<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Zarya&#039;s Blog &#187; Howto</title>
	<atom:link href="http://gigafreak.net/wordpress/archives/tag/howto/feed" rel="self" type="application/rss+xml" />
	<link>http://gigafreak.net/wordpress</link>
	<description>Zarya&#039;s personal blog</description>
	<lastBuildDate>Thu, 29 Sep 2011 13:13:01 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<item>
		<title>Ipsec gre between OpenBSD en Linux</title>
		<link>http://gigafreak.net/wordpress/archives/142</link>
		<comments>http://gigafreak.net/wordpress/archives/142#comments</comments>
		<pubDate>Wed, 28 Oct 2009 09:46:54 +0000</pubDate>
		<dc:creator>Zarya</dc:creator>
				<category><![CDATA[Computers]]></category>
		<category><![CDATA[Howto]]></category>

		<guid isPermaLink="false">http://gigafreak.net/wordpress/?p=142</guid>
		<description><![CDATA[Linux Side: Tools u need are: racoon ipsec-tools /etc/ipsec-tools.conf spdadd &#60;Remote IP&#62; &#60;Local IP&#62; any -P in ipsec esp/transport/&#60;Remote IP&#62;-&#60;Local IP&#62;/require; spdadd &#60;Local IP&#62; &#60;Remote IP&#62; any -P out ipsec esp/transport/&#60;Local IP&#62;-&#60;Remote IP&#62;/require; /etc/racoon/psk.txt &#60;Remote IP&#62; &#60;Your PSK&#62; /etc/racoon/racoon.conf remote &#60;Remote IP&#62; { exchange_mode main; proposal { encryption_algorithm blowfish; hash_algorithm md5; authentication_method pre_shared_key; dh_group modp1024; [...]]]></description>
			<content:encoded><![CDATA[<p>Linux Side:</p>
<p>Tools u need are:<br />
racoon<br />
ipsec-tools</p>
<p>/etc/ipsec-tools.conf</p>
<pre>spdadd &lt;Remote IP&gt; &lt;Local IP&gt; any
    -P in ipsec esp/transport/&lt;Remote IP&gt;-&lt;Local IP&gt;/require;
spdadd &lt;Local IP&gt; &lt;Remote IP&gt; any
    -P out ipsec esp/transport/&lt;Local IP&gt;-&lt;Remote IP&gt;/require;</pre>
<p>/etc/racoon/psk.txt</p>
<pre>&lt;Remote IP&gt; &lt;Your PSK&gt;</pre>
<p>/etc/racoon/racoon.conf</p>
<pre>remote &lt;Remote IP&gt; {
    exchange_mode main;
    proposal {
        encryption_algorithm blowfish;
        hash_algorithm md5;
        authentication_method pre_shared_key;
        dh_group modp1024;
    }
}

sainfo address &lt;Local IP&gt;/32 any address &lt;Remote IP&gt;/32 any {
    pfs_group modp1024;
    encryption_algorithm blowfish;
    authentication_algorithm hmac_md5;
    compression_algorithm deflate;

}

sainfo address &lt;Remote IP&gt;/32 any address &lt;Local IP&gt;/32 any {
    pfs_group modp1024;
    encryption_algorithm blowfish;
    authentication_algorithm hmac_md5;
    compression_algorithm deflate;
}</pre>
<p>Configuration on the OpenBSD side:</p>
<p>Keep in mind the if PF is enabled you need to add firewall rules for the ipsec traffic<br />
proto ah<br />
proto esp<br />
proto ipencap<br />
port 500 udp<br />
and check the rules for interface enc0 its advised to set skip on that interface</p>
<p>/etc/ipsec.conf</p>
<pre>ike esp transport from &lt;Local IP&gt; to &lt;Remote IP&gt; peer &lt;Remote IP&gt; \
main auth hmac-md5 enc blowfish group modp1024 \
quick auth hmac-md5 enc blowfish group modp1024 \
psk &lt;Your PSK&gt;</pre>
<p>/etc/isakmpd/isakmpd.policy</p>
<pre>Authorizer: "POLICY"
Comment: This bare-bones assertion accepts everything</pre>
<p>/etc/sysctl.conf</p>
<pre>net.inet.gre.allow=1
net.inet.ipip.allow=1
net.inet.ah.enable=1
net.inet.esp.enable=1</pre>
<p>/etc/rc.conf</p>
<pre>isakmpd_flags=""
ipsec=YES</pre>
]]></content:encoded>
			<wfw:commentRss>http://gigafreak.net/wordpress/archives/142/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

