VPNC
From DD-WRT Wiki
Revision as of 22:41, 6 August 2008 (edit) Dano33 (Talk | contribs) m (→This describes how to use DD-WRT to connect to a Cisco VPN Concentrator using vpnc without auto-reconnect and without connect on startup) ← Previous diff |
Revision as of 19:48, 14 August 2008 (edit) (undo) De0xyrib0se (Talk | contribs) (→FAQ Frequently asked Questions) Next diff → |
||
Line 172: | Line 172: | ||
==FAQ Frequently asked Questions== | ==FAQ Frequently asked Questions== | ||
+ | |||
+ | * Can I VPN into multiple sites? | ||
+ | Yes you can, you need to keep in mind the following VPNC arguments: | ||
+ | # Local Port 0 (makes it take a random port, very important otherwise all instances try to bind to 500) | ||
+ | # Interface name tun[n] (each connection needs to be set-up on a separate interface, vpnc handles creating and destroying these so you need not worry about anything else) | ||
+ | I leave the script writing to you, one last thing to keep in mind, vpnc-disconnect disconnects ALL instances of the daemon, make sure you record the process ID for each one and disconnect things accordingly if you need to reset one of the tunnels, this way you dont reset all. | ||
* Can some attacker steal my VPN password | * Can some attacker steal my VPN password |
Revision as of 19:48, 14 August 2008
vpnc is supposed to work with:
- Cisco VPN concentrator 3000 Series
- Cisco IOS routers
- Cisco PIX / ASA Zecurity Appliances
- Juniper/Netscreen
This describes how to use DD-WRT to connect to a Cisco VPN Concentrator using vpnc without auto-reconnect and without connect on startup
This "script" without reconnect is mainly for people to test vpnc and find out the correct settings before they use the script with auto-reconnect. If you want your router to automatically reconnect on connection loss see further down
There is currently no gui for this, but don't worry, it won't be complicated. This script also automatically reconnects, if your vpn connection gets disconnected
To let your router connect to the vpn concentrator and share the connection with its clients follow the steps below:
- You need to flash DD-WRT VPN build after 08/18/07 (I recommend latest v24 vpn).
- Paste the code below into a text editor and adjust line 2 - 6.
- Open a Webbrowser, type the IP of your router, then go to Administration -> Commands
- Paste the code adjusted in Step 2 into the commands box, then click 'Save Startup'
- Reboot your router
- Log in via telnet and enter: vpnc /tmp/etc/vpnc/vpn.conf
- To share the vpn tunnel with the connected pc's, enter the following via telnet:
iptables -A FORWARD -o tun0 -j ACCEPT iptables -A FORWARD -i tun0 -j ACCEPT iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
I added also the next rule to share the tunnel tun0 with the LAN connected in br0 interface and added the DNS and WIN servers from my VPN to the local computer connected to LAN:
iptables -A FORWARD -i br0 -j ACCEPT
To disconnect the tunnel, type vpnc-disconnect.
Step 6+7 have to be redone after every disconnect or reboot
If you have any comment or question on this, you can PM me in the DD-WRT Forum (Username: alain)
#!/bin/sh vpn_concentrator="host" ##enter ip or hostname of your Ipsec vpn concentrator vpn_groupname="grid" ##enter the group name here vpn_grouppasswd="grppasswd" ##enter the group password here vpn_username="username" ##enter your username here vpn_password="password" ##enter your password here #--do not edit this-- #Written by Alain R. (alainr [AT] gmx.de) 27.Sep.2007 vpnc-disconnect rm -f /tmp/etc/vpnc/vpn.conf mkdir /tmp/etc/vpnc echo " IPSec gateway $vpn_concentrator IPSec ID $vpn_groupname IPSec secret $vpn_grouppasswd Xauth username $vpn_username Xauth password $vpn_password " >> /tmp/etc/vpnc/vpn.conf
If your VPN also requires your NTDomain to be submitted, modify the above 2 sections to include: (This also applies to the 'persistent' section below)
under "vpn_password"
vpn_domain="domain" ##enter your NTDomain here
and under "Xauth password $vpn_password" add:
Domain $vpn_domain
This describes how to use DD-WRT to connect to a Cisco VPN Concentrator using vpnc with auto-reconnect
This script does not give out any (useful) error nessages. If you have trouble establishing a tunnel, first look at the script without reconnect
There is currently no gui for this, but don't worry, it won't be complicated.
This script also automatically reconnects, if your vpn connection gets disconnected
To let your router connect to the vpn concentrator and share the connection with its clients follow the steps below:
- You need to flash DD-WRT VPN build after 08/18/07 (I recommend latest v24 vpn).
- Paste the code below into a text editor and adjust line 5 - 11.
- Open a Webbrowser, type the IP of your router, then go to Administration -> Commands
- Paste the code adjusted in Step 2 into the commands box, then click 'Save Startup'
- Reboot your router
If everything worked fine, your router has now established a vpn tunnel.
If you have any comment or question on this, you can PM me in the DD-WRT Forum (Username: alain)
mkdir /tmp/etc/vpnc rm -f /tmp/etc/vpnc/vpnc.sh echo ' #!/bin/sh vpn_concentrator="host" ##enter ip or hostname of your Ipsec vpn concentrator vpn_keepalive_host1="keepalive1" ##enter the ip or hostname of a computer that is only reachable if vpn connection is established. vpn_keepalive_host2="keepalive2" ##enter the ip or hostname of a computer that is only reachable if vpn connection is established. vpn_groupname="grid" ##enter the group name here vpn_grouppasswd="grppasswd" ##enter the group password here vpn_username="username" ##enter your username here vpn_password="password" ##enter your password here #--do not edit this-- #Written by Alain R. (alainr [AT] gmx.de) 28.Sep.2007 vpnc-disconnect rm -f /tmp/etc/vpnc/vpn.conf echo " IPSec gateway $vpn_concentrator IPSec ID $vpn_groupname IPSec secret $vpn_grouppasswd Xauth username $vpn_username Xauth password $vpn_password " >> /tmp/etc/vpnc/vpn.conf pingtest1 () { ping -q -c1 $param1 >> /dev/null if [ "$?" == "0" ]; then echo 0 #reachable else echo 1 #not reachable fi } pingtest2 () { ping -q -c2 $param2 >> /dev/null if [ "$?" == "0" ]; then echo 0 #reachable else echo 1 #not reachable fi } while [ true ]; do param1=$vpn_concentrator; if [ "`pingtest1`" == "0" ]; then #Vpn concentrator reachable doloop=1; while [ $doloop -gt 0 ]; do param1=$vpn_keepalive_host1; if [ "`pingtest1`" == "0" ]; then sleep 300 else param2=$vpn_keepalive_host2; if [ "`pingtest2`" == "0" ]; then sleep 300 else doloop=0; vpnc-disconnect vpnc /tmp/etc/vpnc/vpn.conf --dpd-idle 0 sleep 1 if [ "`pingtest1`" != "0" ]; then sleep 10 fi tundev="`ifconfig |grep tun |cut -b 1-4`" iptables -A FORWARD -o $tundev -j ACCEPT iptables -A FORWARD -i $tundev -j ACCEPT iptables -t nat -A POSTROUTING -o $tundev -j MASQUERADE sleep 9 fi fi done else sleep 10; fi done return 0; ' >> /tmp/etc/vpnc/vpnc.sh chmod 700 /tmp/etc/vpnc/vpnc.sh /tmp/etc/vpnc/vpnc.sh&
FAQ Frequently asked Questions
- Can I VPN into multiple sites?
Yes you can, you need to keep in mind the following VPNC arguments:
- Local Port 0 (makes it take a random port, very important otherwise all instances try to bind to 500)
- Interface name tun[n] (each connection needs to be set-up on a separate interface, vpnc handles creating and destroying these so you need not worry about anything else)
I leave the script writing to you, one last thing to keep in mind, vpnc-disconnect disconnects ALL instances of the daemon, make sure you record the process ID for each one and disconnect things accordingly if you need to reset one of the tunnels, this way you dont reset all.
- Can some attacker steal my VPN password
Yes, if you don't secure your router...
- Is it possible to get this to work when using the router as a wireless repeater?
Yes, I use it here on a wireless repeater. If you experience problems, flash latest v24 and follow Wlan Repeater.
- I cannot connect if my password contains ", $, `, or \.
The reason is that the shell always interprets these characters (even between quotation marks). If your password contains such characters, just put a \ (escape character) before each of the above characters. If your password is for example abc$123\xyz you need to enter abc\$123\\xyz
- Can I use split-tunneling to access my local network (and local internet connection) while still accessing my corporate network via VPN tunnel?
Yes. On a Windows machine (which I have tested), you need to edit the TCP/IP configuration and explicitly identify your DNS servers via IP. Add in your corporate DNS server first in the list, then your ISP DNS servers. If you access corporate SMB network shares, be sure to add in your corporate WINS server.
For split tunneling, use the following code:
#!/bin/sh # This is a wrapper for the vpnc-script overriding some variables needed # for setting up split-tunneling # this effectively disables changes to /etc/resolv.conf INTERNAL_IP4_DNS= # This sets up split networking regardless of the concentrators specifications. # You can add as many routes as you want, but you must set the counter # CISCO_SPLIT_INC accordingly. All requests to IP ranges NOT listed # in the code below will NOT go though the VPN tunnel. CISCO_SPLIT_INC=2 CISCO_SPLIT_INC_0_ADDR=147.0.0.0 #IP range to go into first tunnel CISCO_SPLIT_INC_0_MASK=255.0.0.0 #Subnet Mask for first tunnel CISCO_SPLIT_INC_0_MASKLEN=8 #Mask length CISCO_SPLIT_INC_0_PROTOCOL=0 CISCO_SPLIT_INC_0_SPORT=0 CISCO_SPLIT_INC_0_DPORT=0 CISCO_SPLIT_INC_1_ADDR=172.0.0.0 #IP range to go into the second tunnel CISCO_SPLIT_INC_1_MASK=255.0.0.0 #Subnet mask CISCO_SPLIT_INC_1_MASKLEN=8 #Mask length CISCO_SPLIT_INC_1_PROTOCOL=0 CISCO_SPLIT_INC_1_SPORT=0 CISCO_SPLIT_INC_1_DPORT=0 # run the original script . /etc/vpnc/vpnc-script