Network routing question...

chrispy · Apprentice Joined: 10 Nov 2002 Posts: 228 Location: Tokyo

Ok,

So i'm not working in IT, but I decided to build a gentoo box to be used as VPN server in our company, coz right now we use dialup for remote access, and it's painfully slow. For this I would like to use FreeSWAN, since after searching the forums, it seems like the right choice.
On the server side, I think it's pretty straight forward, I've asked the net admin to forward all udp, tcp and esp traffic of one of our global ips to one machine inside.

My concern, (read : headache) is that at home, I have my gentoo box, with 2 nics to do the NAT and other usefull services (that I run on ETH1).

My DSL modem ppp0 is bridged to my ETH0 card, so actually ETH0 doesn't have any IP address.

I'd like to install FreeSWAN there too so that I can access our office network transparently from home.

So to have this working, in my head I see it like this :
( the part between [ ] is the gentoo server )

carlivar · Posted: Wed Nov 13, 2002 7:30 am Post subject:

Doesn't FreeSWAN require the remote IP of each VPN client? If your home IP is dynamic how will you config FreeSWAN?

You might want to think about that first. Could prevent you from doing what you want. VPN server software is pretty limited for Linux.

Carl
_________________
"It is difficult to make our material condition better by the best law, but it is easy enough to ruin it by bad laws." - Theodore Roosevelt

chrispy · Apprentice Joined: 10 Nov 2002 Posts: 228 Location: Tokyo

Well I dunno, I read (still reading hehe) their documentation and it seems that you can use "manual" keys (i.e. keys are generated and put on the clients manually), instead of automatic keying.
besides, it's for connecting once i'm home, not to be a permanent link, so I would fall into the category "road warrior" that they describe in their howtos ...

vertex · n00b Joined: 14 Nov 2002 Posts: 29

[quote="carlivar"]Doesn't FreeSWAN require the remote IP of each VPN client? If your home IP is dynamic how will you config FreeSWAN?

You might want to think about that first. Could prevent you from doing what you want. VPN server software is pretty limited for Linux.
/quote]

You can definitely use ipsec with dynamic ip's on the client side. You might be forced to use shared secrets instead of public key, but thats the tradeoff I suppose. There are probably better and more creative ways.

As far as using NAT with ipsec, I would have to decline as it's too close to bedtime and I might give you an idiot answer.

Good luck!