VPNC

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 08:04, 14 April 2008 (edit)
Sastad (Talk | contribs)
(FAQ Frequently asked Questions)
← Previous diff
Revision as of 08:47, 13 May 2008 (edit) (undo)
Alain (Talk | contribs)
(FAQ Frequently asked Questions)
Next diff →
Line 158: Line 158:
==FAQ Frequently asked Questions== ==FAQ Frequently asked Questions==
-#Can some attacker steal my VPN password+* Can some attacker steal my VPN password
Yes, if you don't secure your router... Yes, if you don't secure your router...
-#Is it possible to get this to work when using the router as a wireless repeater? I have a WRT54GL running dd-wrt RC-05 vpn in repeater mode. With the standard package (RC-05) it worked like a wireless repeater, but with vpn i need to use a cable. Any ideas on how to make both vpn and wireless to work together?+* Is it possible to get this to work when using the router as a wireless repeater?
 +Yes, I use it here on a wireless repeater.
 +If you experience problems, flash latest v24 and follow [[Wlan Repeater]].

Revision as of 08:47, 13 May 2008

vpnc is supposed to work with:

  • Cisco VPN concentrator 3000 Series
  • Cisco IOS routers
  • Cisco PIX / ASA Zecurity Appliances
  • Juniper/Netscreen

This describes how to use DD-WRT to connect to a Cisco VPN Concentrator using vpnc without auto-reconnect and without connect on startup

This "script" without reconnect is mainly for people to test vpnc and find out the correct settings before they use the script with auto-reconnect. If you want your router to automatically reconnect on connection loss see further down

There is currently no gui for this, but don't worry, it won't be complicated. This script also automatically reconnects, if your vpn connection gets disconnected

To let your router connect to the vpn concentrator and share the connection with its clients follow the steps below:

  1. You need to flash DD-WRT VPN build after 08/18/07 (I recommend latest v24 vpn).
  2. Paste the code below into a text editor and adjust line 2 - 6.
  3. Open a Webbrowser, type the IP of your router, then go to Administration -> Commands
  4. Paste the code adjusted in Step 2 into the commands box, then click 'Save Startup'
  5. Reboot your router
  6. Log in via telnet and enter: vpnc /tmp/etc/vpnc/vpn.conf
  7. To share the vpn tunnel with the connected pc's, enter the following via telnet:
  iptables -A FORWARD -o tun0 -j ACCEPT
  iptables -A FORWARD -i tun0 -j ACCEPT
  iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

To disconnect the tunnel, type vpnc-disconnect. Step 6+7 have to be redone after every disconnect or reboot

If you have any comment or question on this, you can PM me in the DD-WRT Forum (Username: alain)

#!/bin/sh 
vpn_concentrator="host" ##enter ip or hostname of your Ipsec vpn concentrator
vpn_groupname="grid"  ##enter the group name here
vpn_grouppasswd="grppasswd"   ##enter the group password here
vpn_username="username"       ##enter your username here
vpn_password="password"        ##enter your password here

#--do not edit this--
#Written by Alain R. (alainr [AT] gmx.de) 27.Sep.2007
vpnc-disconnect
rm -f /tmp/etc/vpnc/vpn.conf
mkdir /tmp/etc/vpnc
echo "
IPSec gateway $vpn_concentrator
IPSec ID $vpn_groupname
IPSec secret $vpn_grouppasswd
Xauth username $vpn_username
Xauth password $vpn_password
" >> /tmp/etc/vpnc/vpn.conf

This describes how to use DD-WRT to connect to a Cisco VPN Concentrator using vpnc with auto-reconnect

This script does not give out any (useful) error nessages. If you have trouble establishing a tunnel, first look at the script without reconnect


There is currently no gui for this, but don't worry, it won't be complicated. This script also automatically reconnects, if your vpn connection gets disconnected

To let your router connect to the vpn concentrator and share the connection with its clients follow the steps below:

  1. You need to flash DD-WRT VPN build after 08/18/07 (I recommend latest v24 vpn).
  2. Paste the code below into a text editor and adjust line 5 - 11.
  3. Open a Webbrowser, type the IP of your router, then go to Administration -> Commands
  4. Paste the code adjusted in Step 2 into the commands box, then click 'Save Startup'
  5. Reboot your router

If everything worked fine, your router has now established a vpn tunnel.

If you have any comment or question on this, you can PM me in the DD-WRT Forum (Username: alain)

mkdir /tmp/etc/vpnc
rm -f /tmp/etc/vpnc/vpnc.sh
echo '
#!/bin/sh 
vpn_concentrator="host" ##enter ip or hostname of your Ipsec vpn concentrator
vpn_keepalive_host1="keepalive1"        ##enter the ip or hostname of a computer that is only reachable if vpn connection is established.
vpn_keepalive_host2="keepalive2"        ##enter the ip or hostname of a computer that is only reachable if vpn connection is established.
vpn_groupname="grid"  ##enter the group name here
vpn_grouppasswd="grppasswd"   ##enter the group password here
vpn_username="username"       ##enter your username here
vpn_password="password"        ##enter your password here

#--do not edit this--
#Written by Alain R. (alainr [AT] gmx.de) 28.Sep.2007
vpnc-disconnect
rm -f /tmp/etc/vpnc/vpn.conf
echo "
IPSec gateway $vpn_concentrator
IPSec ID $vpn_groupname
IPSec secret $vpn_grouppasswd
Xauth username $vpn_username
Xauth password $vpn_password
" >> /tmp/etc/vpnc/vpn.conf


pingtest1 () {
 ping -q -c1 $param1 >> /dev/null
 if [ "$?" == "0" ]; then
       echo 0 #reachable 
	
 else
	echo 1 #not reachable
 fi
}

pingtest2 () {
 ping -q -c2 $param2 >> /dev/null
 if [ "$?" == "0" ]; then
       echo 0 #reachable 
	
 else
	echo 1 #not reachable
 fi
}

while [ true ]; do
	param1=$vpn_concentrator;
	if [ "`pingtest1`" == "0" ]; then  #Vpn concentrator reachable
		doloop=1;
		while [ $doloop -gt 0 ]; do
			param1=$vpn_keepalive_host1;
			
			if [ "`pingtest1`" == "0" ]; then
				sleep 300
			else
				param2=$vpn_keepalive_host2;
				if [ "`pingtest2`" == "0" ]; then
					sleep 300
				else
					doloop=0;
					vpnc-disconnect
					vpnc /tmp/etc/vpnc/vpn.conf --dpd-idle 0
					sleep 1
					if [ "`pingtest1`" != "0" ]; then
						sleep 10
					fi
					tundev="`ifconfig |grep tun |cut -b 1-4`"
					iptables -A FORWARD -o $tundev -j ACCEPT
					iptables -A FORWARD -i $tundev -j ACCEPT
					iptables -t nat -A POSTROUTING -o $tundev -j MASQUERADE
					sleep 9
				fi
			fi
		done
	else
	sleep 10;
	fi
     
done

return 0;
' >> /tmp/etc/vpnc/vpnc.sh
chmod 700 /tmp/etc/vpnc/vpnc.sh
/tmp/etc/vpnc/vpnc.sh&

FAQ Frequently asked Questions

  • Can some attacker steal my VPN password

Yes, if you don't secure your router...

  • Is it possible to get this to work when using the router as a wireless repeater?

Yes, I use it here on a wireless repeater. If you experience problems, flash latest v24 and follow Wlan Repeater.