<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<br>
Hello :-)<br>
Alex a écrit :
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com" type="cite">
<pre wrap="">On Wednesday 13 June 2007 18:58, Julien GROSJEAN - Proxiad wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hello,
</pre>
</blockquote>
<pre wrap=""><!---->
Man, i told you that i just installed openswan yesterday. I have no experience
with this new implementation, but... anyway, read my commnets inline:
First: why are not using my config files on your machines? Just change IP
addresses according to your network design.
</pre>
</blockquote>
Because i wrote you a private mail ;-)<br>
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com" type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">version 2.0 # conforms to second version of ipsec.conf specification
# basic configuration
config setup
nat_traversal=yes
</pre>
</blockquote>
<pre wrap=""><!---->is ok here
</pre>
<blockquote type="cite">
<pre wrap=""> interfaces="ipsec0=eth1"
</pre>
</blockquote>
<pre wrap=""><!---->are you using KLIPS? If no, remove this line. NETKEY does not use it anymore!
</pre>
</blockquote>
No don't use... i remove this line...<br>
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com" type="cite">
<blockquote type="cite">
<pre wrap="">conn net-to-net
type=tunnel
</pre>
</blockquote>
<pre wrap=""><!---->don't need this line. Tunel is default type!
</pre>
</blockquote>
Done.<br>
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com" type="cite">
<blockquote type="cite">
<pre wrap=""> authby=secret
left=10.1.11.39
</pre>
</blockquote>
<pre wrap=""><!---->WOW. Here could be a problem. Here should come your IP address from external
interface of your left router!
</pre>
</blockquote>
If i put my private ip of my router, when i restart ipsec service, i
get this error :<br>
<br>
[root@vpnleft~]# ipsec auto --up net-to-net<br>
022 "net-to-net": We cannot identify ourselves with either end of this
connection.<br>
<br>
IPSEC wait for the local IP of my VPN box, which is 10.1.11.39 fot the
left side... :-|<br>
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com" type="cite">
<blockquote type="cite">
<pre wrap=""> leftsubnet=10.1.11.0/24
</pre>
</blockquote>
<pre wrap=""><!---->WOW: here is smoething wrong. should come your network class behind the router
(connected from your second interface - internal interface of your router)
</pre>
</blockquote>
My left router is 10.1.11.21 private ip and 193.x.x.x public ip<br>
All my stations are in 10.1.11.x /24 ... so i should put 10.1.11.0/24
in leftsubnet no ?<br>
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com" type="cite">
<blockquote type="cite">
<pre wrap=""> leftnexthop=10.1.11.21
</pre>
</blockquote>
<pre wrap=""><!---->assuming that left=10.1.11.39 is ok, here may be ok. </pre>
</blockquote>
That's the ip adress of the local interface of the vpn box<br>
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com" type="cite">
<pre wrap="">Here you should put the
addres of your next connected device (in general your gateway IP address from
your left router), so, should be something from the same class with your
external IP address of your router.</pre>
</blockquote>
You wrote : "external ip of my router" ? my external ip is my ISP
adress... 193.x.x.x my public adress.<br>
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com" type="cite">
<pre wrap=""> To be sure, you can replace with:
leftnexthop=%defaultroute
</pre>
<blockquote type="cite">
<pre wrap=""> right=217.x.x.xx
</pre>
</blockquote>
<pre wrap=""><!---->here is ok
</pre>
<blockquote type="cite">
<pre wrap=""> rightsubnet=192.168.10.0/24
</pre>
</blockquote>
<pre wrap=""><!---->ok too. Also add here:
rightnexthop=%defaultroute
</pre>
<blockquote type="cite">
<pre wrap=""> keyexchange=ike
</pre>
</blockquote>
<pre wrap=""><!---->add here: auth=esp
</pre>
<blockquote type="cite">
<pre wrap=""> esp=3des-md5
</pre>
</blockquote>
<pre wrap=""><!---->replace with:
esp=3des-md5-96
also add:
keylife=8h
pfs=no
</pre>
<blockquote type="cite">
<pre wrap=""> auto=add
</pre>
</blockquote>
<pre wrap=""><!---->No, forget about add (i know that add is writed in howto, but forget about)...
put here:
auto=start
</pre>
<blockquote type="cite">
<pre wrap="">#Disable Opportunistic Encryption
include /etc/ipsec.d/examples/no_oe.conf
</pre>
</blockquote>
<pre wrap=""><!---->
rest of crap deleted!
and now, start ipsec on booth sides: service ipsec start ...
Also, be sure that you are not firewalled on the left/right side and ESP
traffic can pass your firewall rules!
</pre>
</blockquote>
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com" type="cite">
<pre wrap="">
That's all.
</pre>
</blockquote>
All the rest is ok ;-)<br>
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com" type="cite">
<pre wrap="">
Regards,
Alx
</pre>
</blockquote>
Thanks<br>
<br>
</body>
</html>