At 02:04 PM 7/9/2008, Mike Tancsa wrote:
Also, dont confuse using GIF and IPSEC. To create some IPSEC
tunnels, you dont need gif or gre interfaces. The policies will do
that for you.
Here is a simple example that just uses IPSEC tunnels with a static
key. You dont need any gif/gre stuff. Dont use this in production,
use IPSEC-TOOLS from the ports to do dynamic keying.
To test the tunnel, assuming the inside interface of the freebsd boxes are .1
ping -S 192.168.1.1 192.168.1.2
#/bin/sh
server1
MEOUTSIDE=1.1.1.1
MEINSIDE=192.168.1.0/24
REMOTEOUTSIDE=2.2.2.2
REMOTEINSIDE=192.168.5.0/24
IPSECKEY=ZA6PkrlNH6BN11SG1rCa8dxa
setkey -c <<EOF
add $MEOUTSIDE $REMOTEOUTSIDE esp 1049 -m any -E
3des-cbc "$IPSECKEY";
add $REMOTEOUTSIDE $MEOUTSIDE esp 1049 -m any -E
3des-cbc "$IPSECKEY";
spdadd $MEINSIDE $REMOTEINSIDE any -P out ipsec
esp/tunnel/$MEOUTSIDE-$REMOTEOUTSIDE/require;
spdadd $REMOTEINSIDE $MEINSIDE any -P in ipsec
esp/tunnel/$REMOTEOUTSIDE-$MEOUTSIDE/require;
EOF
#!/bin/sh
server2
MEOUTSIDE=2.2.2.2
MEINSIDE=192.168.5.0/24
REMOTEOUTSIDE=1.1.1.1
REMOTEINSIDE=192.168.1.0/24
IPSECKEY=ZA6PkrlNH6BN11SG1rCa8dxa
setkey -c <<EOF
add $MEOUTSIDE $REMOTEOUTSIDE esp 1049 -m any -E
3des-cbc "$IPSECKEY";
add $REMOTEOUTSIDE $MEOUTSIDE esp 1049 -m any -E
3des-cbc "$IPSECKEY";
spdadd $MEINSIDE $REMOTEINSIDE any -P out ipsec
esp/tunnel/$MEOUTSIDE-$REMOTEOUTSIDE/require;
spdadd $REMOTEINSIDE $MEINSIDE any -P in ipsec
esp/tunnel/$REMOTEOUTSIDE-$MEOUTSIDE/require;
EOF
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
