September 13, 2004

More IPSEC fun

I was finally able to get Linux FreeS/WAN working as an IPSEC client using a virtual IP. The trick was to add the ip address to the ipsec0 interface wth "ip addr add x.x.x.x dev ipsec0" and then add a route for the internal subnet on the inside of the vpn pointing to the virtual ip you just added as the default gateway. This way when there is a packet destined for the subnet on the other side of the tunnel, it will have a route pointing to its own virtual ip as a gateway which is bound to the ipsec0 interface. Now it will get encrypted and encapsulated and thrown through the tunnel :) Without the added routes, the remote end (ipsec gateway) didn't understand the configuration and refused to go past Phase 1.

And here is my success:

STATE_MAIN_I4: ISAKMP SA established
STATE_QUICK_I2: sent QI2, IPsec SA established

Posted by mike at September 13, 2004 7:08 AM