2

I need to create an encrypted channel between two computers inside a lan using openswan, so I can show how the encrypted traffic is using wireshark. I installed openswan in both computers (running ubuntu), and read a lot of forums (this is my first vpn creation) and I tried to set up everything but still can't ping any machine from the other...this is the configuration file :

version 2.0 # conforms to second version of ipsec.conf specification

# basic configuration
config setup

        dumpdir=/var/run/pluto/
        nat_traversal=yes
        virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
        oe=off
        protostack=auto

# Add connections here
conn demo-connection-debian
        authby=secret
        auto=start
        keyexchange=ike
        esp=3des-md5
        pfs=yes
        type=transport
        left=192.168.1.102
        right=192.168.1.105

in each computer I changed left for right so left was the local machine ip, did the same in ipsec.secrets in each machine that looks like :

include /var/lib/openswan/ipsec.secrets.inc
192.168.1.102 192.168.1.105: PSK "mypassword"

and I also removed 192.168.. from virtual_private in ipsec.conf, since I read in a forum that the ip server couldn't be there. I also read that if it was a point to point connection without a subnet you should use type=transport. When I run ipsec verify in one machine shows everything ok (the one that has only one network adapter), the other one that has wireless and ethernet shows:

Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path                                 [OK]
Linux Openswan U2.6.38/K3.13.0-35-generic (netkey)
Checking for IPsec support in kernel                            [OK]
 SAref kernel support                                           [N/A]
 NETKEY:  Testing XFRM related proc values                      [OK]
    [OK]
    [OK]
Checking that pluto is running                                  [OK]
 Pluto listening for IKE on udp 500                             [OK]
 Pluto listening for NAT-T on udp 4500                          [OK]
Two or more interfaces found, checking IP forwarding            [FAILED]
Checking NAT and MASQUERADEing                                  [OK]
Checking for 'ip' command                                       [OK]
Checking /bin/sh is not /bin/dash                               [WARNING]
Checking for 'iptables' command                                 [OK]
Opportunistic Encryption Support                                [DISABLED]

But i tried everything on google to fix it, and here I read that that doesnt matter since it was and perl error that could be ignored : https://serverfault.com/questions/619115/ipsec-verify-on-ubuntu-two-or-more-interfaces-found-checking-ip-forwarding-fai

So I have no any idea what is wrong and I wasted so many hours trying with no results, any help would be really appreciated, thanks a lot

Community
  • 1
Sfp
  • 123

1 Answers1

0

The best solution that worked for me was to install OpenSwan on a Ubuntu Server using these instructions

On Ubuntu server terminal use the following command to monitor the OpenSwan operation:

sudo tail -f /var/log/auth.log

Then you can connect to that server on your lan from a Windows PC following these steps. Windows' built-in client can handle L2TP with IPsec VPN so you won't have to install any additional software. Though you may have to tweak Windows PC a bit

This is easier to setup and use.

Faisal
  • 183
  • 1
  • 11