Table of Contents

• IPsec, Security for the Internet Protocol
• Interoperating with other IPsec implementations
• Advantages of IPsec
• Applications of IPsec
• The need to authenticate gateways
• The FreeS/WAN project
• Project goals
• Project team
• Products containing FreeS/WAN
• Full Linux distributions
• Linux kernel distributions
• Office server distributions
• Firewall distributions
• Firewall and VPN products
• Information sources
• This HowTo, in multiple formats
• RTFM (please Read The Fine Manuals)
• Other documents in the distribution
• Background material
• Archives of the project mailing list
• User-written HowTo information
• Papers on FreeS/WAN
• License and copyright information
• Distribution sites
• Primary site
• Mirrors
• The "munitions" archive of Linux crypto software
• Links to other sections

• New! Built in Opportunistic connections
• Upgrading Opportunistic Encryption to 2.01 (or later)
• New! Policy Groups
• New! Packetdefault Connection
• FreeS/WAN now disables Reverse Path Filtering
• Revised ipsec.conf
• No promise of compatibility
• Most ipsec.conf files will work fine
• Backward compatibility patch
• Details
• Upgrading from 1.x RPMs to 2.x RPMs

• Purpose
• OE "flag day"
• Requirements
• RPM install
• Download RPMs
• Check signatures
• Install the RPMs
• Test
• Our Opportunistic Setups
• Full or partial opportunism?
• Initiate-only setup
• Restrictions
• Create and publish a forward DNS record
• Test that your key has been published
• Configure, if necessary
• Test
• Full Opportunism
• Put a TXT record in a Forward Domain
• Put a TXT record in Reverse DNS
• Test your DNS record
• No Configuration Needed
• Consider Firewalling
• Test
• Test
• Testing opportunistic connections
• Now what?
• Notes
• Troubleshooting OE
• Known Issues

• What are Policy Groups?
• Built-In Security Options
• Using Policy Groups
• Example 1: Using a Base Policy Group
• Example 2: Defining IPsec Security Policy with Groups
• Example 3: Creating a Simple IPsec VPN with the private Group
• Example 4: New Policy Groups to Protect a Subnet
• Example 5: Adding a Subnet to the VPN
• Appendix
• Our Hidden Connections
• Custom Policy Groups
• Disabling Opportunistic Encryption

• Index of FAQ questions
• What is FreeS/WAN?
• How do I report a problem or seek help?
• Can I get ...
• Can I get an off-the-shelf system that includes FreeS/WAN?
• Can I hire consultants or staff who know FreeS/WAN?
• Can I get commercial support?
• Release questions
• What is the current release?
• When is the next release?
• Are there known bugs in the current release?
• Modifications and contributions
• Can I modify FreeS/WAN to ...?
• Can I contribute to the project?
• Is there detailed design documentation?
• Will FreeS/WAN work in my environment?
• Can FreeS/WAN talk to ...?
• Can different FreeS/WAN versions talk to each other?
• Is there a limit on throughput?
• Is there a limit on number of tunnels?
• Is a ... fast enough to handle FreeS/WAN with my loads?
• Will FreeS/WAN work on ... ?
• Will FreeS/WAN run on my version of Linux?
• Will FreeS/WAN run on non-Intel CPUs?
• Will FreeS/WAN run on multiprocessors?
• Will FreeS/WAN work on an older kernel?
• Will FreeS/WAN run on the latest kernel version?
• Will FreeS/WAN work on unusual network hardware?
• Will FreeS/WAN work on a VLAN (802.1q) network?
• Does FreeS/WAN support ...
• Does FreeS/WAN support site-to-site VPN ( Virtual Private Network) applications?
• Does FreeS/WAN support remote users connecting to a LAN?
• Does FreeS/WAN support remote users using shared secret authentication?
• Does FreeS/WAN support wireless networks?
• Does FreeS/WAN support X.509 or other PKI certificates?
• Does FreeS/WAN support user authentication (Radius, SecureID, Smart Card...)?
• Does FreeS/WAN support NAT traversal?
• Does FreeS/WAN support assigning a "virtual identity" to a remote system?
• Does FreeS/WAN support single DES encryption?
• Does FreeS/WAN support AES encryption?
• Does FreeS/WAN support other encryption algorithms?
• Can I ...
• Can I use policy groups along with explicitly configured connections?
• Can I turn off policy groups?
• Can I reload connection info without restarting?
• Can I use several masqueraded subnets?
• Can I use subnets masqueraded to the same addresses?
• Can I assign a road warrior an address on my net (a virtual identity)?
• Can I support many road warriors with one gateway?
• Can I have many road warriors using shared secret authentication?
• Can I use Quality of Service routing with FreeS/WAN?
• Can I recognise dead tunnels and shut them down?
• Can I build IPsec tunnels over a demand-dialed link?
• Can I build GRE, L2TP or PPTP tunnels over IPsec?
• ... use Network Neighborhood (Samba, NetBIOS) over IPsec?
• Life's little mysteries
• I cannot ping ....
• It takes forever to ...
• I send packets to the tunnel with route(8) but they vanish
• When a tunnel goes down, packets vanish
• The firewall ate my packets!
• Dropped connections
• Disappearing %defaultroute
• TCPdump on the gateway shows strange things
• Traceroute does not show anything between the gateways
• Testing in stages
• Manually keyed connections don't work
• One manual connection works, but second one fails
• Manual connections work, but automatic keying doesn't
• IPsec works, but connections using compression fail
• Small packets work, but large transfers fail
• Subnet-to-subnet works, but tests from the gateways don't
• Compilation problems
• gmp.h: No such file or directory
• ... virtual memory exhausted
• Interpreting error messages
• route-client (or host) exited with status 7
• SIOCADDRT:Network is unreachable
• ipsec_setup: modprobe: Can't locate module ipsec
• ipsec_setup: Fatal error, kernel appears to lack KLIPS
• ipsec_setup: ... failure to fetch key for ... from DNS
• ipsec_setup: ... interfaces ... and ... share address ...
• ipsec_setup: Cannot adjust kernel flags
• Message numbers (MI3, QR1, et cetera) in Pluto messages
• Connection names in Pluto error messages
• Pluto: ... can't orient connection
• ... we have no ipsecN interface for either end of this connection
• Pluto: ... no connection is known
• Pluto: ... no suitable connection ...
• Pluto: ... no connection has been authorized
• Pluto: ... OAKLEY_DES_CBC is not supported.
• Pluto: ... no acceptable transform
• rsasigkey dumps core
• !Pluto failure!: ... exited with ... signal 4
• ECONNREFUSED error message
• klips_debug: ... no eroute!
• ... trouble writing to /dev/ipsec ... SA already in use
• ... ignoring ... payload
• unknown parameter name "rightcert"
• Why don't you restrict the mailing lists to reduce spam?

• Files
• Commands
• Library routines

• Filtering rules for IPsec packets
• Firewall configuration at boot
• A simple set of rules
• Other rules
• Published rule sets
• Calling firewall scripts, named in ipsec.conf(5)
• Scripts called at IPsec start and stop
• Scripts called at connection up and down