Date: Sat, 28 Sep 2002 10:11:42 -0700 From: Lars Eggert <larse@ISI.EDU> To: Ian Cartwright <ian351c@cox.net> Cc: freebsd-hackers@freebsd.org Subject: Re: VPN Routing through gif (4) tunnel Message-ID: <3D95E2CE.6000502@isi.edu> References: <003b01c2670f$ab21bac0$6600a8c0@iansxp>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] Hi, Ian Cartwright wrote: > I am trying to construct a "B2B" mode VPN tunnel between my house and my > work using FreeBSD. ... > Here is my current configuration (IPs changed to protect the guilty): > > fxp0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 > inet 100.100.100.1 netmask 0xffffff00 broadcast 68.3.250.255 ... > fxp1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 > inet 192.168.0.1 netmask 0xffffff00 broadcast 192.168.0.255 ... > gif0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1280 > tunnel inet 68.3.250.5 --> 199.64.13.20 > inet 192.168.0.1 --> 200.200.200.1 netmask 0xffffff00 > > fxp0 is my external network adapter, connected to the Internet and > assigned "100.100.100.1" by my ISP. gif0 is the tunnel adapter and ties > my network to my work's network. The ip 200.200.200.1 is the inside > interface of my work's VPN server. > > The commands used to create the gif tunnel are as follows: ifconfig gif0 > create tunnel 100.100.100.1 200.200.201.1 ifconfig gif0 inet 192.168.0.1 > 200.200.200.1 netmask 255.255.255.0 > > 100.100.100.1 is my external address again > 200.200.201.1 is the external interface on my work's VPN server > 200.200.200.1 is the internal interface on my works VPN server again your tunnel configuration is a bit strange. You want the tunnel wrapper IP addresses to be those of the external interfaces, both locally and for your remote site. Also, give the tunnel itself addresses that don't overlap with addresses you already use. E.g.: ifconfig gif0 10.0.0.1 10.0.0.2 tunnel 100.100.100.1 <external-ip-of-remote-end> Then just add a route for your remote network to the tunnel, e.g. route add 200.200.200/24 10.0.0.2 As for IPsec and racoon: Are you negotiating IPsec tunnel mode SAs? In which case you MUST NOT set up a gif tunnel. (In short, that abuses the fact that two parallel tunnels trick routing into forwarding over a tunnel mode SA, with consequences; see ftp://ftp.isi.edu/internet-drafts/draft-touch-ipsec-vpn-04.txt. Lars -- Lars Eggert <larse@isi.edu> USC Information Sciences Institute [-- Attachment #2 --] 0 *H 01 0 + 0 *H 080fErtcvE.0 *H 01 0 UZA10U Western Cape10U Cape Town10U Thawte Consulting1(0&U Certification Services Division1$0"UThawte Personal Freemail CA1+0) *H personal-freemail@thawte.com0 000830000000Z 040827235959Z01 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.3000 *H 0 32c %E>nx'gڈD)c5*mp<ܮto034qmOe KaU5u'rװ |CBPQ<9TIf - ki N0L0)U "0 0 10UPrivateLabel1-2970U 0 0 U 0 *H 1KG]qSl]y=&b""I'{9$ *8PUl LGl X1B li+@]jy.%݊ Z<D&iHΥbb090%A0 *H 01 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.300 020824185339Z 030824185339Z0T10 UEggert1 0 U*Lars10U Lars Eggert1 0 *H larse@isi.edu0"0 *H 0 6Fxΰ7a ED&0+Dj)ֽXCUcnleijmz~S0J jWV~ 1^({IݛLjӖ ao:bP}WLVܱ욗cD ɖ_Kv.A(W4 9;Z8-uXE 6b @_0%#d` Rto5 L0R`w@7 r Hcc U 3%7 N_o V0T0*+e!0 00L2uMyffBNUbNJJcdZ2s0U 0 larse@isi.edu0 U 0 0 *H ]Ȕ,fK< cj RZeLa n@Z6,= fK?yO#8+ Ni*LSfpQg <(aӒ$kTx_AL1>ގ|S090%A0 *H 01 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.300 020824185339Z 030824185339Z0T10 UEggert1 0 U*Lars10U Lars Eggert1 0 *H larse@isi.edu0"0 *H 0 6Fxΰ7a ED&0+Dj)ֽXCUcnleijmz~S0J jWV~ 1^({IݛLjӖ ao:bP}WLVܱ욗cD ɖ_Kv.A(W4 9;Z8-uXE 6b @_0%#d` Rto5 L0R`w@7 r Hcc U 3%7 N_o V0T0*+e!0 00L2uMyffBNUbNJJcdZ2s0U 0 larse@isi.edu0 U 0 0 *H ]Ȕ,fK< cj RZeLa n@Z6,= fK?yO#8+ Ni*LSfpQg <(aӒ$kTx_AL1>ގ|S1'0#001 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.30%A0 + a0 *H 1 *H 0 *H 1 020928171142Z0# *H 1 cSX1hZu,0R *H 1E0C0 *H 0*H 0 *H @0+0 *H (0 *H 101 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.30%A0 *H ryZ#/bj!~վ;0xO ol*KR&QxIQ|"Ē @T$H(I}ƾ't I@zpd*ݷ:쑤-Ԣio-!ܦfCgyr,]M% n!}Ov@$ T?:`E&\N30̛O˷pR' aH ǪY+U Up(,YX
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3D95E2CE.6000502>