Howto l2tp/IPsec VPNServer (PSK MS-Chap for now)

AVNazyrov · n00b Joined: 05 Jul 2007 Posts: 3

VinzC, many thanks for your answer. I think, I'll try to use OpenVPN soon.
One remark: now OpenSWAN works with NATed nets perfectly too and requires only three UDP ports opened in firewall.

dashnu · l33t Joined: 21 Jul 2004 Posts: 703 Location: Casco Maine

Some random comments..

VinzC · Posted: Tue Aug 07, 2007 9:08 am Post subject:

mike123abc · n00b Joined: 24 Aug 2007 Posts: 1

Suse 9.3 2.6.11 Kernel <----> NAT Windows XP

I have openswan 2.2.0 and the latests download xl2tpd-1.1.11

The syslog info from pluto, it looks like it does its job and establishes an ipsec connection.

temper · Posted: Tue Dec 30, 2008 3:13 pm Post subject:

HI. It's my first time doing this king of connection... so I need little help from the community.
When I connect my client (windows xp sp3) to my host, internet goes down on client. I can ping both local and global ips in both ways, but client cannot ping anything outside vpn

I'm using:

VinzC · Posted: Tue Dec 30, 2008 5:05 pm Post subject:

Remember what a VPN is: a secure tunnel between your computer and the remote network. Secure tunnel means every network packet is sent through the tunnel for security. Hence there's no route to the Internet by default, other than through the default gateway at the opposite side of the tunnel.

That is to say that a host connected through VPN must isolate itself as well as the remote network from external attacks. If a VPN host is compromised then the remote network is under threat as well. This is why it is unwise to have a VPN host also connected to the Internet directly.

There are two ways for a host to also send/receive packets to/from the Internet: either directly (dangerous as I've just explained) or through a gateway on the remote network.

The latter option is preferable and requires adding routes to the gateway on the remote network and possibly changing firewall rules on the remote Internet gateway.
If this is not possible then the former option is your only choice

By default, Windows VPN hosts use the remote gateway as the default gateway, making Internet unavailable on the VPN host. You can change that behaviour on Windows XP by changing how Windows routes packets. There is a checkbox «Use default gateway on the remote network» (typing from memory) in the TCP/IP properties of your VPN connection. It is checked by default. Uncheck it before making the VPN connection and you'll be able to surf the Internet from your machine while the VPN link is active.

You've been warned ;-)

.
_________________
Gentoo addict: tomorrow I quit, I promise!... Just one more emerge...
GNU/Linux user #369763
“Wow! I feel root”

dashnu · l33t Joined: 21 Jul 2004 Posts: 703 Location: Casco Maine

I do not use this setup anymore however, it sounds to me as if your firewall at the remote end-point is causing the problem.

I routed all packets outbound from client through the tunnel and out the VPN.

Keep in mind with this setup a PPP+ interface is created and the proper forwarding rules must be set.

Is this VPN end-point also your firewall ? Or behind a firewall in place already?
_________________
write quit bang

temper · Posted: Tue Dec 30, 2008 8:02 pm Post subject:

OK, now I get little better understanding of how vpn works. But I'm still ubber n00b, I know... :lol:

Well, I will test this when my brother gets off of his MMORPG games

and let you know. I'll try both methods. This is my home network and I have no information sensitive things on it, or any service running to be concerned about security. My initial goal was to setup LAN connetion, but I don't have a router and spare NIC's to plug into PC's to setup LAN, they are both Laptops btw. I know there are other solution, like ftp, ssh but want to learn how to setup VPN's over IPsec...Thank you for help.

EDIT:

VinzC
dashnu
Thanks for helping me. I got it working finally. Thank you!!!

Aand have a Happy new year!