ==
 /etc/ipsec.conf
@@ Line 119: / Line 118: @@
   include /etc/ipsec.d/examples/no_oe.conf
 /etc/ipsec.secrets
 # serverKey.pem and oursecretpassword is the one we have specified at 2.2
 : RSA serverKey.pem "oursecretpassword"
 == Client Configuration ==

@@ Line 4: / Line 4: @@
 connectivity. The Shrew Soft VPN Client has been reported to inter-operate correctly with OpenSwan.
- == Overview ==
+== Overview ==
 The configuration example described below will allow an IPsec VPN client to communicate with a single