OpenSwan is a VPN that implements IPsec. Through the addition of the xl2tp package we can implement a complete VPN setup that works with that mac and the iPhone natively. The current OpenSwan package (as of November 2010) require kernel modifications to run and is therefore a little trickier to install. However the StrongSwan package doesn't so it's pretty easy to install.
apt-get install build-essential fakeroot dpkg-dev devscripts apt-get source strongswan apt-get install libcurl4-openssl-dev ipsec-tools apt-get build-dep strongswan
This set of commands gets the tools needed to build packages (you probably have them, but this is safe), gets the source for strongswan, gets some tools that are needed by strongswan, and then makes sure that all the build dependencies are satisfied. These commands probably need to be run as root. Be mindful that the source will be checked out to whatever directory you're currently in.
cd strongswan-*.*.*/
As of this writing the command is actually
cd strongswan-4.2.4/
But this will increment with time. Next you want to increment the version, this indicates that you're making you're version to the debian package system. It also lets you look over the changelog.
dch -i
The -i indicated that you are incrementing the release number.
Next you want to change the build rules to enable NAT translation. This isn't enabled by default and is the whole reason we checked out the source instead of installing a binary. The rules for building the strongswan package are found in the strongswan folder under debian/rules, you want to edit these
vim debian/rules
Look for the line:
–disable-md5 –disable-sha1 –disable-sha2 \
and change it to:
–disable-md5 –disable-sha1 –disable-sha2 –enable-nat-transport \
Ready to build:
dpkg-buildpackage -rfakeroot -uc -b
And then to install:
dpkg -i ../*.deb
If everything went well strongswan is now installed!
Important Files
/etc/ipsec.conf /etc/ipsec.secrets
Important Files
/etc/xl2tpd/l2tp-secrets /etc/xl2tpd/xl2tpd.conf /etc/ppp/options.xl2tpd
The thing to check for is that traffic is arriving at the server. This can be done with a tcp dump on the server end
tcpdump -i eth0 -n -p udp port 500 or udp port 4500
You will need to either be root or execute this command as a superuser because tcpdump grabs the raw unix socket information. If traffic isn't arriving check for firewalls that may be blocking the traffic.
tail -f /var/log/auth.log /var/log/daemon.log
ipsec secrets
Needs to be executed by a super user or root
ipsec status
Needs to be executed by a super user or root
This comes from the strong swan mailing list
Hi
This is perhaps a stupid Question .. but with a simple apt-get install build-essential fakeroot dpkg-dev devscripts
apt-get source strongswan apt-get install libcurl4-openssl-dev ipsec-tools apt-get build-dep strongswan configuration
auth=secret and a valid ipsec.secrets (one PSK Entry) i got this
Message:
Jun 1 09:20:12 vm1 pluto[4383]: packet from 172.16.100.2:1333: initial
Main Mode message received on 172.16.101.250:500 but no connection has
been authorized with policy=PSK
Have you enabled nat_traversal=yes in the config setup section?
If the answer is no then any source port different from UDP/500 will be recejected independently of the fact that the authentication is based on RSA or PSK.