Openswan side configuration

Kernel requirements

If you built your own kernel you're going to either have to include the following as modules or build them in:

• • Transformation user configuration interface

  • PF_KEY sockets

  • IP: AH transformations

  • IP: ESP transformations

  • IP: IPComp transformations

  • IP: IPsec tunnel mode

Usually these are found under Networking->Network Options.

If you have not built your own kernel, chances are these are already built in.

Openswan config

There are two configuration files you need to worry about: /etc/ipsec.conf

version 2.0 config setup # Having this option off caused issues nat_traversal=yes oe=off protostack=netkey fragicmp=no conn sonicwall # This is where you define your connexion to the Sonicwall. # You do not have to call it "Sonicwall" you can all it what # you wish. left=209.14.212.52 leftsourceip=192.168.0.1 leftsubnet=192.168.0.0/24 leftid=209.14.212.52 right=24.252.13.9 rightid=24.252.13.9 keyingtries=0 pfs=no aggrmode=yes auth=esp esp=3des-sha1 ike=3des-sha1 authby=secret keyexchange=ike rightsubnet=10.0.0.0/24 # This allows the VPN to come up automatically when openswan starts auto=start

You'll notice the rightid and the leftid above. These are what helps identify the connexion when the Openswan and the Sonicwall try to talk. Usually Sonicwalls want this value set to a Sonicwall Identifier. Well, if you haven't noticed by now your Openswan/Linux box won't have an identifier for itself. So we use the IP instead. Sonicwalls will also accept that option.

/etc/ipsec.secrets

209.14.212.52 24.252.13.9 : PSK "secretpass"

In the ipsec.secrets file make sure the IPs are correct. This will be what gives the authentication password for the VPN. If your IPs change and you have to change them in the ipsec.conf file, make sure to remember to change them here to. Otherwise you'll have errors and it won't establish a connexion.

iptables config

If you're doing masquerading and you have other nat rules set up in iptables it will interfere with your VPN traffic. So, you will have to set rules to allow all traffic unaffected for your VPN subnet.

# IPSec ports for opening iptables -A INPUT -p ah -j ACCEPT iptables -A INPUT -p esp -j ACCEPT iptables -A INPUT -p udp -i eth0 --dport 500 -j ACCEPT iptables -A INPUT -p udp -i eth0 --dport 4500 -j ACCEPT iptables -A INPUT -p udp -i eth0 --dport 50:58 -j ACCEPT iptables -A INPUT -p tcp -i eth0 --dport 50:58 -j ACCEPT # Allow all traffic from our Sonicwall side of the VPN in iptables -A INPUT -j ACCEPT --source 10.0.0.0/255.255.255.0 # Put a rule in to cancel out any MASQ rules that might try to take effect iptables -t nat -A POSTROUTING -j ACCEPT --destination 10.0.0.0/255.255.255.0 # Cancel out any forward rules that might be trying to take effect iptables -t nat -A PREROUTING -j ACCEPT --source 10.0.0.0/255.255.255.0

The point of the above commands is that they are placed before any other firewall rules take place that may interfere with traffic either bound to or coming from the Sonicwall VPN network. In a default scenario without any restrictions we want to leave those packets untouched. If you find your VPN traffic is still being interfered with, check your other chains to see that they aren't mangling your VPN traffic.

If you need to insert the rule above another rule, for example above a MASQ rule, use the -I command instead. For example:

iptables -t nat -I POSTROUTING 1 -j ACCEPT --destination 10.0.0.0/255.255.255.0

To put the rule first in the chain.

Sonicwall side configuration

The screenshots below are from the web interface for the Sonicwall NSA 2400.

Go to the VPN lists to add another VPN (Usually VPN->Settings on the menu).

Add a new VPN connexion (the Add button).