生まれ変わる - umarekawaru

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

<markdown>
# Description
IPsec-Tools was devloped by the KAME project and is now deprecated. You may still find this package usefulf for quickly configuring IPsec tunnels in an lab environment.
# Install
Install from Alpine APK or a package of your choice.
```
apk add ipsec-tools
```
# Configure Tunnel
```
ip tunnel add gre0  mode gre remote <remote_ip_addr> local <local_ip_addr> ttl 255
ip link set gre0 up
ip address <tunnel_ip_addr>/<subnet_mask> dev gre0
```
# Configure ipsec.conf
Create /etc/ipsec.conf
```
spdflush;
spdadd 0.0.0.0/0 0.0.0.0/0 gre -P out	ipsec esp/transport//require;
spdadd 0.0.0.0/0 0.0.0.0/0 gre -P in 	ipsec esp/transport//require;
```
# Configure racoon.conf
Make racoon directory.
```
mkdir /etc/racoon
```
Create racoon.conf file.
```
path certificate "/etc/racoon/";
remote anonymous {
	exchange_mode main;
	lifetime time 2 hour;
	certificate_type x509 "/etc/racoon/cert.pem" "/etc/racoon/key.pem";
	ca_type x509 "/etc/racoon/ca.pem";
	my_identifier asn1dn;
	nat_traversal on;
        script "/etc/opennhrp/racoon-ph1dead.sh" phase1_dead;
	dpd_delay 120;
	proposal {
		encryption_algorithm aes 256;
		hash_algorithm sha1;
		authentication_method rsasig;
		dh_group modp4096;
	}
	proposal {
		encryption_algorithm aes 256;
		hash_algorithm sha1;
		authentication_method rsasig;
		dh_group 2;
	}
}

sainfo anonymous {
	pfs_group 2;
	lifetime time 2 hour;
	encryption_algorithm aes 256;
	authentication_algorithm hmac_sha1;
	compression_algorithm deflate;
}
```
# Copy Certificates and Key
```
scp {ca.pem,cert.pem,key.pem} <user>@<host>:/etc/racoon/
```
# Enable the IPsec Service
```
setkey -f /etc/ipsec.conf
racoon -f /etc/racoon/racoon.conf
```
</markdown>

生まれ変わる - umarekawaru

User Tools

Site Tools

Page Tools