Routing a VPN.....confused

Routing a VPN.....confused

[Matt Brei]

Hi all,

I'm trying to set up a VPN with my buddy back in Chicago.  We're both
using iptables to nat our Internet connection to the rest of the LAN and
filter out all the naughtiness on the cable modem connection.  So far,
we've tried FreeS/WAN on the iptables routers, but as soon as we start
the ipsec service, it kills the Internet connection.  

Now I know this sounds like a FreeS/WAN problem, and it probably is, but
the mailing list seems to be down, and the netfilter people are great,
so I'm asking you.  Hopefully someone can give me some advice, or point
me in another direction. 

Is the ipsec service supposed to block the rest of the Internet?  If
this is supposed to happen, is there a way to stop it or will we need to
use 2 machines with public IP addresses?  Provided we can get the VPN
working, is there a way to use iptables to nat the VPN connection to the
rest of the LAN?  Basically we would like to use a PC with iptables and
whatever ipsec software just like you would use a Cisco PIX.

Thanks for your time,
Matt

Re: Routing a VPN.....confused

[John A. Sullivan III]

iptables and FreeS/WAN play very nicely together.  There are some
documents in the massive collection of documentation with FreeS/WAN that
treat using FreeS/WAN and a firewall together.  There are also some
slightly out of date slide shows at http://iscs.sourceforge.net on using
iptables, iproute2 and FreeS/WAN together.  You may find those helpful. 
Good luck - John

On Sat, 2003-12-13 at 21:24, Matt Brei wrote:
> Hi all,
> 
> I'm trying to set up a VPN with my buddy back in Chicago.  We're both
> using iptables to nat our Internet connection to the rest of the LAN and
> filter out all the naughtiness on the cable modem connection.  So far,
> we've tried FreeS/WAN on the iptables routers, but as soon as we start
> the ipsec service, it kills the Internet connection.  
> 
> Now I know this sounds like a FreeS/WAN problem, and it probably is, but
> the mailing list seems to be down, and the netfilter people are great,
> so I'm asking you.  Hopefully someone can give me some advice, or point
> me in another direction. 
> 
> Is the ipsec service supposed to block the rest of the Internet?  If
> this is supposed to happen, is there a way to stop it or will we need to
> use 2 machines with public IP addresses?  Provided we can get the VPN
> working, is there a way to use iptables to nat the VPN connection to the
> rest of the LAN?  Basically we would like to use a PC with iptables and
> whatever ipsec software just like you would use a Cisco PIX.
> 
> Thanks for your time,
> Matt
-- 
John A. Sullivan III
Chief Technology Officer
Nexus Management
+1 207-985-7880
john.sullivan@nexusmgmt.com

Re: Routing a VPN.....confused

[Ralf Spenneberg]

Am Son, 2003-12-14 um 03.24 schrieb Matt Brei:
> Hi all,
> 
> I'm trying to set up a VPN with my buddy back in Chicago.  We're both
> using iptables to nat our Internet connection to the rest of the LAN and
> filter out all the naughtiness on the cable modem connection.  So far,
> we've tried FreeS/WAN on the iptables routers, but as soon as we start
> the ipsec service, it kills the Internet connection. 
This sounds pretty much like a configuration issue using freeswan >=
2.0. FreeS/WAN enables opportunistic encryption (OE) by default. This
may interrupt your Internet connections since it tries to encrypt
everything by default. It uses policy groups for this. You probably have
to disable these policy groups.

Take a look at:
http://www.freeswan.org/freeswan_trees/freeswan-2.04/doc/policygroups.html#disable_policygroups

Cheers,

Ralf
-- 
Ralf Spenneberg
RHCE, RHCX

Book: VPN mit Linux
Book: Intrusion Detection für Linux Server   http://www.spenneberg.com
IPsec-Howto				     http://www.ipsec-howto.org
Honeynet Project Mirror:                     http://honeynet.spenneberg.org

Re: Routing a VPN.....confused

[Babar Kazmi]

[-- Attachment #1: Type: text/html, Size: 2896 bytes --]

RE: Routing a VPN.....confused

[Jan Kaastrup]

Hi 
I have had the same problem, and i found out that i forgot to put on
"leftnexthop" or "rightnexthop". Also be sure that the ipsec.conf files
are the same on both machines.

Another thing - if you are using %default route, this can also be the
problem. 

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Ralf
Spenneberg
Sent: 14. december 2003 12:50
To: mbrei@carolina.rr.com
Cc: Netfilter
Subject: Re: Routing a VPN.....confused


Am Son, 2003-12-14 um 03.24 schrieb Matt Brei:
> Hi all,
> 
> I'm trying to set up a VPN with my buddy back in Chicago.  We're both
> using iptables to nat our Internet connection to the rest of the LAN
and
> filter out all the naughtiness on the cable modem connection.  So far,
> we've tried FreeS/WAN on the iptables routers, but as soon as we start
> the ipsec service, it kills the Internet connection. 
This sounds pretty much like a configuration issue using freeswan >=
2.0. FreeS/WAN enables opportunistic encryption (OE) by default. This
may interrupt your Internet connections since it tries to encrypt
everything by default. It uses policy groups for this. You probably have
to disable these policy groups.

Take a look at:
http://www.freeswan.org/freeswan_trees/freeswan-2.04/doc/policygroups.ht
ml#disable_policygroups

Cheers,

Ralf
-- 
Ralf Spenneberg
RHCE, RHCX

Book: VPN mit Linux
Book: Intrusion Detection für Linux Server   http://www.spenneberg.com
IPsec-Howto				     http://www.ipsec-howto.org
Honeynet Project Mirror:
http://honeynet.spenneberg.org