[gentoo-user] Setting up VPN tunnel using racoon on a Roadwarrior

[Mick]

Hi All,

I have posted about this before, but did not get any responses.  Since then I 
have made some progress and have been able to set up a VPN tunnel using 
racoon.

However, each time I have to assign subnets and set up the tunnel manually, 
because the ipsec-tools initialisation scripts do not seem to work.

The scripts are originally installed in:

/usr/share/doc/ipsec-tools-0.7.3-r1/samples/roadwarrior/client/

phase1-up.sh.bz2 

and 

phase1-down.sh.bz2

These scripts are meant to pick up local and remote addresses and set up 
appropriate security policies for the roadwarrior, as well as change the 
default gateway & DNS resolver to the LAN of the VPN router.  Well, for some 
reason that escapes me completely they don't.


The phase1-up.sh contains:
========================================
#!/bin/sh

#
# sa-up.sh local configuration for a new SA
#
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin

case `uname -s` in
NetBSD)
        DEFAULT_GW=`netstat -rn | awk '($1 == "default"){print $2}'`
        ;;
Linux)
        DEFAULT_GW=`netstat -rn | awk '($1 == "0.0.0.0"){print $2}'`
        ;;
esac

echo $@
echo "LOCAL_ADDR = ${LOCAL_ADDR}"
echo "LOCAL_PORT = ${LOCAL_PORT}"
echo "REMOTE_ADDR = ${REMOTE_ADDR}"
echo "REMOTE_PORT = ${REMOTE_PORT}"
echo "DEFAULT_GW = ${DEFAULT_GW}"
echo "INTERNAL_ADDR4 = ${INTERNAL_ADDR4}"
echo "INTERNAL_DNS4 = ${INTERNAL_DNS4}"

echo ${INTERNAL_ADDR4} | grep '[0-9]' > /dev/null || exit 0
echo ${DEFAULT_GW} | grep '[0-9]' > /dev/null || exit 0

test -f /etc/resolv.conf.bak || cp /etc/resolv.conf /etc/resolv.conf.bak
echo "# Generated by racoon on `date`" > /etc/resolv.conf
echo "nameserver ${INTERNAL_DNS4}" >> /etc/resolv.conf

case `uname -s` in
NetBSD)
        if=`netstat -rn|awk '($1 == "default"){print $7}'`
        ifconfig ${if} alias ${INTERNAL_ADDR4} netmask ${INTERNAL_NETMASK4}
        route delete default
        route add default ${DEFAULT_GW} -ifa ${INTERNAL_ADDR4}
        route add ${REMOTE_ADDR} ${DEFAULT_GW}
        ;;
Linux)
        if=`netstat -rn|awk '($1 == "0.0.0.0"){print $8}'`
        ifconfig ${if}:1 ${INTERNAL_ADDR4}
        route delete default
        route add ${REMOTE_ADDR} gw ${DEFAULT_GW} dev ${if}
        route add default gw ${DEFAULT_GW} dev ${if}:1
        ;;
esac

# Use this for a NAT-T setup
LOCAL="${LOCAL_ADDR}[${LOCAL_PORT}]"
REMOTE="${REMOTE_ADDR}[${REMOTE_PORT}]"

# Use this for a non NAT-T setup
#LOCAL="${LOCAL_ADDR}"
#REMOTE="${REMOTE_ADDR}"


echo "
spdadd ${INTERNAL_ADDR4}/32[any] 0.0.0.0/0[any] any
       -P out ipsec esp/tunnel/${LOCAL}-${REMOTE}/require;
spdadd 0.0.0.0/0[any] ${INTERNAL_ADDR4}[any] any
       -P in ipsec esp/tunnel/${REMOTE}-${LOCAL}/require;
" | setkey -c

#
# XXX This is a workaround for Linux forward policies problem. 
# Someone familiar with forward policies please fix this properly.
#
case `uname -s` in
Linux)
        echo "
        spddelete 0.0.0.0/0[any] ${INTERNAL_ADDR4}[any] any
                -P fwd ipsec esp/tunnel/${REMOTE}-${LOCAL}/require;
        " | setkey -c
        ;;
esac
========================================


I have tried with a completed and an empty /etc/ipsec.conf file (in which the 
security policies are defined).  If it is empty it is left so by the script 
and no routes are set up when I ping the remote LAN.

When I run the script by hand this is what I get:

# /etc/racoon/scripts/phase1-up.sh 

LOCAL_ADDR = 
LOCAL_PORT = 
REMOTE_ADDR = 
REMOTE_PORT = 
DEFAULT_GW = 193.30.166.3
INTERNAL_ADDR4 = 
INTERNAL_DNS4 =

Which shows the roadwarriors ISPs gateway, but no local network or remote 
addresses.  Of course pinging the remote LAN does not get me anywhere, until I 
add the remote LAN subnet VPN allocation manually to my interface device, and 
create a route to the remote LAN, e.g. by running:

# ifconfig wlan0:1:0 172.16.1.1
# ip route add 10.10.10.0/24 via 172.16.1.1 dev wlan0

After doing this all works fine and I can ping, establish a connection to the 
remote LAN and get one with my work.

I am not sure if there is something wrong with the way that the 
/etc/init.d/racoon initialises the service; i.e. perhaps the phase1-up.sh 
script is running at the wrong time?

Notwithstanding something being wrong with the router's VPN implementation 
(there's a lot of poorly implemented IPSec routers out there) I am not sure if 
I have configured something wrong.  According to Google I'm not supposed to 
set up routing manually as I do.  This is all meant to be set up by the policy 
file.

What do you get when you run the script?  

Any idea how could I troubleshoot this?

I attach my kernel configuration just in case you spot something that I have 
missed out and that's the reason the kernel does not set up the routes.
-- 
Regards,
Mick