[Openswan Users] Setting up VPN between Linux box and Fortigate firewall

Jim Barber jim.barber at ddihealth.com
Sun Aug 27 22:35:10 EDT 2006

It's interesting that you needed to specify the nexthop parameters.
I didn't need to.
My complete config is as follows:

	version 2.0

	config setup

	conn fortigate

Where X.X.X.X is the external IP address of my Linux host with a network behind it and bound to one of it's interfaces.
Y.Y.Y.Y is the external IP address of the fortigate unit and has a network behind it.

Note the above is the result of me combining sections together into one to simplify for this message.
I actually have 'conn %default' section with common settings, and multiple definitions for accessing different subnet ranges that are behind the fortigate device.
These definitions are using something like 'also=fortigate-common' to include the parts that are common to all.

I'm not sure if I need the virtual_private setting or not.
It is still there from when I was playing with road-warrior setups, but I figure there's no harm in leaving it and specifying within it to exclude my own private address space (

I'm using NETKEY so there are no separate ipsecX interfaces created.
As others have already mentioned, the traffic that gets encrypted is completely controlled by the IPsec policy that you define in your config.
This also goes for routes, etc. You never explicitly add routes.
Any subnets you need to reach on the other side will need an IPsec phase2 config set up.

As you stated you also need the correct firewall rules in place to allow this to work.
I no longer use iptables directly as I found it started to get unwieldy maintaining all of the rules after a while.
I now use shorewall which was quite easy to set up.

Jim Barber
DDI Health

Rhys Johnson wrote:
> Ok I can ping from both sides now. However how can I ensure that only
> traffic destined for the remote subnet will be encrypted? All other
> traffic should proceed out the default gateway as normal.
> My routing table is
> Destination     Gateway         Genmask         Flags Metric Iface
> U     0       eth1
>   U     0       eth0
>   UG    0       eth1
>         UG    0       eth1
> I added the interfaces="ipsec0=eth1" line to my ipsec.conf to get
> openswan to only manage packets heading out the ipsec0 interface. Thus
> leaving web traffic out eth1 alone.
> ============================
> config setup       
>         klipsdebug=none
>         interfaces="ipsec0=eth1"
> # Add connections here
> conn fortigate
>      auto=start
>      left=
>      leftsubnet=
>      leftnexthop=
>      leftsourceip=
>      right=
>      rightsubnet=
>      keyingtries=0
>      pfs=yes
>      auth=esp
>      esp=3des
>      authby=secret
> ===============================
> I restarted ipsec but it won't add a new route for ipsec0. What am I
> doing wrong?
> I also added the following firewall rule so that packets to the remote
> subnet weren't NATed
> # Masquerade the connection out eth1
> iptables -t nat -A POSTROUTING -o $EXTERNAL_IF -d ! -j
> SNAT --to-source $EXTERNAL_IP
> Cheers
> Rhys

More information about the Users mailing list