Create an IPSEC tunnel in Debian for tunneling NFS and other traffic

Auge David Hausheer
Google
Web hausheer.osola.com

Home

CV

Guestbook

Japan

Gallery

latex2png

Links

CFPs

Publications

Bibliography

Docs

Software

Contact

Installation

Make sure your kernel supports IPSEC:

Install ipsec-tools:

apt-get install ipsec-tools

Configuration

Edit /etc/ipsec-tools.conf locally (here 111.000.111.000):

#!/usr/sbin/setkey -f

# Flush the SAD and SPD
flush;
spdflush;

add 222.111.222.111 111.000.111.000 esp 12340 -m tunnel -E 3des-cbc "secret1";
add 111.000.111.000 222.111.222.111 esp 12341 -m tunnel -E 3des-cbc "secret2";

spdadd 111.000.111.000 222.111.222.111 any -P out ipsec esp/tunnel/111.000.111.000-222.111.222.111/require;
spdadd 222.333.444.555 111.000.111.000 any -P in ipsec esp/tunnel/222.111.222.111-111.000.111.000/require;

Edit /etc/ipsec-tools.conf remotely (here 222.333.444.555):

#!/usr/sbin/setkey -f

# Flush the SAD and SPD
flush;
spdflush;

add 222.111.222.111 111.000.111.000 esp 12340 -m tunnel -E 3des-cbc "secret1";
add 111.000.111.000 222.111.222.111 esp 12341 -m tunnel -E 3des-cbc "secret2";

spdadd 222.333.444.555 111.000.111.000 any -P out ipsec esp/tunnel/222.111.222.111-111.000.111.000/require;
spdadd 111.000.111.000 222.111.222.111 any -P in ipsec esp/tunnel/111.000.111.000-222.111.222.111/require;

Let your local firewall accept esp packets:

iptables -A INPUT -s 222.333.444.555 -p esp -j ACCEPT

Let your remote firewall accept esp packets:

iptables -A INPUT -s 111.000.111.000 -p esp -j ACCEPT

More info

Related topics

This document was last modified on Friday, 30-Nov-2007 16:17:57 CET
© 1999 - 2010 David Hausheer. All rights reserved.