[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Linux box as an IPsec router

On Wed, Jan 23, 2002 at 09:02:05AM +0100, Olsen Gerhard-Just wrote:
> Hi I'm investigating the possibility to use Linux box as an IPsec router. I
> want to be able to connect win clients to a LAN over the internet using
> IPsec. there is a win2k server set up with IPsec. Has any one any experience
> with this?

Yes, the FreeS/WAN ipsec implementation for Linux (www.freeswan.org) can
interoperate with Win2k/XP, etc.  I have not used IPsec on Windows, but
am running an IPsec gateway on a Debian potato system, as well as
several IPsec hosts on various other Debian systems.

> It needs to completely block ALL other incoming and outgoing traffic. (I
> want to force the clients thru a proxy.)


> It has to be rook stable.

I've never had a Linux system crash.  The FreeS/WAN code is very high
quality, and has introduced no stability issues.

> Maybe it needs to have some form of local ip handling (DHCP etc.)

apt-get install dhcpd

> The server has static ip but the IPsec router dose not.

This is probably fine, but will require a bit of configuration magic.
The freeswan docs describe such a configuration as a "roadwarrior",
since it usually is used for mobile laptops.  I've got such a setup
running, however the machine with the dynamic IP is not a gateway.

> I think there are some plug and pray routers ho has these functions all
> ready, but if I can use a free Linux on a old pc.

Make sure the machine has enough CPU power to perform the encryption
fast enough to avoid any kind of performance hit.  I've got freeswan
running on a couple of fairly slow machines (a dual PPro 200 and a 300
MHz Apple PowerMac G3) and don't seem to have any problems.

> I herd something about the windows implementation of the Kerberos V5
> Protocol not being compatible with the Kerberos V5 Protocol. hens it dos not
> work with any thing else then Windows Is this true?

This isn't related to IPsec (unless you plan on using kerberos to
exchange IPsec auth info, which you con't do in Linux anyway).  But yes,
MS broke kerberos.  They bolted Windows ACLs on to it, but since
non-Windows implementations don't know anything about ACLs, bad things
can happen.  If your KDC is a Unix system, though, I think you can make
things work.  Interoperability is not completely broken.

> Is there anything else I need to think about?

Make sure you read the interoperability docs.  Some tweaking must be
done to get different IPsec implementations to talk to each other.  This
info is linked from freeswan.org.


| Web: http://web.morgul.net/~frodo/
| PGP Public Key: http://web.morgul.net/~frodo/mail.html 

Attachment: pgp1eUb6EUgPh.pgp
Description: PGP signature

Reply to: