Table of Contents

• IPsec, Security for the Internet Protocol
• Interoperating with other IPsec implementations
• Applications of IPsec
• The need to authenticate gateways
• The FreeS/WAN project
• Project goals
• Project team
• Products containing FreeS/WAN
• Full Linux distributions
• Office server distributions
• Firewall distributions
• Firewall and VPN products
• RPM sets
• Information sources
• This HowTo, in multiple formats
• RTFM (please Read The Fine Manuals)
• Other documents in the distribution
• Background material
• Archives of the project mailing list
• User-written HowTo information
• Papers on FreeS/WAN
• License and copyright information
• Distribution sites
• Primary site
• Mirrors
• The "munitions" archive of Linux crypto software
• Links to other sections

• New! Built in Opportunistic connections
• New! Policy Groups
• New! Packetdefault Connection
• FreeS/WAN now disables Reverse Path Filtering
• Revised ipsec.conf
• No promise of compatibility
• Most ipsec.conf files will work fine
• Backward compatibility patch
• Details
• Upgrading from 1.x RPMs to 2.x RPMs

• Purpose
• Requirements
• RPM install
• Download RPMs
• Check signatures
• Install the RPMs
• Test
• Our Opportunistic Setups
• Full or partial opportunism?
• Initiate-only setup
• Restrictions
• Create and publish a forward DNS record
• Test that your key has been published
• Configure
• Test
• Full Opportunism
• Put (KEY and TXT) records in Reverse DNS
• Test your DNS records
• No Configuration Needed
• Consider Firewalling
• Test
• An Opportunistic Gateway
• Start from full opportunism
• Reverse DNS (TXT) records for each protected machine
• Publish your records
• ...and test them
• No Configuration Needed
• Test
• Testing opportunistic connections
• Additional OE tests
• Now what?
• Notes
• Troubleshooting OE

• What are Policy Groups?
• Built-In Security Options
• Using Policy Groups
• Example 1: Using a Base Policy Group
• Example 2: Defining IPsec Security Policy with Groups
• Example 3: Creating a Simple IPsec VPN with the private Group
• Example 4: New Policy Groups to Protect a Subnet
• Example 5: Adding a Subnet to the VPN
• Appendix
• Our Hidden Connections
• Custom Policy Groups
• Disabling Opportunistic Encryption

• Index of FAQ questions
• What is FreeS/WAN?
• How do I report a problem or seek help?
• Can I get ...
• Can I get an off-the-shelf system that includes FreeS/WAN?
• Can I hire consultants or staff who know FreeS/WAN?
• Can I get commercial support?
• Release questions
• What is the current release?
• When is the next release?
• Are there known bugs in the current release?
• Modifications and contributions
• Can I modify FreeS/WAN to ...?
• Can I contribute to the project?
• Is there detailed design documentation?
• Will FreeS/WAN work in my environment?
• Can FreeS/WAN talk to ...?
• Can different FreeS/WAN versions talk to each other?
• Is there a limit on throughput?
• Is there a limit on number of tunnels?
• Is a ... fast enough to handle FreeS/WAN with my loads?
• Will FreeS/WAN work on ... ?
• Will FreeS/WAN run on my version of Linux?
• Will FreeS/WAN run on non-Intel CPUs?
• Will FreeS/WAN run on multiprocessors?
• Will FreeS/WAN work on an older kernel?
• Will FreeS/WAN run on the latest kernel version?
• Will FreeS/WAN work on unusual network hardware?
• Will FreeS/WAN work on a VLAN (802.1q) network?
• Does FreeS/WAN support ...
• Does FreeS/WAN support site-to-site VPN ( Virtual Private Network) applications?
• Does FreeS/WAN support remote users connecting to a LAN?
• Does FreeS/WAN support remote users using shared secret authentication?
• Does FreeS/WAN support wireless networks?
• Does FreeS/WAN support X.509 or other PKI certificates?
• Does FreeS/WAN support user authentication (Radius, SecureID, Smart Card...)?
• Does FreeS/WAN support NAT traversal?
• Does FreeS/WAN support assigning a "virtual identity" to a remote system?
• Does FreeS/WAN support single DES encryption?
• Does FreeS/WAN support AES encryption?
• Does FreeS/WAN support other encryption algorithms?
• Can I ...
• Can I use policy groups along with explicitly configured connections?
• Can I turn off policy groups?
• Can I reload connection info without restarting?
• Can I use several masqueraded subnets?
• Can I use subnets masqueraded to the same addresses?
• Can I assign a road warrior an address on my net (a virtual identity)?
• Can I support many road warriors with one gateway?
• Can I have many road warriors using shared secret authentication?
• Can I use Quality of Service routing with FreeS/WAN?
• Can I recognise dead tunnels and shut them down?
• Can I build IPsec tunnels over a demand-dialed link?
• Can I build GRE tunnels over IPsec?
• ... use Network Neighborhood (Samba, NetBIOS) over IPsec?
• Life's little mysteries
• I cannot ping ....
• It takes forever to ...
• I send packets to the tunnel with route(8) but they vanish
• When a tunnel goes down, packets vanish
• The firewall ate my packets!
• Dropped connections
• TCPdump on the gateway shows strange things
• Traceroute does not show anything between the gateways
• Testing in stages
• Manually keyed connections don't work
• One manual connection works, but second one fails
• Manual connections work, but automatic keying doesn't
• IPsec works, but connections using compression fail
• Small packets work, but large transfers fail
• Subnet-to-subnet works, but tests from the gateways don't
• Compilation problems
• gmp.h: No such file or directory
• ... virtual memory exhausted
• Interpreting error messages
• route-client (or host) exited with status 7
• SIOCADDRT:Network is unreachable
• ipsec_setup: modprobe: Can't locate module ipsec
• ipsec_setup: Fatal error, kernel appears to lack KLIPS
• ipsec_setup: ... failure to fetch key for ... from DNS
• ipsec_setup: ... interfaces ... and ... share address ...
• ipsec_setup: Cannot adjust kernel flags
• Message numbers (MI3, QR1, et cetera) in Pluto messages
• Connection names in Pluto error messages
• Pluto: ... can't orient connection
• ... we have no ipsecN interface for either end of this connection
• Pluto: ... no connection is known
• Pluto: ... no suitable connection ...
• Pluto: ... no connection has been authorized
• Pluto: ... OAKLEY_DES_CBC is not supported.
• Pluto: ... no acceptable transform
• rsasigkey dumps core
• !Pluto failure!: ... exited with ... signal 4
• ECONNREFUSED error message
• klips_debug: ... no eroute!
• ... trouble writing to /dev/ipsec ... SA already in use
• ... ignoring ... payload
• unknown parameter name "rightcert"
• Why don't you restrict the mailing lists to reduce spam?

• Files
• Commands
• Library routines

• Filtering rules for IPsec packets
• Firewall configuration at boot
• A simple set of rules
• Other rules
• Published rule sets
• Calling firewall scripts, named in ipsec.conf(5)
• Scripts called at IPsec start and stop
• Scripts called at connection up and down
• Scripts for ipchains or iptables
• A complication: IPsec vs. NAT
• NAT on or behind the IPsec gateway works
• NAT between gateways is problematic
• Other references on NAT and IPsec
• Other complications
• IPsec through the gateway
• Preventing non-IPsec traffic
• Filtering packets from unknown gateways
• Other packet filters
• ICMP filtering
• UDP packets for traceroute
• UDP for L2TP
• How it all works: IPsec packet details
• ESP and AH do not have ports
• Header layout
• DHR on the updown script

• Overview
• 1. During Install
• 1.1 RPM install gotchas
• 1.2 Problems installing from source
• 1.3 Install checks
• 2. During Negotiation
• 2.1 Determine Connection State
• 2.2 Finding error text
• 2.3 Interpreting a Negotiation Error
• 3. Using a Connection
• 3.1 Orienting yourself
• 3.2 Those pesky configuration errors
• 3.3 Check Routing and Firewalling
• 3.4 When in doubt, sniff it out
• 3.5 Check your logs
• 3.6 More testing for the truly thorough
• 4. Problem Reporting
• 4.1 How to ask for help
• 4.2 Where to ask
• 5. Additional Notes on Troubleshooting
• 5.1 Information available on your system
• 5.2 Testing between security gateways
• 5.3 ifconfig reports for KLIPS debugging
• 5.4 Using GDB on Pluto

• Implemented parts of the IPsec Specification
• In Linux FreeS/WAN
• Deliberately omitted
• Not (yet) in Linux FreeS/WAN
• Our PF-Key implementation
• PF-Key portability
• Kernels other than the latest 2.2.x and 2.4.y
• 2.0.x kernels
• 2.2 and 2.4 kernels
• Intel Linux distributions other than Redhat
• Redhat 7.0
• SuSE Linux
• Slackware
• Debian
• Caldera
• CPUs other than Intel
• Corel Netwinder (StrongARM CPU)
• Yellow Dog Linux on Power PC
• Mklinux
• Alpha 64-bit processors
• Sun SPARC processors
• MIPS processors
• Transmeta Crusoe
• Motorola Coldfire
• Multiprocessor machines
• Support for crypto hardware
• IP version 6 (IPng)
• IPv6 background

• Interop at a Glance
• Key
• Basic Interop Rules
• Longer Stories
• For More Compatible Implementations
• For Other Implementations

• Published material
• Estimating CPU overheads
• Higher performance alternatives
• Other considerations
• Many tunnels from a single gateway
• Low-end systems
• Measuring KLIPS
• Speed with compression
• Methods of measuring

• Testing with User Mode Linux
• Configuration for a testbed network
• Testbed network
• Using packet sniffers in testing
• Verifying encryption
• Mailing list pointers

• Not everyone needs to worry about kernel configuration
• Assumptions and notation
• Labels used
• Kernel options for FreeS/WAN

• Some rules of thumb about configuration
• Tunnels are cheap
• Subnet sizes
• Other network layouts
• Choosing connection types
• Manual vs. automatic keying
• Authentication methods for auto-keying
• Advantages of public key methods
• Using shared secrets in production
• Putting secrets in ipsec.secrets(5)
• File security
• Shared secrets for road warriors
• Using manual keying in production
• Creating keys with ranbits
• Setting up connections at boot time
• Multiple tunnels between the same two gateways
• One tunnel plus advanced routing
• Extruded Subnets
• Road Warrior with virtual IP address
• Dynamic Network Interfaces
• Basics
• Boot Time
• Change Time
• Unencrypted tunnels

• Requirements
• Choose your install method
• FreeS/WAN ships with some Linuxes
• FreeS/WAN may be altered...
• You might need to create an authentication keypair
• Start and test FreeS/WAN
• RPM install
• Download RPMs
• For freeswan.org RPMs: check signatures
• Install the RPMs
• Start and Test FreeS/WAN
• Install from Source
• Decide what functionality you need
• Download FreeS/WAN
• For freeswan.org source: check its signature
• Untar, unzip
• Patch if desired
• ... and Make
• Start FreeS/WAN and test your install
• Test your install
• Making FreeS/WAN play well with others
• Configure for your needs

• Requirements
• Net-to-Net connection
• Gather information
• Edit /etc/ipsec.conf
• Start your connection
• Do not MASQ or NAT packets to be tunneled
• Test your connection
• Finishing touches
• Road Warrior Configuration
• Gather information
• Customize /etc/ipsec.conf
• Start your connection
• Do not MASQ or NAT packets to be tunneled
• Test your connection
• Finishing touches
• Multiple Road Warriors
• What next?

• Some DNS background
• Forward and reverse maps
• Hierarchy and delegation
• Syntax of DNS records
• Cacheing, TTL and propagation delay
• Problems with packet fragmentation
• Network address translation (NAT)
• NAT to non-routable addresses
• NAT to routable addresses

• Poltorak's Firewall script

• What is "make check"
• Running "make check"

• Structure of a test
• The TESTLIST
• Test kinds
• Common parameters
• KLIPStest paramaters
• mkinsttest paramaters
• rpm_build_install_test paramaters
• libtest paramaters
• umlplutotest paramaters
• umlXhost parameters
• kernel_patch_test paramaters
• module_compile paramaters

• Preliminary Notes on BIND
• Steps to Install UML for FreeS/WAN

• Other notes about debugging

• Introduction
• History
• Politics
• Links
• Outline of this section
• From our project leader
• Swan: Securing the Internet against Wiretapping
• Stopping wholesale monitoring
• Government promotion of weak crypto
• Escrowed encryption
• Limited key lengths
• Cryptography Export Laws
• US Law
• What's wrong with restrictions on cryptography
• The Wassenaar Arrangement
• Export status of Linux FreeS/WAN
• Help spread IPsec around
• DES is Not Secure
• Dedicated hardware breaks DES in a few days
• Spooks may break DES faster yet
• Networks break DES in a few weeks
• We disable DES
• 40-bits is laughably weak
• Triple DES is almost certainly secure
• AES in IPsec
• Press coverage of Linux FreeS/WAN:
• FreeS/WAN 1.0 press
• Press release for version 1.0

• Protocols and phases
• Applying IPsec
• Advantages of IPsec
• Limitations of IPsec
• IPsec is a general mechanism for securing IP
• Using authentication without encryption
• Encryption without authentication is dangerous
• Multiple layers of IPsec processing are possible
• Resisting traffic analysis
• Cryptographic components
• Block ciphers
• Hash functions
• Diffie-Hellman key agreement
• RSA authentication
• Structure of IPsec
• IKE (Internet Key Exchange)
• IPsec Services, AH and ESP
• The Authentication Header (AH)
• Encapsulated Security Payload (ESP)
• IPsec modes
• Tunnel mode
• Transport mode
• FreeS/WAN parts
• KLIPS: Kernel IPsec Support
• The Pluto daemon
• The ipsec(8) command
• Linux FreeS/WAN configuration file
• Key management
• Currently Implemented Methods
• Methods not yet implemented

• Mailing lists about FreeS/WAN
• The project mailing lists
• Archives of the lists
• Indexes of mailing lists
• Lists for related software and topics
• Products that include FreeS/WAN
• Linux mailing lists
• Lists for IETF working groups
• Other mailing lists
• Usenet newsgroups

• The Linux FreeS/WAN Project
• Add-ons and patches for FreeS/WAN
• Distributions including FreeS/WAN
• Things FreeS/WAN uses or could use
• Other approaches to VPNs for Linux
• The IPsec Protocols
• General IPsec or VPN information
• IPsec overview documents or slide sets
• IPsec information in languages other than English
• RFCs and other reference documents
• Analysis and critiques of IPsec protocols
• Background information on IP
• IPsec Implementations
• Linux products
• IPsec in router products
• IPsec in firewall products
• Operating systems with IPsec support
• IPsec on network cards
• Open source IPsec implementations
• Interoperability
• Linux links
• Basic and tutorial Linux information
• General Linux sites
• Documentation
• Advanced routing
• Security for Linux
• Linux firewalls
• Miscellaneous Linux information
• Crypto and security links
• Crypto and security resources
• Cryptography law and policy
• Cryptography technical information
• Computer and network security
• Links to home pages

• Jump to a letter in the glossary
• Other glossaries
• Definitions

• The RFCs.tar.gz Distribution File
• Other sources for RFCs & Internet drafts
• RFCs
• Internet Drafts
• FIPS standards
• What's in the RFCs.tar.gz bundle?
• Overview RFCs
• Basic protocols
• Key management
• Details of various things used
• Older RFCs which may be referenced
• RFCs for secure DNS service, which IPsec may use
• RFCs labelled "experimental"
• Related RFCs

• Top directory
• Documentation
• KLIPS: kernel IP security
• Pluto key and connection management daemon
• Utils
• Libraries
• FreeS/WAN Library
• Imported Libraries

• Preliminary Notes on BIND
• Steps to Install UML for FreeS/WAN

• Other notes about debugging

• What is "make check"
• Running "make check"

• Structure of a test
• The TESTLIST
• Test kinds
• Common parameters
• KLIPStest paramaters
• mkinsttest paramaters
• rpm_build_install_test paramaters
• libtest paramaters
• umlplutotest paramaters
• umlXhost parameters
• kernel_patch_test paramaters
• module_compile paramaters

• Files you need to know about
• Configuring freeswan-regress-env.sh