Table of Contents

• IPSEC, Security for the Internet Protocol
• Interoperating with other IPSEC implementations
• Applications of IPSEC
• The need to authenticate gateways
• The FreeS/WAN project
• Project goals
• Project team
• Information on the web
• Distribution sites
• Archives of the project mailing list
• Products containing FreeS/WAN
• Full Linux distributions
• Firewall distributions
• Firewall and VPN products
• Documentation
• This HowTo, in multiple formats
• Other documents in the distribution
• User-written HowTo information
• Papers on FreeS/WAN
• Test results
• License and copyright information
• Links to other sections

• Who needs to perform an installation?
• Re-installs
• Before starting the install
• Choosing a kernel
• Things you must have installed
• Getting FreeS/WAN
• Kernel configuration
• Install and test a kernel before adding FreeS/WAN
• Building and installing the software
• Everything but kernel installation
• Installing the new kernel
• Make sure Lilo knows about the new kernel
• Testing to see if install succeeded
• Where to go from here

• Our example networks
• Configuration for a testbed network
• Set up and test networking
• Enabling packet forwarding
• Other software
• RTFM (please Read The Fine Manuals)
• Setting up RSA authentication keys
• Generating an RSA key pair
• Exchanging authentication keys
• Using RSA signatures for authentication
• The configuration file
• The setup section of ipsec.conf(5)
• Connection defaults
• Editing a connection description
• Which is which?
• Example setups
• VPN
• Road Warrior
• Opportunistic encryption
• Simplifying ipsec.conf files
• Is there a firewall in play?
• Testing the installation
• Matching numbers
• Sanity checking
• Starting a connection
• Ping tests
• Testing with tcpdump
• What next?
• Other configuration possibilities
• Choosing connection types
• Using shared secrets in production
• Using manual keying in production
• Setting up connections at boot time
• Multiple tunnels between the same two gateways
• Many tunnels from a single gateway
• Extruded Subnets
• Road Warrior with virtual IP address
• Dynamic Network Interfaces
• Unencrypted tunnels

• Files
• Commands
• Library routines

• IPSEC packets
• ESP and AH do not have ports
• Header layout
• Filtering rules for IPSEC packets
• IPSEC through the gateway
• Preventing non-IPSEC traffic
• Filtering packets from unknown gateways
• Other packet filters
• ICMP filtering
• UDP packets for traceroute
• UDP for L2TP
• IPSEC and NAT
• NAT on or behind the IPSEC gateway works
• NAT between gateways is problematic
• Other references on NAT and IPSEC
• Calling firewall scripts, named in ipsec.conf(5)
• Scripts called at IPSEC start and stop
• Scripts called at connection up and down
• Scripts for ipchains
• DHR on the updown script
• Example updown script for ipchains
• Ipchains firewall configuration at boot
• Scripts based on Ranch's work
• The Seattle firewall
• The RCF scripts

• Problem Reporting
• Logs used
• Information available on your system
• man pages provided
• Status information
• Pluto problem hints
• Using GDB on Pluto
• ifconfig reports for KLIPS debugging
• Testing between security gateways
• Claudia's guide

• Not everyone needs to worry about kernel configuration
• Assumptions and notation
• Labels used
• Kernel options for FreeS/WAN

• Top directory
• Documentation
• KLIPS: kernel IP security
• Pluto key and connection management daemon
• Utils
• Libraries
• FreeS/WAN Library
• Imported Libraries

• Implemented parts of the IPSEC Specification
• In Linux FreeS/WAN
• Deliberately ommitted
• Not (yet) in Linux FreeS/WAN
• Our PF-Key implementation
• PF-Key portability
• Kernels other than 2.0.38 and 2.2.18
• Other 2.0.x Intel Kernels
• 2.2 and 2.4 Kernels
• Intel Linux distributions other than Redhat
• Redhat 7.0
• SuSE Linux
• Slackware
• Debian
• Caldera
• CPUs other than Intel
• Corel Netwinder (StrongARM CPU)
• Yellow Dog Linux on Power PC
• Mklinux
• Alpha 64-bit processors
• Sun SPARC processors
• MIPS processors
• Motorola Coldfire
• Multiprocessor machines
• Support for crypto hardware
• IP version 6 (IPng)
• IPv6 background

• Patches to extend interoperability
• Interoperability problems
• Systems that want to use single DES
• Interop HowTo documents
• Interoperation with specific products
• Older versions of FreeS/WAN
• OpenBSD
• FreeBSD
• NetBSD
• Cisco Routers
• Nortel (Bay Networks) Contivity switch
• Raptor Firewall
• Gauntlet firewall GVPN
• Checkpoint Firewall-1
• Redcreek Ravlin
• SSH Sentinel
• F-Secure VPN for Windows
• Watchguard
• Xedia Access Point/QVPN
• PGP Mac and Windows IPSEC Client
• IRE Safenet/SoftPK
• Borderware
• Freegate
• Timestep
• Shiva/Intel LANrover
• Sun Solaris
• Sonicwall
• Radguard
• Windows clients
• NT domains vs. tunnels
• Windows 2000

• Introduction
• History
• Politics
• Links
• Outline of this section
• From our project leader
• Swan: Securing the Internet against Wiretapping
• Stopping wholesale monitoring
• Government promotion of weak crypto
• Escrowed encryption
• Limited key lengths
• Cryptography Export Laws
• US Law
• What's wrong with restrictions on cryptography
• The Wassenaar Arrangement
• Export status of Linux FreeS/WAN
• Help spread IPSEC around
• DES is Not Secure
• Dedicated hardware breaks DES in a few days
• Spooks may break DES faster yet
• Networks break DES in a few weeks
• We disable DES
• 40-bits is laughably weak
• Triple DES is almost certainly secure
• AES in IPSEC
• Press coverage of Linux FreeS/WAN:
• FreeS/WAN 1.0 press
• Press release for version 1.0

• Applying IPSEC
• Advantages of IPSEC
• Limitations of IPSEC
• IPSEC is a general mechanism for securing IP
• Using authentication without encryption
• Encryption without authentication is dangerous
• Multiple layers of IPSEC processing are possible
• Resisting traffic analysis
• Cryptographic components
• Block ciphers
• Hash functions
• Diffie-Hellman key agreement
• RSA authentication
• Structure of IPSEC
• IKE (Internet Key Exchange)
• IPSEC Services, AH and ESP
• The Authentication Header (AH)
• Encapsulated Security Payload (ESP)
• IPSEC modes
• Tunnel mode
• Transport mode
• FreeS/WAN parts
• KLIPS: Kernel IPSEC Support
• The Pluto daemon
• The ipsec(8) command
• Linux FreeS/WAN configuration file
• Key management
• Currently Implemented Methods
• Methods not yet implemented

• Mailing lists about FreeS/WAN
• The project mailing lists
• Archives of the lists
• Indexes of mailing lists
• Lists for related software and topics
• Linux mailing lists
• Lists for IETF working groups
• Other mailing lists
• Usenet newsgroups

• The Linux FreeS/WAN Project
• Add-ons and patches for FreeS/WAN
• Distributions including FreeS/WAN
• Things FreeS/WAN uses or could use
• Other approaches to VPNs for Linux
• The IPSEC Protocols
• General IPSEC or VPN information
• IPSEC overview documents or slide sets
• IPSEC information in languages other than English
• RFCs and other reference documents
• Analysis and critiques of IPSEC protocols
• Background information on IP
• IPSEC Implementations
• Linux products
• IPSEC in router products
• IPSEC in firewall products
• Operating systems with IPSEC support
• Open source IPSEC implementations
• Interoperability
• Linux links
• Basic and tutorial Linux information
• General Linux sites
• Documentation
• Advanced routing
• Security for Linux
• Linux firewalls
• Miscellaneous Linux information
• Crypto and security links
• Crypto and security resources
• Cryptography law and policy
• Cryptography technical information
• Computer and network security
• Links to home pages

• Jump to a letter in the glossary
• Other glossaries
• Definitions

• The RFCs.tar.gz Distribution File
• Other sources for RFCs & Internet drafts
• RFCs
• Internet Drafts
• FIPS standards
• Document CDs
• What's in the RFCs.tar.gz bundle?
• Overview RFCs
• Basic protocols
• Key management
• Details of various things used
• Older RFCs which may be referenced
• RFCs for secure DNS service, which IPSEC may use
• RFCs labelled "experimental"
• Related RFCs

• Questions
• What is FreeS/WAN?
• How do I report a problem or seek help?
• Generic questions
• This is too complicated. Isn't there an easier way?
• Can I get commercial support for this product?
• Can I modify FreeS/WAN to ...?
• Can I contribute to the project?
• Is there detailed design documentation?
• Can FreeS/WAN talk to ...?
• Can different FreeS/WAN versions talk to each other?
• Does FreeS/WAN run on my version of Linux?
• Does FreeS/WAN run on the latest kernel version?
• Is a ... fast enough to handle FreeS/WAN with ... connections?
• Compilation problems
• gmp.h: No such file or directory
• ... virtual memory exhausted
• Life's little mysteries
• I cannot ping ....
• It takes forever to ...
• I send packets to the tunnel with route(8) but they vanish
• When a tunnel goes down, packets vanish
• The firewall ate my packets!
• Dropped connections
• TCPdump on the gateway shows strange things
• Traceroute does not show anything between the gateways
• Testing in stages
• Manually keyed connections don't work
• One manual connection works, but second one fails
• Manual connections work, but automatic keying doesn't
• IPSEC works, but connections using compression fail
• Small packets work, but large transfers fail
• Subnet-to-subnet works, but tests from the gateways don't
• Interpreting error messages
• SIOCADDRT:Network is unreachable
• ipsec_setup: Fatal error, kernel appears to lack KLIPS
• ipsec_setup: ... failure to fetch key for ... from DNS
• ipsec_setup: ... interfaces ... and ... share address ...
• ipsec_setup: Cannot adjust kernel flags
• Connection names in Pluto error messages
• Pluto: ... can't orient connection
• Pluto: ... no connection is known
• Pluto: ... no suitable connection ...
• Pluto: ... no connection has been authorized
• Pluto: ... OAKLEY_DES_CBC is not supported.
• Pluto: ... no acceptable transform
• ECONNREFUSED error message
• ... trouble writing to /dev/ipsec ... SA already in use
• ... ignoring ... payload
• Can I ...
• Can I reload connection info without restarting?
• Can I use several masqueraded subnets?
• Can I use subnets masqueraded to the same addresses?
• Can I assign a road warrior an address on my net?
• Can I use Quality of Service routing with FreeS/WAN?
• Can I recognise dead tunnels and shut them down?
• Can I build IPSEC tunnels over a demand-dialed link?
• Can I build GRE tunnels over IPSEC?
• Does FreeS/WAN support X.509 or other PKI certificates?
• Does FreeS/WAN support Radius or other user authentication?
• Does FreeS/WAN support single DES encryption?
• Why don't you restrict the mailing lists to reduce spam?

• Methods of mesasuring