Attachment 64761 Details for Bug 97760 – version 0.6

version 0.6

vpnc-howto.xml (text/plain), 21.81 KB, created by David H. Askew on 2005-07-30 21:06:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David H. Askew

Created: 2005-07-30 21:06:49 UTC

Size: 21.81 KB

patch

obsolete

><?xml version='1.0' encoding='UTF-8'?>
><!DOCTYPE guide SYSTEM "/dtd/guide.dtd">
>
><guide link="/doc/vpnc-howto.xml">
>
><title>VPN Howto : Using vpnc</title>
>
><author title="Author">
>  <mail link="insertemailaddresshere">replace with name</mail>
></author>
>
><abstract>
>This document details how to connect your workstation to a cisco 3000 vpn
>concentrator.
></abstract>
>
><version>0.6</version>
><date>2005-07-31</date>
>
><chapter>
><title>Introduction</title>
>
><section>
><body>
>
><p>
>If you're reading this, then you likely need to connect to your office network
>from home or during travel.  Many companies utilize Cisco 3000 vpn concentrators
>for their vpn needs, and I am willing to bet that most Linux newbies think that
>they are forced to use Windows to connect to them.  Well I'm here to tell you
>that connecting to a Cisco vpn may very well be possible, and this document
>will hopefully enable to you to setup a working tunnel using your Gentoo
>workstation or laptop.
></p>
>
></body>
></section>
>
><section>
><title>What this document is:</title>
><body>
>
><ul>
> <li>A guide to the basic workings of vpnc.</li>
> <li>A discussion of dns and routing issues that relate to vpns.</li>
> <li>Examples of managing vpn sessions.</li>
> <li>Useful tips and tricks. (Hopefully)</li>
></ul>
>
></body>
></section>
>
><section>
><title>What this document is not:</title>
><body>
>
><ul>
> <li>An in-depth guide to vpn / encryption technologies.</li>
> <li>A feature by feature explanation of vpnc.</li>
></ul>
>
></body>
></section>
>
><section>
><title>Assumptions</title>
><body>
><p>
>The assumptions made at this point are:
></p>
>
><ul>
> <li>You have gentoo installed</li>
> <li>You have internet access</li>
> <li>You want to connect to a cisco 3000 vpn concentrator</li>
> <li>You know how to configure, build, and install a new kernel</li>
></ul>
>
></body>
></section>
></chapter>
>
><chapter>
><title>Kernel Configuration</title>
><section>
><body>
>
><note>
>The kernel used in this guide is <c>sys-kernel/gentoo-sources 2.6.9-r9</c>.
></note>
>
><p>
>In order for the Linux to be able to open a vpn connection, "Universal TUN/TAP
>device driver support" must be enabled in the kernel.  What is it, and why do
>we need it?  Below is a relatively strait forward explanation from the kernel
>configuration dialog:
></p>
>
><pre caption="CONFIG_TUN:">
>TUN/TAP provides packet reception and transmission for user space
>programs.  It can be viewed as a simple Point-to-Point or Ethernet
>device, which instead of receiving packets from a physical media,
>receives them from user space program and instead of sending packets
>via physical media writes them to the user space program.
>
>When a program opens /dev/net/tun, driver creates and registers
>corresponding net device tunX or tapX.  After a program closed above
>devices, driver will automatically delete tunXX or tapXX device and
>all routes corresponding to it.
></pre>
>
><p>
>You can verify if your kernel has TUN/TAP support with the following command:
></p>
>
><pre caption="Checking the kernel config">
># <i>cat /usr/src/linux/.config | grep TUN</i>
>CONFIG_INET_TUNNEL=m
># CONFIG_INET6_TUNNEL is not set
># CONFIG_IPV6_TUNNEL is not set
>CONFIG_TUN=m
># CONFIG_8139TOO_TUNE_TWISTER is not set
></pre>
>
><p>
>As you can see above, <c>CONFIG_TUN=m</c> is compiled as a module.  If this is
>not the case with your setup, enable support in your kernel of choice, rebuild,
>install, reboot, and return to this document before continuing.
></p>
>
><pre caption="Config location">
>TUN/TAP support is located under:
>
>Device Drivers  --->
>	Networking support  --->
>		   Universal TUN/TAP device driver support
></pre>
>
><p>
>If you already have TUN/TAP support built for your kernel, or you just booted
>your computer after a fresh kernel build, then we need to verify that the
>kernel has the appropriate code initialized.
></p>
>
><p>
>If you built TUN/TAP support directly into the kernel, you should see
>information from <c>dmesg</c> output like the following:
></p>
>
><pre caption="Checking dmesg output">
># <i>dmesg | grep TUN</i>
>Universal TUN/TAP device driver 1.5 (C)1999-2002 Maxim Krasnyansky
></pre>
>
><p>
>If you build TUN/TAP support as a module, you first must load the "tun" module.
></p>
>
><pre caption="Load tun module">
># <i>modprobe tun</i>
># <i>lsmod</i>
>Module                  Size  Used by
>tun                     7296  0
>nvidia               4050204  12
></pre>
>
><p>
>Now that the "tun" module is loaded, check dmesg output.  You should see
>something like the following:
></p>
><pre caption="Checking dmesg output">
># <i>dmesg | grep TUN</i>
>Universal TUN/TAP device driver 1.5 (C)1999-2002 Maxim Krasnyansky
></pre>
>
></body>
></section>
></chapter>
>
><chapter>
><title>Install Needed Software</title>
><section>
><body>
>
><p>
>Now that we have a working kernel setup, we need to install vpnc.
></p>
><pre caption="Installing vpnc">
># <i>emerge net-misc/vpnc</i>
></pre>
>
><note>
>The version of <c>vpnc</c> used in this guide is <c>0.3.2</c>.  As of this
>writing, <c>vpnc</c> version <c>0.3.3</c> has been released, but it has not yet
>added to the portage tree.
></note>
>
></body>
></section>
></chapter>
>
><chapter>
><title>Example Setup</title>
><section>
><body>
>
><p>
>In order to make the following sections more clear, we need an example setup
>to work from.  For the purposes of this exercise, we will assume that we have
>a home network of several computers.  All computers are on the 192.168.0.0 /
>255.255.255.0 network.  The lan in question is run by a Gentoo box running an
>iptables firewall / dhcp / caching dns / etc ..., and it masquerading the lan
>behind the public ip address it receives from an ISP.  We now have a
>workstation on the lan that we want to be able to vpn into our office with.
></p>
><p>
>Our workstation configuration looks like the following
></p>
><pre caption="/etc/resolv.conf">
># <i>cat /etc/resolv.conf</i>
>nameserver      192.168.0.1
></pre>
>
><pre caption="/etc/hosts">
># <i>cat /etc/hosts</i>
>127.0.0.1       desktop localhost
>192.168.0.1     router
>192.168.2.2     mediacenter
></pre>
>
><pre caption="our interface settings">
># <i>ifconfig -a</i>
>eth0      Link encap:Ethernet  HWaddr 00:11:2F:8D:08:08
>          inet addr:192.168.0.2  Bcast:192.168.0.255  Mask:255.255.255.0
>          inet6 addr: fe80::211:2fff:fe8d:808/64 Scope:Link
>          UP BROADCAST NOTRAILERS RUNNING MULTICAST  MTU:1500  Metric:1
>          RX packets:3657889 errors:0 dropped:0 overruns:0 frame:0
>          TX packets:2305893 errors:0 dropped:0 overruns:0 carrier:0
>          collisions:0 txqueuelen:1000
>          RX bytes:2193722103 (2092.0 Mb)  TX bytes:1415104432 (1349.5 Mb)
>          Interrupt:185 Memory:fac00000-0
>
>lo        Link encap:Local Loopback
>          inet addr:127.0.0.1  Mask:255.0.0.0
>          inet6 addr: ::1/128 Scope:Host
>          UP LOOPBACK RUNNING  MTU:16436  Metric:1
>          RX packets:35510 errors:0 dropped:0 overruns:0 frame:0
>          TX packets:35510 errors:0 dropped:0 overruns:0 carrier:0
>          collisions:0 txqueuelen:0
>          RX bytes:16023838 (15.2 Mb)  TX bytes:16023838 (15.2 Mb)
></pre>
>
><pre caption="our routing table">
># <i>netstat -r</i>
>Kernel IP routing table
>Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
>192.168.0.0     *               255.255.255.0   U         0 0          0 eth0
>loopback        desktop         255.0.0.0       UG        0 0          0 lo
>default         router          0.0.0.0         UG        0 0          0 eth0
></pre>
>
></body>
></section>
></chapter>
>
>
><chapter>
><title>Setup vpnc</title>
><section>
><body>
>
><p>
>Now that we have vpnc installed, and we have an example to work from, lets
>discuss the basics of setting up vpnc.  The configuration file for vpnc
>connection settings can be located in a couple places, depending on how many
>"profiles" you want to setup.  By default, vpnc looks first for
><c>/etc/vpnc/default.conf</c> for its connection settings.  If it doesn't 
>find that file, then it looks for <c>/etc/vpnc.conf</c>.  This setup will only
>address a single profile example, and will use the config file location
><c>/etc/vpnc.conf</c>.
></p>
>
><pre caption="example config file">
># <i>cat /etc/vpnc.conf</i>
>IPSec gateway vpngateway.domain.org
>IPSec ID group_id
>IPSec secret group_password
>Xauth username network_signon
>Xauth password network_password
></pre>
>
><p>
>The config file example above should be modified to reflect the appropriate
>values for your setup.  The gateway option <c>vpngateway.domain.org</c> can be
>a fully qualified domain name or an ip address.  The ID and secret options
>should be given to you by a network adminstrator.  If they are hisitent about
>giving you this info, and you currently have a working setup on a Windows box
>which utilizes the official Cisco vpn client, then all you have to do is export
>your profile.  The username and password options are for your normal network
>sign-on, such as a Windows NT domain account.
></p>
>
><p>
>If you are forced to export your profile from a Windows machine, then what you
>will likely have is a file ending in <c>.pcf</c>.  This file will have all the
>information you need.  Below is an example:
></p>
>
><pre caption="example.pcf">
># <i>cat example.pcf</i>
>[main]
>Description=
>Host=VPNGATEWAY.DOMAIN.ORG
>AuthType=1
>GroupName=group_id
>GroupPwd=
>enc_GroupPwd=F3256220AA200A1D532556024F4F314B0388D48B0FBF2DB12
>EnableISPConnect=0
>ISPConnectType=0
>ISPConnect=FOOBAR
>ISPCommand=
>Username=
>SaveUserPassword=0
>UserPassword=
>enc_UserPassword=
>NTDomain=
>EnableBackup=0
>BackupServer=
>EnableMSLogon=1
>MSLogonType=0
>EnableNat=1
>TunnelingMode=0
>TcpTunnelingPort=10000
>CertStore=0
>CertName=
>CertPath=
>CertSubjectName=
>CertSerialHash=00000000000000000000000000000000
>SendCertChain=0
>VerifyCertDN=
>DHGroup=2
>ForceKeepAlives=0
>PeerTimeout=90
>EnableLocalLAN=0
>EnableSplitDNS=1
>ForceNetLogin=0
></pre>
>
><p>
>In the above example, we can see entries for "Host","GroupName", and 
>"enc_GroupPwd".  Your "Username" and "UserPassword" may or may not be exported,
>depending on the setup.
></p>
>
><note>
>The vpnc config file uses an unencrypted group password (IPSec secret), so if
>you do not know the group password, but you have a copy of the encrypted group
>password from an exported profile, the you need not worry.  The encoding scheme
>for these group passwords is widely known, and all you have to do is visit a
>webpage that will offer to decrypt it for you.  The 
><uri link="http://www.unix-ag.uni-kl.de/~massar/vpnc/">vpnc homepage </uri>
>has a link to just such a page 
><uri link="http://www.unix-ag.uni-kl.de/~massar/bin/cisco-decode">here</uri>.
></note>
>
></body>
></section>
>
><section>
><title>Testing our setup</title>
><body>
>
><p>
>Now that we have our configuration in place, its time to test our setup.  To
>startup vpnc you do the following:
></p>
>
><pre caption="vpnc-connect example">
># <i>vpnc-connect</i>
>Enter password for username@vpngateway.domain.org: 
>VPNC started in background (pid: 14788)...
></pre>
>
><p>
>As you can see from the above command output, once you type <c>vpnc-connect</c>
>(as root), you are prompted for your password.  After inputing your password, 
>and it will not be echoed back to you, the vpnc process will automatically 
>become a background process.
></p>
>
><note>
>If you specified the <c>Xauth password</c> option in your vpnc config file, then
>you will not be prompted for your password at vpnc startup.  Additionally, if
>vpnc needs some extra options not specified in the configuration file, or if
>you have forgetten something, don't worry, it will ask you for it.
></note>
>
><pre caption="ifconfig -a output">
># <i> ifconfig -a</i>
>eth1      Link encap:Ethernet  HWaddr 00:11:2F:8D:08:08
>          inet addr:192.168.0.2  Bcast:192.168.0.255  Mask:255.255.255.0
>          inet6 addr: fe80::211:2fff:fe8d:808/64 Scope:Link
>          UP BROADCAST NOTRAILERS RUNNING MULTICAST  MTU:1500  Metric:1
>          RX packets:2101119 errors:0 dropped:0 overruns:0 frame:0
>          TX packets:1577559 errors:0 dropped:0 overruns:0 carrier:0
>          collisions:0 txqueuelen:1000
>          RX bytes:1757862627 (1676.4 Mb)  TX bytes:732200131 (698.2 Mb)
>          Interrupt:177 Memory:faa00000-0
>
>sit0      Link encap:IPv6-in-IPv4
>          NOARP  MTU:1480  Metric:1
>          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
>          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
>          collisions:0 txqueuelen:0
>          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
>
>tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
>          inet addr:192.168.160.42  P-t-P:192.168.160.42  Mask:255.255.255.255
>          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1412  Metric:1
>          RX packets:1 errors:0 dropped:0 overruns:0 frame:0
>          TX packets:9 errors:0 dropped:0 overruns:0 carrier:0
>          collisions:0 txqueuelen:500
>          RX bytes:60 (60.0 b)  TX bytes:616 (616.0 b)
>
></pre>
>
><pre caption="netstat -r">
># <i>netstat -r</i>
>Kernel IP routing table
>Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
>vpn01.domain.or router          255.255.255.255 UGH    1500 0          0 eth1
>192.168.0.0     *               255.255.255.0   U         0 0          0 eth1
>loopback        desktop         255.0.0.0       UG        0 0          0 lo
>default         *               0.0.0.0         U         0 0          0 tun0
></pre>
>
><pre caption="/etc/resolv.conf">
># <i>cat /etc/resolv.conf</i>
>nameserver 192.168.0.1
></pre>
>
><p>
>As you can see from the above command output(s), vpnc has done the following:
></p>
>
><ul>
>	<li>Created the tun0 network interface, a virtual interface to handle
>	the traffic accross our vpn tunnel.</li>
>	<li>Optained the ip address for the tun0 device from our vpn provider.</li>
>	<li>Set our default route to our vpn gateway.</li>
></ul>
>
><p>
>At this point, our workstation is capable of communicating with hosts via the
>vpn, but only by ip address.  As you have probably noticed, vpnc did not alter
>our <c>/etc/resolv.conf</c>, thus not setting up dns services for our virtual
>link.  Also, because vpnc sets our default route to our vpn gateway, all network
>traffic will travel accross the vpn, even if it destined for the internet or
>elsewhere not specifically specified by additional routes.  For some, this basic
>type of connection may be satisfactory, but for most, additional steps need to
>be taken.
></p>
>
><p>
>Additional things we would like to have:
></p>
>
><ul>
>	<li>DNS for our vpn.</li>
>	<li>A routing setup that will only send trafic destined for the vpn down
>	the virtual tunnel.  This way, we can browse the internet while connected to
>	the vpn, without our "personel" web/p2p etc ... trafic going accross the
>	tunnel.</li>
>	<li>A script to manage all this, because vpnc-connect just doesn't do
>	enough.</li>
></ul>
>
><p>
>When you are ready to end the vpn session, execute <c>vpnc-disconnect</c>. An
>example is shown below.
></p>
>
><note>
>Don't disconnect yet, because we have additional things to test.  The example
>below is just for informational purposes.
></note>
>
><pre caption="vpnc-disconnect">
># <i>vpnc-disconnect</i>
>Terminating vpnc daemon (pid: 26250)
></pre>
>
></body>
></section>
>
></chapter>
>
><chapter>
><title>Setup dns</title>
><section>
><body>
>
><p>
>Unfortunately, <c>vpnc</c> doesn't handle the setup and management of dns for
>our newly established tunnel.  The user is left to decide how dns should be
>handled.  We could just overwrite <c>/etc/resolv.conf</c> when we connect, but
>that would utilize our vpn dns for all dns queries regardless of whether or not
>the traffic is destined for our vpn tunnel.  This is a very functional solution,
>and if you simply need to connect to the tunnel, do your work, and then
>disconnect, read no further.  But, if you want to be able to leave your tunnel
>connected for lengthy periods of time, and don't want your work dns servers 
>handling requests for your "personel" traffic, read on.
></p>
>
><p>
>The ideal setup would allow us seperate our dns queries into two
>categories, vpn-related, and other.  Under this setup, all vpn-related dns
>queries would be answered by dns servers located at the other end of our vpn
>tunnel, and all other queries would continue to be answered by local or ISP
>supplied dns servers.  This is the setup that will be demonstrated here.
></p>
>
><note>
>We will consider vpn-related dns queries to be any query belonging to the 
>example.org domain, such as host1.example.org, or server1.example.org.
></note>
>
><p>
>So how do we set things up, so that only requests made to hosts on the 
>example.org domain get sent to vpn supplied dns servers?  Well, we're going to
>need to install a local dns server, but don't worry, its much easier than you
>think.  There are several software packages that can handle the type of setup
>we desire, but for the purposes of this demonstration, <c>dnsmasq</c> will be
>utilized.  Lets emerge it now:
></p>
>
><note>
>This dns server software will not be available to the network, and will only
>answer requests from localhost, <c>127.0.0.1</c>.
></note>
>
><pre caption="Install dnsmasq">
># <i>emerge -pv dnsmasq</i>
>
>These are the packages that I would merge, in order:
>
>Calculating dependencies ...done!
>[ebuild  N    ] net-dns/dnsmasq-2.22  0 kB
>
># <i> emerge -v dnsmasq </i>
></pre>
>
><p>
>Now we need to add an option to our dnsmasq startup options.  Edit the following
>option to suit your needs.  Substitute .example.org with the appropriate domain,
>and the ip address with a valid dns server that belongs to the vpn tunnel.
></p>
>
><pre caption="/etc/conf.d/dnsmasq">
># <i>cat /etc/conf.d/dnsmasq</i>
>
># Config file for /etc/init.d/dnsmasq
>
># See the dnsmasq(8) man page for possible options to put here.
>DNSMASQ_OPTS="-S /.example.org/192.168.125.10"
>
></pre>
>
><p>
>Now we need to make sure that the first entry in <c>/etc/resolv.conf</c> is our
>localhost <c>127.0.0.1</c>, followed by the location of the backup dns servers
>that should handle the dns traffic should dnsmasq fail to start, or if it needs
>to forward a dns query it doesn't currently have in its cache.  An example
>/etc/resolv.conf is below.
></p>
>
><pre caption="/etc/resolv.conf">
># <i> cat /etc/resolv.conf</i>
>nameserver 127.0.0.1
>nameserver 192.168.0.1
></pre>
>
><p>
>Now that we have setup a rule for our vpn tunnel dns, we need to startup
>dnsmasq.
></p>
>
><pre caption="startup dnsmasq">
># /etc/init.d/dnsmasq start
></pre>
>
><pre caption="add dnsmasq to default runlevel">
># rc-update add dnsmasq default
></pre>
>
></body>
></section>
></chapter>
>
><chapter>
><title>Setup routing tables</title>
><section>
><body>
>
><p>
>The ideal senario would be if only the traffic destined for vpn tunnel would
>travel accross the link.  At this point, we have a vpn tunnel setup and all
>traffic will travel accross the tunnel, unless we specify additional routes. In
>order to fix this situation we need to know what networks are available to us
>on our vpn.  The easiest way to find out the needed information is to ask a 
>network administrator, but sometimes they are reluctant to answer such
>questions.  If your local network admin wont volunteer the needed information,
>a little trial and error experimentation will be required.
></p>
>
><p>
>When the vpn tunnel was started, vpnc set the default route to the tunnel.  So
>we must set our default route back to normal, so that things work as expected.
></p>
>
><pre caption="resetting our default route">
># <i>route add default gw 192.168.0.1</i>
></pre>
>
><p>
>Earlier, when dns services were being configured for our vpn, we specified a 
>dns server to handle our example.org domain.  We need to add a route for the
>192.168.125.0 subnet so that dns queries will work.
></p>
>
><pre caption="adding a route for dns">
>#<i> route add -net 192.168.160.0 netmask 255.255.255.0 dev tun0</i>
></pre>
>
><p>
>At this point, you should add any additional routes for known networks.  If 
>your friendly co-worker the network administrator gave you the required info,
>great.  Otherwise, you might need to ping hosts you will be connecting to 
>frequently, to give yourself an idea about what your routing table should look
>like.
></p>
>
><note>
>Due to our setup, when using vpn network services by name, you must specify the
>fully qualified domain name.  Example:  webserver1.example.org
></note>
>
><pre caption="ping example">
># ping intranet1.example.org
>PING intranet1.example.org (172.25.230.29) 56(84) bytes of data.
>
>
>--- intranet.example.org ping statistics ---
>18 packets transmitted, 0 received, 100% packet loss, time 16997ms
></pre>
>
><p>
>As you can see from the above example, we tried to ping host 
>intranet1.example.org and were unsuccessfull.  So we need to add a route for
>that subnet.
></p>
>
><pre caption="another route command example">
># <i>route add -net 172.25.230.0 netmask 255.255.255.0 dev tun0</i>
></pre>
>
><p>
>A few ping commands, and a few route commands later, you should be well on your
>way to a pretty good routing table.
></p>
>
></body>
></section>
></chapter>
>
><chapter>
><title>Manage the connection</title>
><section>
><body>
>
><p>
>Here is a script example to manage the vpn connection. You could execute it
>(as root) from an xterm to start a connection to your vpn.  Then all you have
>to do is press return to disconnect the vpn.  Obviously you will need to 
>modify this for your setup, remembering to add all the additional routes that
>you may need.
></p>
>
><pre caption="Example session management script">
># <i>cat vpn.sh</i>
>vpnc-connect
>route add default gw 192.168.0.1
>route add -net 172.25.230.0 netmask 255.255.255.0 dev tun0
>route add -net 192.168.160.0 netmask 255.255.255.0 dev tun0
>route add -net 192.168.125.0 netmask 255.255.255.0 dev tun0
>echo "press any key to disconnect ..."
>read $disconnect
>vpnc-disconnect
>route add default gw 192.168.0.1
>echo "vpn should now be disconnected ... hit enter to exit"
>read $exitvpn
></pre>
>
></body>
></section>
></chapter>
>
>
><chapter>
><title>Tips and Tricks</title>
><section>
><body>
>
><p>
>net-misc/grdesktop - gnome tool for rdp sessions to wintel servers
></p>
>
><p>
>nmblookup (samba WINS tool) - give an example of using nmblookup to query a
>WINS server for a given netbios name
></p>
>
><p>
>net-misc/kvpnc - a kde vpn management gui
></p>
>
></body>
></section>
></chapter>
>
><chapter>
><title>Useful Links</title>
><section>
><body>
>
><p>
><uri link="http://www.unix-ag.uni-kl.de/~massar/vpnc/">vpnc homepage</uri>
></p>
>
></body>
></section>
></chapter>
>
><chapter>
><title>Final Notes</title>
><section>
><body>
>
><p>
>Final Notes go here.
></p>
>
></body>
></section>
></chapter>
></guide>

Actions: View

Attachments on bug 97760: 62501 | 62511 | 62569 | 62813 | 63106 | 63841 | 64761 | 64838 | 64911 | 65170 | 65339 | 77310 | 78833 | 111455 | 120062