I totally appreciate all the help. I got it working, and it runs GREAT! Thanks! Michael Robinson wrote: > > Brian Nelson <[EMAIL PROTECTED]> writes: > >> % cat /dev/random | od -X > > > >I should then be using a 30-character octal random string, yes? I had > >to use urandom. > > 128-bit (16-byte, 32-character) hexadecimal string (more or less, according > to whatever hash algorithm you pick; 128 bits is for hmac-md5). > > >> pipsecd uses symmetric keys for security associations (if you've ever used > >> RADIUS secrets, it's the same sort of thing). > > > >So, the same octal string needs to be used on each side, for auth, > >right? > > Like this: > > host 1: > sa (ipah|ipsec) spi=<host1 sa index> (akey|ekey)=<sa key 1> > sa (ipah|ipsec) spi=<host2 sa index> (akey|ekey)=<sa key 2> dest=<host 2> > > host 2: > sa (ipah|ipsec) spi=<host2 sa index> (akey|ekey)=<sa key 1> > sa (ipah|ipsec) spi=<host1 sa index> (akey|ekey)=<sa key 2> dest=<host 1> > > The spi is a table index. It is included in the esp packet, and tells > pipsecd which configuration line should be referenced. Thus, in the example > above, <host1 sa index> has to be the same in both places, and <host2 sa > index> has to be the same in both places. > > If the (local/remote) spi's match, and the protocol (ipsec, ipah) matches, > then the key and algorithm also have to match on both systems. Of course, > nothing prevents you from using the same key everywhere, but that's not > particularly good practice. > > >ok, what we are doing is NATing 2 private networks, so this will be set > >up on the NAT boxes. > > > >192.168.2.x->nat-<-->Internet<-->-nat<-10.x.x.x > > Ugly. Both ends of the encrypted tunnel need to be in one subnet. > You'll have to create a link subnet, and set up routing for it. > > e.g.: > > ifconfig tun0 172.16.0.1 172.16.0.2 netmask 0xfffffffc mtu 1440 > route add -net 10.0.0.0 172.16.0.2 -netmask 0xff000000 > > And vice-versa on the other system. This goes into /etc/ipsec/startup. > > Also, the "dest=" fields have to be the raw ip addresses, not the NAT > ip addresses (unless your NAT handles esp packets). In other words, > VPN packets go through the ipsec tunnel, non-VPN packets go > through the NAT, and no packets go through both. > > >-- HOST 1 -- > >sa ipah spi=1000 auth=hmac-md5-96 akey=[STRING1] dest=[HOST2] > >sa ipah spi=1000 auth=hmac-md5-96 akey=[STRING2] > >if /dev/tun0 local_spi=1000 remote_spi=1000 > >-- HOST 1 -- > > >-- HOST 2 -- > >sa ipah spi=1000 auth=hmac-md5-96 akey=[STRING1] dest=[HOST1] > >sa ipah spi=1000 auth=hmac-md5-96 akey=[STRING2] > >if /dev/tun0 local_spi=1000 remote_spi=1000 > >-- HOST 2 -- > > This is backward. See above. > > -Michael Robinson > > ______________________________________________________________________ > OpenSSL Project http://www.openssl.org > User Support Mailing List [EMAIL PROTECTED] > Automated List Manager [EMAIL PROTECTED] -- Brian Nelson Network Minion mailto:[EMAIL PROTECTED] PocketScience, Inc. * Give a man a fish and you feed him for a day; teach him to use the Net and he won't bother you for weeks.
begin:vcard n:Nelson;Brian x-mozilla-html:FALSE org:PocketScience, Inc;Network Operations adr:;;;;;; version:2.1 email;internet:[EMAIL PROTECTED] title:Network Daemon x-mozilla-cpt:;0 fn:Brian Nelson end:vcard
