Archangel's Code Diary

Cisco IPSec VPN for Debian

Unsatisfied with OpenVPN’s low speed to connect, I tried to setup a Cisco IPSec VPN recently. Its awesome speed proves to be a right choice. Here are brief steps on Debian.

Server

racoon

raccon is an Internet Key Exchange (IKE) daemon for automatically keying IPsec connections. We’ll use this tool to establish our IPSec connection.

Since we are on Debian, we can simply use apt-get to install it:

apt-get install racoon

And set its configuration files as follows:

racoon.conf

# /etc/racoon/racoon.conf

path pre_shared_key “/etc/racoon/psk.txt”;
path certificate “/etc/racoon/certs”;

listen {
    isakmp SERVER.IP.ADDRESS [500];
    isakmp_natt SERVER.IP.ADDRESS [4500];
}

remote anonymous {
    exchange_mode aggressive, main, base;
    mode_cfg on;
    proposal_check obey;
    nat_traversal on;
    generate_policy unique;
    ike_frag on;
    passive on;
    dpd_delay 30;

    proposal {
        lifetime time 28800 sec;
        encryption_algorithm 3des;
        hash_algorithm md5;
        authentication_method xauth_psk_server;
        dh_group 2;
    }
}

sainfo anonymous {
    encryption_algorithm aes, 3des, blowfish;
    authentication_algorithm hmac_sha1, hmac_md5;
    compression_algorithm deflate;
}

mode_cfg {
    auth_source system;
    dns4 8.8.8.8;
    banner “/etc/racoon/motd”;
    save_passwd on;
    network4 10.12.0.100;
    netmask4 255.255.255.0;
    pool_size 100;
    pfs_group 2;
}

psk.txt

Pre-shared key:

# /etc/racoon/psk.txt

# Group Name Group Secret
GROUP.NAME GROUP.SECRET

And set its permissions to 600:

chmod 600 /etc/racoon/psk.txt

motd

Banner:

# /etc/racoon/motd

# Banner
Welcome to Cisco IPSec!

Accounts

To make it simple, we use system’s account system to validate our users:

useradd -MN -b /tmp -s /bin/false USER
passwd USER

iptables

Add the following rules to open relative ports and enable NAT.

iptables -A INPUT -p udp -–dport 500 -j ACCEPT
iptables -A INPUT -p udp –dport 4500 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.12.0.0/24 -o eth0 -j MASQUERADE
iptables -A FORWARD -s 10.12.0.0/24 -j ACCEPT

These rules may be lost after reboot. Consult this article to avoid this.

ipv4 forward

# /etc/sysctl.conf

net.ipv4.ip_forward=1

Run this command to enable this change:

sysctl -p /etc/sysctl.conf

Client

Linux

We can use vpnc as a client on Linux. Here is an example of its config:

# /etc/vpnc/default.conf

IPSec gateway SERVER.DOMAIN/IP
IPSec ID GROUP.NAME
IPSec secret GROUP.SECRET
IKE Authmode psk
Xauth username USER.NAME
Xauth password USER.PASSWORD
NAT Traversal Mode cisco-udp

Now we can connect or disconnect to the server using vpnc-connect or vpnc-disconnect.

Reference

Thanks to these articles for great help:

VPN

Comments