IPSec/VPN Hints

Here's a 'summary' of the steps I did to get my stuff running....if it
helps, great:

> Just wondering if you have any documentation on how you did
> all this?

Yep...unfortunately, as with any Unix docs, my collection of hints/MAN
pages/Web Tutorials is about 2 inches thick.

but here's a recap that should hopefully get you started at least (again
this is a recap of how I did it - setup/systems may vary)

1).  On each network, make sure that you have a *BSD (I used OpenBSD) box
that is acting as a 'bridge' (ie. they have two NIC's, one with
external/static IP and one on the internal network).  They can both be the
Gateways/Firewalls for their respective networks (makes it easier), but not
necessary (if not, what you'll have to do is make a static route for the
'foreign' network to the specific *BSD box to be the 'gateway' for all
packets in that IP range - will show example later).

2).  Read/print/re-read the OpenBSD FAQ chapter 13. Using IPSec.  Follow the
basic example for manual key exchange to start with.

3).  Read/print/re-read the script /usr/share/ipsec/rc.vpn - use it to
'start' the vpn connection on the two machines w/ the following points/ideas
(taken shamelessly from Quist Consulting Email: [email protected] - contact them
if you need consulting help):

Then you have to set LOCAL_NET_0 and REMOTE_NET_0 on each machine
and flip them on the remote end. Then flip the  SPI_OUT and SPI_IN
values on the peers.

Then run rc.vpn on each side.


4).  Make sure you setup gateways properly for packets to get
through...here's my promised example:

          192.168.1.7           v-static to 192.168.2.1
User      <-->Gateway<-->Internet<-->Other *BSD<-->Server 192.168.2.10
192.168.1.23   ^also has static IP

Ok...what this is showing that how a packet will flow from User to
Server...since 192.168.1.7 is the normal Gateway for 'User' (because the
*BSD box is also the Firewall/Gateway)...they will be encrypted and sent
over internet to destination (all setup in rc.vpn) which is the other *BSD
box.  The Server will receive the packet, but will try to send info back
through it's main Gateway (192.168.2.5)..SO, on that main gateway you need
to add a Static Route....(can be done with the command if Unix based):

                  Destination   Gateway
route -n add -net 192.168.1.0 192.168.2.1

5). With this setup, your entire 192.168.1.0 network will be 'joined' with
the 192.168.2.0 network - you should be able to ping back in fourth (a
digital game of Ping-pong??)

6).  If you have Windows clients on either end that want to talk to each
other, you'll need to have a common WINS server that they share...with that,
Network Neighborhood will work)

Hope that helps and lessens the 'beating head against wall' routine

Dave