From owner-freebsd-security@FreeBSD.ORG  Thu Jan 26 14:05:36 2006
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
X-Original-To: freebsd-security@freebsd.org
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 130AD16A420
	for <freebsd-security@freebsd.org>;
	Thu, 26 Jan 2006 14:05:36 +0000 (GMT)
	(envelope-from vaida.bogdan@gmail.com)
Received: from zproxy.gmail.com (zproxy.gmail.com [64.233.162.203])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 410ED43D48
	for <freebsd-security@freebsd.org>;
	Thu, 26 Jan 2006 14:05:35 +0000 (GMT)
	(envelope-from vaida.bogdan@gmail.com)
Received: by zproxy.gmail.com with SMTP id 8so369653nzo
	for <freebsd-security@freebsd.org>;
	Thu, 26 Jan 2006 06:05:34 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=ItXLVWSQ7QxC38dX6qkpGuQceHBGX8p7UFgL28kSn0R4pObiNphsxJWKWf0SCLMnc2xdfhxyc42xGtMvzZZLrWr4Kew/Lzj4ujAAuuW0FiUrfy7BA53K0QDe5ScE+TBwG0ngFslSihHAKD2DXZygChnVqRgUvP5wn1kmVr/ZVA0=
Received: by 10.37.20.41 with SMTP id x41mr1536220nzi;
	Thu, 26 Jan 2006 06:05:34 -0800 (PST)
Received: by 10.36.251.68 with HTTP; Thu, 26 Jan 2006 06:05:34 -0800 (PST)
Message-ID: <12848a3b0601260605k668329b7n41b15f7958b5e27e@mail.gmail.com>
Date: Thu, 26 Jan 2006 14:05:34 +0000
From: Vaida Bogdan <vaida.bogdan@gmail.com>
To: Fernando Gleiser <fgleiser@cactus.fi.uba.ar>
In-Reply-To: <20060125145213.A65853@cactus.fi.uba.ar>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
References: <12848a3b0601221142r2161c20ka6d128ecf5c299aa@mail.gmail.com>
	<43D3E694.9040902@aeternal.net>
	<12848a3b0601230055h12b7169uce7f1fbb2f0da8e6@mail.gmail.com>
	<20060125145213.A65853@cactus.fi.uba.ar>
Cc: freebsd-security@freebsd.org
Subject: Re: setting up vpn client on a freebsd workstation
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 26 Jan 2006 14:05:36 -0000

My certificates are self-signed and they were signed by the same CA as
the server's.

What I did on the client:

ifconfig gif0 create
ifconfig gif0 tunnel aaa.aaa.aaa.aaa ccc.ccc.ccc.ccc
ifconfig gif0 inet xxx.xxx.xxx.xxx 192.168.1.1
What do I need to replace xxx.xxx.xxx.xxx with and how do I test it
works until this step?

External Interface         External Interface (behind nat)
ccc.ccc.ccc.ccc             10.100.100.2
     |                                               |
--> VPN <--> Internet <--> FreeBSD Client (NATed extip: ddd.ddd.ddd.ddd)
      |
FW-1 Protected Net
192.168.1.0/24

On 1/25/06, Fernando Gleiser <fgleiser@cactus.fi.uba.ar> wrote:
> On Mon, 23 Jan 2006, Vaida Bogdan wrote:
>
> > I don't need openvpn, I need IPSEC (KAME). So none of the proposed
> > solutions work.
> >
> > I am the "FreeBSD Client" in the configuration so I can't change the
> > server vpn implementation.
> >
>
> Some basic questions: are your certificates self-signed? are your
> certificates and the linux ones signed by the same CA? you need to send
> your certificate and your CA's certificate to the linux admin so s?he
> can install them in the linux box.
>
> For the local config, look here:
>
> http://ezine.daemonnews.org/200502/ipsec.html
>
>
> Hope this helps
>
>
>                 Fer
>