After some experimentation, I have sucessfully connected Astaro 3.216 to a Smoothwall 0.99 with IPSec VPN.
Note: On the smoothwall, you cannot use the web interface to define the connection *as far as I know*. I will do more experimenting to check this. You must edit the ipsec.conf and ipsec.secrets files in /var/smoothwall/vpn and only use the web interface to restart the connection.
My settings are as follows:
Astaro:
Type: Standard Policy: 3DES Local Endpoint: Outside Interface Remote Endpoint: Local Subnet: Remote Subnet: Authentication: PSK
After you finish configuration, use the web interface on the smoothwall and restart the vpn, and the tunnel should come up.
You should also remember that you must have packet filter rules defined on the astaro machine to allow traffic to/from the network behind the smoothwall.
I left out an important point. The smoothwall/ipcop box has to be modified to allow you to use dynamic dns names, IF your smoothwall and/or Astaro box do not have static IP address.
To do this do the following: on the smoothwall/ipcop, in /home/httpd/cgi-bin/vpn.cgi/vpnconfig.dat,
Edit and comment out these lines:
# unless (&validip($cgiparams{'LEFT'})) { # $errormessage = $tr{'left ip is invalid'}; } # unless (&validip($cgiparams{'LEFTNEXTHOP'})) { # $errormessage = $tr{'left next hop ip is invalid'}; } # unless (&validip($cgiparams{'RIGHT'})) { # $errormessage = $tr{'right ip is invalid'}; } # unless (&validip($cgiparams{'RIGHTNEXTHOP'})) { # $errormessage = $tr{'right next hop ip is invalid'}; }
What these edits do is to allow you to enter DNS names instead of IP addresses for the left and right IP addresses and to allow you to enter %defaultroute for the left and right next hops.
WARNING: These edits remove validation of the addresses and next hops. If things don't work then check these very carefully. Also be aware that FreeS/WAN works with IP addresses not DNS names and that the IP address for your dynamic DNS name is only resolved when FreeS/WAN is started.
What you need to do now is to register your machines using dynamic IP addresses with one of the supported dynamic DNS services.
You then need to create VPN connections using the dynamic DNS names instead of the left/right IP addresses. Put %defaultroute for the next hop on both left and right (in fact this can be used for most VPN connections.
As you notice in the first post, at the end of the ipsec.conf configuration on the smoothwall/ipcop, in the connection definition, there is a line that reads: auto=start
That line tells the smoothwall/ipcop box to initiate the connection (and bring it back up if it is disconnected for some reason).
Sorry about all the repeat posts, just wanted to make sure you guys had all the info.
I left out an important point. The smoothwall/ipcop box has to be modified to allow you to use dynamic dns names, IF your smoothwall and/or Astaro box do not have static IP address.
To do this do the following: on the smoothwall/ipcop, in /home/httpd/cgi-bin/vpn.cgi/vpnconfig.dat,
Edit and comment out these lines:
# unless (&validip($cgiparams{'LEFT'})) { # $errormessage = $tr{'left ip is invalid'}; } # unless (&validip($cgiparams{'LEFTNEXTHOP'})) { # $errormessage = $tr{'left next hop ip is invalid'}; } # unless (&validip($cgiparams{'RIGHT'})) { # $errormessage = $tr{'right ip is invalid'}; } # unless (&validip($cgiparams{'RIGHTNEXTHOP'})) { # $errormessage = $tr{'right next hop ip is invalid'}; }
What these edits do is to allow you to enter DNS names instead of IP addresses for the left and right IP addresses and to allow you to enter %defaultroute for the left and right next hops.
WARNING: These edits remove validation of the addresses and next hops. If things don't work then check these very carefully. Also be aware that FreeS/WAN works with IP addresses not DNS names and that the IP address for your dynamic DNS name is only resolved when FreeS/WAN is started.
What you need to do now is to register your machines using dynamic IP addresses with one of the supported dynamic DNS services.
You then need to create VPN connections using the dynamic DNS names instead of the left/right IP addresses. Put %defaultroute for the next hop on both left and right (in fact this can be used for most VPN connections.
As you notice in the first post, at the end of the ipsec.conf configuration on the smoothwall/ipcop, in the connection definition, there is a line that reads: auto=start
That line tells the smoothwall/ipcop box to initiate the connection (and bring it back up if it is disconnected for some reason).
Sorry about all the repeat posts, just wanted to make sure you guys had all the info.
