VPNC

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 20:06, 27 September 2007 (edit)
Alain (Talk | contribs)
(This describes how to use DD-WRT to connect to a Cisco VPN Concentrator using vpnc without auto-reconnect)
← Previous diff
Revision as of 13:59, 28 September 2007 (edit) (undo)
Alain (Talk | contribs)
(This describes how to use DD-WRT to connect to a Cisco VPN Concentrator using vpnc with auto-reconnect)
Next diff →
Line 71: Line 71:
#!/bin/sh #!/bin/sh
vpn_concentrator="host" ##enter ip or hostname of your Ipsec vpn concentrator vpn_concentrator="host" ##enter ip or hostname of your Ipsec vpn concentrator
-vpn_keepalive_host1="keepalive1" ##enter the ip or hostname of a computer that should be reachable if vpn connection is established.+vpn_keepalive_host1="keepalive1" ##enter the ip or hostname of a computer that is reachable if vpn connection is established.
-vpn_keepalive_host2="keepalive2" ##enter the ip or hostname of a computer that should be reachable if vpn connection is established.+vpn_keepalive_host2="keepalive2" ##enter the ip or hostname of a computer that is reachable if vpn connection is established.
vpn_groupname="grid" ##enter the group name here vpn_groupname="grid" ##enter the group name here
vpn_grouppasswd="grppasswd" ##enter the group password here vpn_grouppasswd="grppasswd" ##enter the group password here
Line 79: Line 79:
#--do not edit this-- #--do not edit this--
-#Written by Alain R. (alainr [AT] gmx.de) 17.Sep.2007+#Written by Alain R. (alainr [AT] gmx.de) 28.Sep.2007
-rm -f /tmp/etc/vpnc/vpn.conf+
vpnc-disconnect vpnc-disconnect
 +rm -f /tmp/etc/vpnc/vpn.conf
echo " echo "
IPSec gateway $vpn_concentrator IPSec gateway $vpn_concentrator
Line 128: Line 128:
vpnc-disconnect vpnc-disconnect
vpnc /tmp/etc/vpnc/vpn.conf vpnc /tmp/etc/vpnc/vpn.conf
- sleep 10+ sleep 1
 + if [ "`pingtest1`" != "0" ]; then
 + sleep 10
 + fi
tundev="`ifconfig |grep tun |cut -b 1-4`" tundev="`ifconfig |grep tun |cut -b 1-4`"
iptables -A FORWARD -o $tundev -j ACCEPT iptables -A FORWARD -o $tundev -j ACCEPT

Revision as of 13:59, 28 September 2007

vpnc is supposed to work with:

  • Cisco VPN concentrator 3000 Series
  • Cisco IOS routers
  • Cisco PIX / ASA Zecurity Appliances
  • Juniper/Netscreen

This describes how to use DD-WRT to connect to a Cisco VPN Concentrator using vpnc without auto-reconnect and without connect on startup

if you want your router to automatically reconnect on connection loss see further down

There is currently no gui for this, but don't worry, it won't be complicated. This script also automatically reconnects, if your vpn connection gets disconnected

To let your router connect to the vpn concentrator and share the connection with its clients follow the steps below:

  1. You need to flash DD-WRT VPN build after 08/18/07 (I recommend latest v24 vpn).
  2. Paste the code below into a text editor and adjust line 2 - 6.
  3. Open a Webbrowser, type the IP of your router, then go to Administration -> Commands
  4. Paste the code adjusted in Step 2 into the commands box, then click 'Save Startup'
  5. Reboot your router
  6. Log in via telnet and enter: vpnc /tmp/etc/vpnc/vpn.conf
  7. To share the vpn tunnel with the connected pc's, enter the following via telnet:
  iptables -A FORWARD -o tun0 -j ACCEPT
  iptables -A FORWARD -i tun0 -j ACCEPT
  iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE


If you have any comment or question on this, you can PM me in the DD-WRT Forum (Username: alain)

#!/bin/sh 
vpn_concentrator="host" ##enter ip or hostname of your Ipsec vpn concentrator
vpn_groupname="grid"  ##enter the group name here
vpn_grouppasswd="grppasswd"   ##enter the group password here
vpn_username="username"       ##enter your username here
vpn_password="password"        ##enter your password here

#--do not edit this--
#Written by Alain R. (alainr [AT] gmx.de) 27.Sep.2007
vpnc-disconnect
rm -f /tmp/etc/vpnc/vpn.conf
mkdir /tmp/etc/vpnc
echo "
IPSec gateway $vpn_concentrator
IPSec ID $vpn_groupname
IPSec secret $vpn_grouppasswd
Xauth username $vpn_username
Xauth password $vpn_password
" >> /tmp/etc/vpnc/vpn.conf

This describes how to use DD-WRT to connect to a Cisco VPN Concentrator using vpnc with auto-reconnect

There is currently no gui for this, but don't worry, it won't be complicated. This script also automatically reconnects, if your vpn connection gets disconnected

To let your router connect to the vpn concentrator and share the connection with its clients follow the steps below:

  1. You need to flash DD-WRT VPN build after 08/18/07 (I recommend latest v24 vpn).
  2. Paste the code below into a text editor and adjust line 5 - 11.
  3. Open a Webbrowser, type the IP of your router, then go to Administration -> Commands
  4. Paste the code adjusted in Step 2 into the commands box, then click 'Save Startup'
  5. Reboot your router

If everything worked fine, your router has now established a vpn tunnel.

If you have any comment or question on this, you can PM me in the DD-WRT Forum (Username: alain)

mkdir /tmp/etc/vpnc
rm -f /tmp/etc/vpnc/vpnc.sh
echo '
#!/bin/sh 
vpn_concentrator="host" ##enter ip or hostname of your Ipsec vpn concentrator
vpn_keepalive_host1="keepalive1"        ##enter the ip or hostname of a computer that is reachable if vpn connection is established.
vpn_keepalive_host2="keepalive2"        ##enter the ip or hostname of a computer that is reachable if vpn connection is established.
vpn_groupname="grid"  ##enter the group name here
vpn_grouppasswd="grppasswd"   ##enter the group password here
vpn_username="username"       ##enter your username here
vpn_password="password"        ##enter your password here

#--do not edit this--
#Written by Alain R. (alainr [AT] gmx.de) 28.Sep.2007
vpnc-disconnect
rm -f /tmp/etc/vpnc/vpn.conf
echo "
IPSec gateway $vpn_concentrator
IPSec ID $vpn_groupname
IPSec secret $vpn_grouppasswd
Xauth username $vpn_username
Xauth password $vpn_password
" >> /tmp/etc/vpnc/vpn.conf


pingtest1 () {
 ping -q -c1 $param1 >> /dev/null
 if [ "$?" == "0" ]; then
       echo 0 #reachable 
	
 else
	echo 1 #not reachable
 fi
}

pingtest2 () {
 ping -q -c2 $param2 >> /dev/null
 if [ "$?" == "0" ]; then
       echo 0 #reachable 
	
 else
	echo 1 #not reachable
 fi
}

while [ true ]; do
	param1=$vpn_concentrator;
	if [ "`pingtest1`" == "0" ]; then  #Vpn concentrator reachable
		doloop=1;
		while [ $doloop -gt 0 ]; do
			param1=$vpn_keepalive_host1;
			
			if [ "`pingtest1`" == "0" ]; then
				sleep 300
			else
				param2=$vpn_keepalive_host2;
				if [ "`pingtest2`" == "0" ]; then
					sleep 300
				else
					doloop=0;
					vpnc-disconnect
					vpnc /tmp/etc/vpnc/vpn.conf
					sleep 1
					if [ "`pingtest1`" != "0" ]; then
						sleep 10
					fi
					tundev="`ifconfig |grep tun |cut -b 1-4`"
					iptables -A FORWARD -o $tundev -j ACCEPT
					iptables -A FORWARD -i $tundev -j ACCEPT
					iptables -t nat -A POSTROUTING -o $tundev -j MASQUERADE
					sleep 9
				fi
			fi
		done
	else
	sleep 10;
	fi
     
done

return 0;
' >> /tmp/etc/vpnc/vpnc.sh
chmod 700 /tmp/etc/vpnc/vpnc.sh
/tmp/etc/vpnc/vpnc.sh&