doc/src/quickstart-configs.html

   1 <html>
   2 <head>
   3   <meta http-equiv="Content-Type" content="text/html">
   4   <title>Quick FreeS/WAN installation and configuration</title>
   5   <meta name="keywords"
   6   content="Linux, IPsec, VPN, security, FreeSWAN, installation, quickstart">
   7   <!--
   8
   9   Written by Sandy Harris for the Linux FreeS/WAN project
  10   Revised by Claudia Schmeing for same
  11   Freely distributable under the GNU General Public License
  12
  13   More information at www.freeswan.org
  14   Feedback to users@lists.freeswan.org
  15
  16   This is a new file derived from:
  17   RCS ID:          $Id: quickstart-configs.html,v 1.1 2004/03/15 20:35:24 as Exp $
  18   Last changed:    $Date: 2004/03/15 20:35:24 $
  19   Revision number: $Revision: 1.1 $
  20
  21   CVS revision numbers do not correspond to FreeS/WAN release numbers.
  22   -->
  23 </head>
  24 <BODY>
  25 <H1><A name="quick_configs">FreeS/WAN quick start examples</A></H1>
  26 <P>These are sample
  27 <A href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</A>
  28 configuration files for opportunistic encryption, with comments. Much of
  29 this configuration will be unnecessary with the new defaults proposed
  30 for FreeS/WAN 2.x.</P>
  31 <P>Full instructions are in our
  32 <A href="quickstart.html#quickstart">quickstart guide</A>.
  33
  34 <H2><A name="qc.opp.client">Configuration for Initiate-only Opportunistic Encryption</A></H2>
  35 <P>The ipsec.conf file for an initiate-only opportunistic setup is:</P>
  36 <PRE># general IPsec setup
  37 config setup
  38         # Use the default interface
  39         interfaces=%defaultroute
  40         # Use auto= parameters in conn descriptions to control startup actions.
  41         plutoload=%search
  42         plutostart=%search
  43         uniqueids=yes
  44
  45 # defaults for subsequent connection descriptions
  46 conn %default
  47         # How to authenticate gateways
  48         authby=rsasig
  49         # default is
  50         # load connection description into Pluto's database
  51         # so it can respond if another gatway initiates
  52         # individual connection descriptions may override this
  53         auto=add
  54
  55 # description for opportunistic connections
  56 conn me-to-anyone
  57         left=%defaultroute         # all connections should use default route
  58         right=%opportunistic       # anyone we can authenticate
  59         leftrsasigkey=%dnsondemand  # NEW: look up keys in DNS as-needed
  60         rightrsasigkey=%dnsondemand # (not at connection load time)
  61         rekey=no                   # let unused connections die
  62         keylife=1h                 # short
  63         auto=route                 # set up for opportunistic
  64         leftid=@xy.example.com     # our identity for IPSec negotiations
  65                                    # must match DNS and ipsec.secrets</PRE>
  66
  67 <P>Normally, you need to do only two things:</P>
  68 <UL>
  69   <LI>edit <VAR>leftid=</VAR></LI>
  70   <LI>set <VAR>auto=route</VAR></LI>
  71 </UL>
  72 <P>
  73  However, some people may need to customize the <VAR>interfaces=</VAR> line
  74  in the "config setup" section. All other sections are identical for any
  75  standalone machine doing opportunistic encryption.</P>
  76 <P>The @ sign in the <VAR>leftid=</VAR> makes the ID go "over the wire"
  77  as a Fully Qualified Domain Name (FQDN).  Without it, an IP address would
  78  be used and this won't work.</P>
  79 <P>The conn is not used to supply either public key. Your private key
  80  is in <A href="manpage.d/ipsec.secrets.5.html">ipsec.secrets(5)</A>
  81  and, for opportunistic encryption, the public keys for remote gateways
  82  are all looked up in DNS.</P>
  83 <P>FreeS/WAN authenticates opportunistic encryption by <A href="#gen_rsa">RSA
  84  signature</A> only, so "public key" and "private key" refer to these keys.</P>
  85 <P>While the <VAR>left</VAR> and <VAR>right</VAR> designations
  86  here are arbitrary, we follow a convention of using <VAR>left</VAR> for
  87  local and <VAR>right</VAR> for remote.</P>
  88
  89 <P><A href="quickstart.html#config.opp.client">Continue configuring
  90 initiate-only opportunism.</A>
  91
  92 <H2><A name="qc.incoming.opp.conf">ipsec.conf for Incoming Opportunistic Encryption</A></H2>
  93 Use the ipsec.conf above, except that the section describing opportunistic
  94 connections is now:</P>
  95 <PRE>
  96 # description for opportunistic connections
  97 conn me-to-anyone
  98         left=%defaultroute         # all connections should use default route
  99         right=%opportunistic       # anyone we can authenticate
 100         leftrsasigkey=%dnsondemand  # NEW: look up keys in DNS as-needed
 101         rightrsasigkey=%dnsondemand # (not at connection load time)
 102         rekey=no                   # let unused connections die
 103         keylife=1h                 # short
 104         auto=route                 # set up for opportunistic</PRE>
 105
 106 <P>Note that <VAR>leftid=</VAR> has been removed. With no explicit setting,
 107 <VAR>leftid=</VAR> defaults to the IP of your public interface.</P>
 108
 109 <P><A href="quickstart.html#incoming.opp.conf">Continue configuring
 110 full opportunism.</A>
 111
 112
 113 <H2><A name="qc.gate.opp.conf">ipsec.conf for Opportunistic Gateway</A></H2>
 114 Use the ipsec.conf above, plus these connections:
 115
 116 <PRE>conn subnet-to-anyone            # must be above me-to-anyone
 117        also=me-to-anyone
 118        leftsubnet=42.42.42.0/24
 119
 120 conn me-to-anyone                # just like for full opportunism
 121         left=%defaultroute
 122         right=%opportunistic
 123         leftrsasigkey=%dnsondemand
 124         rightrsasigkey=%dnsondemand
 125         keylife=1h
 126         rekey=no
 127         auto=route               # be sure this is enabled
 128                                  # Note there is NO leftid= </PRE>
 129
 130
 131 <P>Note that a subnet described in ipsec.conf(5) need not correspond to a
 132  physical network segment. This is discussed in more detail in our
 133 <A href="adv_config.html">advanced configuration</A> document.</P>
 134
 135 <P>If required, a gateway can easily provide this service for more than one
 136  subnet. You just add a connection description for each.</P>
 137
 138 <P><A href="quickstart.html#config.opp.gate">Continue configuring an
 139 opportunistic gateway.</A>
 140
 141
 142 </BODY>
 143 </HTML>
 144