Difference between revisions of "Make Strongswan start on a b3"
Jump to navigation
Jump to search
| Line 66: | Line 66: | ||
For some reasons strongswan don't load the configuration even though it startup fine. | For some reasons strongswan don't load the configuration even though it startup fine. | ||
So i added a ipsec reload to /etc/rc.local that gets run after each runlevel : | So i added a ipsec reload to /etc/rc.local that gets run after each runlevel : | ||
<pre> | <pre>#!/bin/sh -e | ||
#!/bin/sh -e | |||
# | # | ||
# rc.local | # rc.local | ||
| Line 84: | Line 83: | ||
exit 0 | exit 0 | ||
</pre> | </pre> | ||
here is an example /etc/ipsec.conf : | here is an example /etc/ipsec.conf : | ||
<pre># ipsec.conf - strongSwan IPsec configuration file | <pre># ipsec.conf - strongSwan IPsec configuration file | ||
| Line 108: | Line 106: | ||
left=%defaultroute | left=%defaultroute | ||
leftsubnet={your_lan}/24 | leftsubnet={your_lan}/24 | ||
leftid={ | leftid={your@email.adr} | ||
leftfirewall=yes | leftfirewall=yes | ||
leftsourceip={b3_lanip} | leftsourceip={b3_lanip} | ||
| Line 124: | Line 122: | ||
</pre> | </pre> | ||
and this is a /etc/ipsec.secrets : | and this is a /etc/ipsec.secrets : | ||
<pre>{ | <pre>{your@email.adr} {remoteid} : PSK "4fgdfgj76sdf3F2" | ||
# this file is managed with debconf and will contain the automatically created private key | # this file is managed with debconf and will contain the automatically created private key | ||
Revision as of 06:06, 20 December 2010
Login as root :
# su -
Install build utils :
# aptitude install devscripts build-essential lsb-release libncurses-dev
Lets try to install Strongswan
# aptitude install strongswan
You will see that strongswan has problems detecting the IPsec stack :
no netkey IPsec stack detected no KLIPS IPsec stack detected no known IPsec stack detected, ignoring! Starting strongSwan 4.4.1 IPsec [starter]... charon is already running (/var/run/charon.pid exists) -- skipping charon start no netkey IPsec stack detected no KLIPS IPsec stack detected no known IPsec stack detected, ignoring! starter is already running (/var/run/starter.pid exists) -- no fork done
Okay, now lets get the kernel :
# uname -a Linux b3 2.6.35.4 #5 Tue Sep 7 16:06:15 CEST 2010 armv5tel GNU/Linux # cd /usr/src # wget http://download.excito.net/kernel/Excito_B3/2.6.35.4/linux-2.6.35.4-excito.tar.bz2 # bzip2 -d linux-2.6.35.4-excito.tar.bz2 # tar -xvf linux-2.6.35.4-excito.tar # cd linux-2.6.35.4
Make a .config :
# make bubba3_defconfig
Edit the config and enable the 2 modules missing :
# nano .config CONFIG_XFRM_USER=m CONFIG_NET_KEY=m
Save the .config file and make the modules :
# make modules modules_install
If the make script prompts you for anything, just press Enter to accept the default choice.
Make the modules available for modprobe :
# depmod -a
Lets try to restart ipsec :
# /etc/init.d/ipsec restart Restarting strongswan IPsec services: ipsecStopping strongSwan IPsec... Starting strongSwan 4.4.1 IPsec [starter]... insmod /lib/modules/2.6.35.4/kernel/net/ipv4/ah4.ko insmod /lib/modules/2.6.35.4/kernel/net/ipv4/esp4.ko insmod /lib/modules/2.6.35.4/kernel/net/xfrm/xfrm_ipcomp.ko insmod /lib/modules/2.6.35.4/kernel/net/ipv4/ipcomp.ko insmod /lib/modules/2.6.35.4/kernel/net/ipv4/tunnel4.ko insmod /lib/modules/2.6.35.4/kernel/net/ipv4/xfrm4_tunnel.ko
Nice, that seems to work now.
Make strongswan startup after reboot :
update-rc.d ipsec defaults
For some reasons strongswan don't load the configuration even though it startup fine.
So i added a ipsec reload to /etc/rc.local that gets run after each runlevel :
#!/bin/sh -e # # rc.local # # This script is executed at the end of each multiuser runlevel. # Make sure that the script will "exit 0" on success or any other # value on error. # # In order to enable or disable this script just change the execution # bits. # # By default this script does nothing. ipsec reload exit 0
here is an example /etc/ipsec.conf :
# ipsec.conf - strongSwan IPsec configuration file
# basic configuration
config setup
charonstart=no
plutostart=yes
#plutodebug=control
conn %default
ikelifetime=60m
keylife=60m
rekeymargin=3m
keyingtries=%forever
authby=secret
keyexchange=ikev1
mobike=no
conn your_conn
left=%defaultroute
leftsubnet={your_lan}/24
leftid={your@email.adr}
leftfirewall=yes
leftsourceip={b3_lanip}
lefthostaccess=yes
right={remote_gateway}
rightsubnet={remote_lan}/24
rightid={remoteid}
auto=route
type=tunnel
ike=aes128-sha1-modp1024
esp=aes128-sha1-modp1024
include /var/lib/strongswan/ipsec.conf.inc
and this is a /etc/ipsec.secrets :
{your@email.adr} {remoteid} : PSK "4fgdfgj76sdf3F2"
# this file is managed with debconf and will contain the automatically created private key
include /var/lib/strongswan/ipsec.secrets.inc