IPSEC Tunnels

There is an excellent guide to configuring IPSEC tunnels at http://www.geocities.com/jixen66/. I highly recommend that you consult that site for information about configuring FreeS/Wan.

conn block
        auto=ignore

conn private
        auto=ignore

conn private-or-clear
        auto=ignore

conn clear-or-private
        auto=ignore

conn clear
        auto=ignore

conn packetdefault
        auto=ignore

Suppose that we have the following sutuation:

We want systems in the 192.168.1.0/24 sub-network to be able to communicate with systems in the 10.0.0.0/8 network.

To make this work, we need to do two things:

Opening the firewall for the IPSEC tunnel is accomplished by adding an entry to the /etc/shorewall/tunnels file.

In /etc/shorewall/tunnels on system A, we need the following

In /etc/shorewall/tunnels on system B, we would have:

Shorewall can be used in a VPN Hub environment where multiple remote networks are connected to a gateway running Shorewall. This environment is shown in this diatram.

We want systems in the 192.168.1.0/24 sub-network to be able to communicate with systems in the 10.0.0.0/16 and 10.1.0.0/16 networks and we want the 10.0.0.0/16 and 10.1.0.0/16 networks to be able to communicate.

To make this work, we need to do several things:

Opening the firewall for the IPSEC tunnels is accomplished by adding two entries to the /etc/shorewall/tunnels file.

In /etc/shorewall/tunnels on system A, we need the following

In /etc/shorewall/tunnels on systems B and C, we would have:

On each system, we will create a zone to represent the remote networks. On System A:

On systems B and C:

At system A, ipsec0 represents two zones so we have the following in /etc/shorewall/interfaces:

The /etc/shorewall/hosts file on system A defines the two VPN zones:

At systems B and C, ipsec0 represents a single zone so we have the following in /etc/shorewall/interfaces:

On systems A, you will need to allow traffic between the “vpn1” zone and the “loc” zone as well as between “vpn2” and the “loc” zone -- if you simply want to admit all traffic in both directions, you can use the following policy file entries on all three gateways:

On systems B and C, you will need to allow traffic between the “vpn” zone and the “loc” zone -- if you simply want to admit all traffic in both directions, you can use the following policy file entries on all three gateways:

Once you have the Shorewall entries added, restart Shorewall on each gateway (type shorewall restart); you are now ready to configure the tunnels in FreeS/WAN.

Suppose that you have a laptop system (B) that you take with you when you travel and you want to be able to establish a secure connection back to your local network.

Beginning with Shorewall release 1.3.10, you can define multiple VPN zones and add and delete remote endpoints dynamically using /sbin/shorewall. In /etc/shorewall/zones:

In /etc/shorewall/tunnels:

When Shorewall is started, the zones vpn[1-3] will all be empty and Shorewall will issue warnings to that effect. These warnings may be safely ignored. FreeS/Wan may now be configured to have three different Road Warrior connections with the choice of connection being based on X-509 certificates or some other means. Each of these connectioins will utilize a different updown script that adds the remote station to the appropriate zone when the connection comes up and that deletes the remote station when the connection comes down. For example, when 134.28.54.2 connects for the vpn2 zone the “up” part of the script will issue the command:

/sbin/shorewall add ipsec0:134.28.54.2 vpn2

and the “down” part will:

/sbin/shorewall delete ipsec0:134.28.54.2 vpn2