VPN setup behind iptables

Hi all,

I am trying to configure some rules in my Linux box for an external
windows 2000 machine to VPN to the private network.

Windows 2k workstation
|
Internet
|
(Public IP)
Netgear DG834 Router
(10.0.0.1)
|
(10.0.0.2)
Linux Firewall
(192.168.0.1)
|
Windows VPN server(192.168.0.5)

There is only one public address and everything is open for testing on
Netgear router.

What do I need to do to setup the VPN?
What do I need to do on the linux firewall using iptables?

Thank you in advance.

you will need tcp 1723 & gre (51,51, cant remember) forwarded to the windows
server, also you will obviously need the firewall to accept these protocols
as well.


"Soojin Kim" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed) om...
> Hi all,
>
> I am trying to configure some rules in my Linux box for an external
> windows 2000 machine to VPN to the private network.
>
> Windows 2k workstation
> |
> Internet
> |
> (Public IP)
> Netgear DG834 Router
> (10.0.0.1)
> |
> (10.0.0.2)
> Linux Firewall
> (192.168.0.1)
> |
> Windows VPN server(192.168.0.5)
>
> There is only one public address and everything is open for testing on
> Netgear router.
>
> What do I need to do to setup the VPN?
> What do I need to do on the linux firewall using iptables?
>
> Thank you in advance.

sorry, that should have been 50 or 51.
i have this set up to access the work network, from memory only one client
can connect because of nat/vpn issues with w2k server. i think this issue
may be sorted with 2003 server.

"mark cosens" <(E-Mail Removed)> wrote in message
news:40366c9a$0$61972$(E-Mail Removed) ...
> you will need tcp 1723 & gre (51,51, cant remember) forwarded to the
windows
> server, also you will obviously need the firewall to accept these
protocols
> as well.
>
>
> "Soojin Kim" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed) om...
> > Hi all,
> >
> > I am trying to configure some rules in my Linux box for an external
> > windows 2000 machine to VPN to the private network.
> >
> > Windows 2k workstation
> > |
> > Internet
> > |
> > (Public IP)
> > Netgear DG834 Router
> > (10.0.0.1)
> > |
> > (10.0.0.2)
> > Linux Firewall
> > (192.168.0.1)
> > |
> > Windows VPN server(192.168.0.5)
> >
> > There is only one public address and everything is open for testing on
> > Netgear router.
> >
> > What do I need to do to setup the VPN?
> > What do I need to do on the linux firewall using iptables?
> >
> > Thank you in advance.
>
>

On 2004-02-20, Soojin Kim <(E-Mail Removed)> wrote:
> [snipped]
>
> What do I need to do to setup the VPN?
> What do I need to do on the linux firewall using iptables?
>
get yourself a router that does 'PPP half bridge' (or sometimes called ZIPB),
this will then put the real IP address of the router onto a dhcp-enabled
client inside your network.

Much that I love the Netgear boxes, especially as that one runs linux, I only
do so as a recommendation to our lusers, the last thing I want is their
computers not NATed....people are bad enough with opening attachments they
have been told not to

My home setup is KAME (Linux 2.6.x required) and rp-L2TP. For the VPN you
will need to play with IPSec+L2TP. I only recently got my setup working, but
to save you lots of time make sure you plan on giving out static addresses to
your VPNed 'satellite' clients and you use rp-l2tpd (as opposed to the
horrible 'l2tpd' which is as buugy as anything).

Then you simply can use my /etc/l2tp/l2tp.conf file as an example and dish
out SSL client certifications (X.501) to your windoze box. I use the
approach that the certificate authorises the machine to talk to the network,
however then you use CHAP to authorize what IP address you want
(/etc/ppp/chap-secrets).

An interesting thing with this approach is that you can export real IP
addresses anywhere you want and even if you are NATed on the other side of
the world, still you can have the same real IP address (without having to
have any 'relay' IP addresses being wasted).

The IPSec of things is much more straight forward, the one entry works for
everyone and you forget about it. I will leave it to you to play with
certificate generation and the relevent links below for you to play with.

have fun

Alex

[1] http://www.ipsec-howto.org/x247.html (KAME 2.6.x)
[2] http://www.ipsec-howto.org/x507.html (certificates)
[3] http://www.jacco2.dds.nl/networking/freeswan-l2tp.html

------------------ /etc/l2tp/l2tp.conf (1.2.3.4 is your servers real ip)
# Global section (by default, we start in global mode)
global

# Load handlers
load-handler "sync-pppd.so"
load-handler "cmd.so"

# Bind address
listen-port 1701

# Configure the sync-pppd handler. You MUST have a "section sync-pppd" line
# even if you don't set any options.
section sync-pppd
lns-pppd-opts "require-chap <realip>: lcp-echo-interval 30 lcp-echo-failure 6"
lac-pppd-opts "name <hostname> noipdefault ipcp-accept-local ipcp-accept-remote lcp-echo-interval 30 lcp-echo-failure 6 file /etc/l2tp/ppp.options"

# Peer section
section peer
peer 0.0.0.0
mask 0
hostname <hostname>
port 1701
lac-handler sync-pppd
lns-handler sync-pppd
hide-avps yes

# Configure the cmd handler. You MUST have a "section cmd" line
# even if you don't set any options.
section cmd
-----------------

----------------- /etc/l2tp/ppp.options
lock
noauth
#debug
dump
logfd 2
logfile /var/log/l2tpd.log
nodetach
noccp
novj
novjccomp
nopcomp
noaccomp
------------------

------------------ /etc/ppp/chap-secrets
# Secrets for authentication using CHAP
# client server secret IP addresses
#
# dd if=/dev/urandom bs=1 count=32 2>/dev/null | uuencode -m - (remove the ending '=')
#
# public IP's
<client 1> <servername> <passphrase> <ip one>

# internal IP's (10.0.254.0/24) - catchall
<client 2> <servername> <passphrase> <ip two>
-------------------

------------------- /etc/racoon/racoon.conf (relevent section)
remote anonymous {
# exchange_mode main, aggressive, base; uncomment this for windows only
# linux does not do aggresive mode and requires a different phase 1
# proposal
exchange_mode main, base;
#passive on;
verify_cert on;
generate_policy on;
proposal_check obey;
doi ipsec_doi;
situation identity_only;
certificate_type x509 "host-cert.pem" "host-key.pem";
my_identifier asn1dn;
proposal {
# Windows 2000, Cisco, others
encryption_algorithm des;
hash_algorithm md5;
authentication_method rsasig;
dh_group 1;
}
proposal {
# linux freeswan, more paranoic clients
# delete if you are dealing with windows only
# and enable aggressive mode
encryption_algorithm aes;
hash_algorithm sha1;
authentication_method rsasig ;
dh_group 2;
}
}

sainfo anonymous {
{
#pfs_group 2;
encryption_algorithm aes, blowfish, 3des, des;
authentication_algorithm hmac_sha1, hmac_md5;
compression_algorithm deflate;
}
-------------------

------------------- /etc/ipsec.conf
#!/usr/local/sbin/setkey -f

# Flush the SAD and SPD
flush;
spdflush;

### security policies for racoon
spdadd <hostip>[1701] 0.0.0.0/0 any -P out ipsec
esp/transport//require;
spdadd 0.0.0.0/0 <hostip>[1701] any -P in ipsec
esp/transport//require;
-------------------