Set the configuration of interfaces for IPSec-tunnels

[unax]

Hello, comrades! I have a tiny question.
Suppose, create a tunnel between two addresses 100.111.222.1 and 100.111.222.2 uses (net-firewall/ipsec-tools-0.7.3-r1 USE="iconv ipv6 nat pam readline -hybrid -idea -kerberos -ldap -rc5 (-selinux)")
In first server have the configuration like this: (in /etc/racoon/racoon.conf)

[salahx]

Unlike FreeBSD, Linux does not use separate interface for ipsec, rather the ipsec policies define what gets tunneled and how.

[unax]

[salahx]

Well, I'm not exactly sure how you've got your network configured, but given that you are using tunnel model it sounds like you a probably trying to connect 2 networks at different sites.

So using the IP you gave: 100.111.222.1 and 100.111.222.2, lets presume 100.111.222.1 has a 192.168.1.0/24 behind it, and 100.111.222.2 has a 192.168.2.0/24 behind it.

So, for the router on 100.111.222.1, the ipsec.conf would be as follows

[unax]

[salahx]

Ok, if server1 has an extrnal IP of 10.0.11.26 and an internal IP of 192.168.1.1 (with a 192.168.1.0/24 behind it) and server2 ha an external IP of 10.0.11.20 and an internal IP for 192.168.2.1 (with a 192.168.2.0/24 behind it), then it should go something like this:

for server1 /etc/ipsec.conf:

[unax]

[salahx]

Maybe something is wrong with /etc/racoon/racoon.conf. There a lot of extraneous stuff in there.

I suspect this ought to work (unfortunately while experimenting with this I killed the other machine and have no physical access to it right now)

For 10.0.11.26:

[salahx]

Ok, after some test, this ought to do it I've tested between 2 machines and packets flow though the tunnel.

For 10.0.11.26 raccon.conf:

[unax]

hm... how options of kernel "Network device support -> Universal TUN/TAP device driver support" affects on the racoon works?This option required for IPsec tunnels?
now i use the OpenVPN, i like it but setup the racoon too

[salahx]

You don't need tap/tun support for IPsec (you do for openvpn, however).

The config files above should establish the tunnel. Remember though, make sure when testing the applications are being to the right interface - in particular, most program bind to the interface which the default gateway
So use something like this:

[unax]

I decided to continue experimenting, getting closer to solving the... salahx my great thanks.
But all very strange stell.
in general, the main task in setting up tunnels gentoo<===>freebsd.
At now exist server with freebsd, and he has several working tunnels.. on server i create a new tunnel, like other in this server
Main FreeBSD server name "Server F" and his ip = xx.xx.xx.xx, localnet = 10.10.1.0/24
One of my Gentoo server has ip = yy.yy.yy.yy, localnet = 10.10.5.1/24 name = "Server G"
Server G: net-firewall/ipsec-tools-0.7.3-r1 USE="iconv ipv6 nat pam rc5 readline -hybrid -idea -kerberos -ldap (-selinux)"
in /etc/racoon/racoon.conf

[salahx]

"Address in use" means something already listing on that port. If you're trying to run both Openswan and racoon on the same machine, don't, as they both do the same thing and will conflict with one another.

[unax]

Ok.. now start without ipsec (to avoid any conflict)
log in Server G:

[salahx]

racoon won't bring up the tunnel until something actually needs it. So do:

[unax]

Yes it work! I just forget something roles for firewall, but tcpdump fix my problems with iptables)
p.s.
Maybe someone will be helpful.. Something about a firewall for client-server (remote office)
this example of iptables roles apply only for work local network of offices

[unax]

i have tiny question..
If I specify interface, the traffic goes into the tunnel.

[unax]

so.. One route decided my problem
#ip route add -net <remote lan> via <global ip of router> src <local ip of router>
everything is fine