>> Edit article
이름
제목
패스워드
pc 가 한대 더 생겨서 한번 해봤습니다. 자세하게 설명을 하지는 않았습니다... 인터넷 뒤져보시면 자료가 많이 있을겁니다. 참고 하시구요. (IP 는 바꿨습니다.) |------| |------| |------| |------| | | ----------- | | ---------------------------------- | | --------------------- | | |------| |------| |------| |------| (210.100.102.14) (210.100.102.1:라우터) (210.100.101.1:라우터) (210.100.101.201) (192.168.1.1) (192.168.0.3) | | | | | | |-----| |------| | | | | | |-----| |------| (192.168.1.2) (192.168.0.4) 기본 구조는 위와 같습니다.(그림이 깨지는군요) <준비물> freeswan-1.95 or higher gcc or egcs glibc GMP(GNU MULTI PRECISION): Pluto 데몬의 공개키 계산에 필요. ncurses library (make menuconfig 할때 필요) kernel source kernel headers 1.커널을 다운받아서 컴파일,설치 합니다.(반드시 선행되어야 합니다. 새 커널을 다운받을 필요는 없으나, 커널 컴파일이 되어 있어야 하며 network options 부분도 적절히 설정되어 있어야 합니다. kernel/user netlink socket netlink device emulation 이 두부분은 반드시 설정하셔야 합니다.) 2.FreeS/WAN 을 다운받습니다. 3.압축을 풀고 FreeS/WAN 소스 디렉으로 이동하여 다음과 같이 합니다. (첫번째 방법) ---> make menugo (하시면 커널 설정화면이 나오는데,네트워크 옵션에 찾아보시면 ipsec 관련부분에 체크 되어 있는지 확인합니다. 이것은 커널에 FreeS/WAN 패치를 하고,make bzImage 까지 과정입니다.) 커널 이미지까지 만들었으면 다음으로. ---> make kinstall (make modules_install 까지의 과정입니다.) (두번째 방법) ---> make menumod (위의 make menugo 와 같습니다.) ---> make minstall (위의 make kinstall 과 같습니다만, 모듈로서 설치하는것입니다.물론 make kinstall 은 직접커널이겠지요.) (세번째 방법) make insert make programs make install (여기까지는 FreeS/WAN 소스디렉에서) cd ../linux-2.4.19 make menuconfig make dep;make clean;make bzImage make install make modules make modules_install 위의 어떤 방법이건 간에 패치한후에 커널 설정시, IPSEC OPTIONS 부분에 모두 체크 되어 있어야 합니다. 각 편한 방법으로 설치를 한후, lilo.conf 를 적절히 수정하고 재부팅합니다. 재부팅하는 과정에서 Starting ipsec [ok] 라고 보일겁니다. message 파일과 secure 파일의 로그도 살펴보세요. < ipsec에 필요한 네트워크 설정> ※각각의 게이트웨이 서버에서 TCP/IP 포워딩을 가능하게 1. vi /etc/sysctl.conf # 패킷 포워딩기능 활성화 net.ipv4.ip_forward = 1 /etc/rc.d/init.d/network restart ※ipsec 이 제대로 작동하려면 IP스푸핑 방지를 위한 rp_filter 기능을 꺼야 합니다. 2. echo 0 > /proc/sys/net/ipv4/conf/ipsec0/rp_filter echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter 참고로 저는 간단한 테스트를 위한 것이었기 때문에, 대충 /etc/rc.d/rc.local 파일에 echo 0 > /proc/sys/net/ipv4/conf/ipsec0/rp_filter echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE 로 설정을 했습니다만.... 별 문제는 없더군요.. <network to network 설정> --RSA 키를 이용한 설정-- 210.100.102.14 이나 101.* 나 상관없습니다. 아무 vpn 서버 하나를 잡고 다음과 같이 설정을 합니다. [root@wizard /tmp]# ipsec newhostkey --output /etc/ipsec.secrets (버전 1.95는 --output 이란 옵션이 없더군요. ipsec newhostkey > /etc/ipsec.secrets 로 하시면 될겁니다.) [root@wizard /tmp]# vi /etc/ipsec.secrets #pubkey=0sAQOdTJKI2sF3gdm2AgZ95i1eodi08krIvF30nfVr1NmCA3uhcM3BiLHOQl/6sK 0vBXVXbokftRXcfp0JeCcTFldOFIQyVW24xWn3OgAuQlcPtyh34pSoQD1ynqIgrwvUZTYNp0b+9hRqdv 0v3rus+4Q8PNZudqqJPakKL3t/36c+JQ== #IN KEY 0x4200 4 1 AQOdTJKI2sF3gdm2AgZ95i1eodi08krIvF30nfVr1NmCA3uhcM3Bi LHOQl/6sK0vBXVXbokftRXcfp0JeCcTFldOFIQyVW24xWn3OgAuQlcPtyh34pSoQD1ynqIgrwvUZTYNp 0b+9hRqdv0v3rus+4Q8PNZudqqJPakKL3t/36c+JQ== # (0x4200 = auth-only host-level, 4 = IPSec, 1 = RSA) 위에 #pubkey= 로 시작되는 곳이 공개키값입니다. 이 값을 ipsec.conf 파일에 넣으셔야 합니다. [root@wizard /tmp]# ipsec showhostkey --left >> /etc/ipsec.conf 하시면 될겁니다. 다음과 같을겁니다. [root@wizard /tmp]# vi /etc/ipsec.conf # /etc/ipsec.conf - FreeS/WAN IPsec configuration file # More elaborate and more varied sample configurations can be found # in FreeS/WAN's doc/examples file, and in the HTML documentation. # basic configuration config setup interfaces=%defaultroute klipsdebug=none plutodebug=none plutoload=%search plutostart=%search # sample VPN connection conn sample left=210.100.102.14 (eth0,ipsec0) leftsubnet=192.168.1.0/24 leftnexthop=210.100.102.1 (라우터) right=210.100.101.201 (eth0,ipsec0) rightsubnet=192.168.0.0/24 rightnexthop=210.100.101.1 (라우터) auto=start auth=esp authby=rsasig leftrsasigkey=0sAQOdTJKI2sF3gdm2AgZ95i1eodi08krIvF30nfVr1NmCA3uhcM3BiLHOQl/6sK 0vBXVXbokftRXcfp0JeCcTFldOFIQyVW24xWn3OgAuQlcPtyh34pSoQD1ynqIgrwvUZTYNp0b+9hRqdv 0v3rus+4Q8PNZudqqJPakKL3t/36c+JQ== 그런 다음 1. 위에서 작성한 ipsec.conf 파일을 210.100.101.201 vpn 서버로 복사합니다. 2. 210.100.101.201 의 vpn 서버에서는 ipsec.secrets 파일만 새로 생성해주면 됩니다. ipsec newhostkey --output /etc/ipsec.secrets(1.99버전) ipsec newhostkey > /etc/ipsec.secrets (1.95버전) 하면 됩니다. 3. ipsec showhostkey --right > /etc/ipsec.conf 하셔서 rightrsasigkey 값을 넣어줍니다. [root@18 /tmp]# vi /etc/ipsec.conf # /etc/ipsec.conf - FreeS/WAN IPsec configuration file # More elaborate and more varied sample configurations can be found # in FreeS/WAN's doc/examples file, and in the HTML documentation. # basic configuration config setup interfaces=%defaultroute klipsdebug=none plutodebug=none plutoload=%search plutostart=%search # sample VPN connection conn sample left=210.100.102.14 leftsubnet=192.168.1.0/24 leftnexthop=210.100.102.1 right=210.100.101.201 rightsubnet=192.168.0.0/24 rightnexthop=210.100.101.1 auto=start auth=esp authby=rsasig leftrsasigkey=0sAQOdTJKI2sF3gdm2AgZ95i1eodi08krIvF30nfVr1NmCA3uhcM3BiLHOQl/6sK 0vBXVXbokftRXcfp0JeCcTFldOFIQyVW24xWn3OgAuQlcPtyh34pSoQD1ynqIgrwvUZTYNp0b+9hRqdv 0v3rus+4Q8PNZudqqJPakKL3t/36c+JQ== rightrsasigkey=0sAQO0DhPMnLbfGHjEcoNHKg32NHrxzKgqFNe+hNZdLtWC5Fb566V+mZYR+e2nRQ HiPQO5agSnftfpJY41+47YEKHEwEmkkKtGHZDM1xpMTBInjYYfn9GA48iSRymxUVyX8oQVlUBczovZtw WzutNVxKOQ6pXMMttkTo/eOAHXUmr2eQ 그럼 위처럼 보일겁니다. 4. 이 파일을 다시 210.100.102.14 vpn 서버로 복사합니다. 기존의 것은 rightrsasigkey 값이 없기 때문이죠. 이렇게 되면 양 vpn 서버의 ipsec.conf 파일은 완전히 동일해집니다. 5. 이제 양 vpn 서버에서 ipsec 데몬을 띄워주기만 하면 됩니다. /etc/rc.d/init.d/ipsec start message 로그를 살펴보면 아래와 같이 나와야 합니다. Dec 9 15:51:55 wizard 12월 9 15:51:55 ipsec_setup: Starting FreeS/WAN IPsec 1.95... Dec 9 15:51:55 wizard ipsec_setup: KLIPS debug `none' Dec 9 15:51:55 wizard ipsec_setup: KLIPS ipsec0 on eth0 210.100.101.201/255.255.255.0 broadcast 210.100.101.255 Dec 9 15:51:55 wizard ipsec_setup: ...FreeS/WAN IPsec started Dec 9 15:51:56 wizard ipsec__plutorun: 104 "sample" #1: STATE_MAIN_I1: initiate Dec 9 15:51:56 wizard ipsec__plutorun: 106 "sample" #1: STATE_MAIN_I2: sent MI2, expecting MR2 Dec 9 15:51:56 wizard ipsec__plutorun: 108 "sample" #1: STATE_MAIN_I3: sent MI3, expecting MR3 Dec 9 15:51:56 wizard ipsec__plutorun: 004 "sample" #1: STATE_MAIN_I4: ISAKMP SA established Dec 9 15:51:56 wizard ipsec__plutorun: 112 "sample" #2: STATE_QUICK_I1: initiate Dec 9 15:51:56 wizard ipsec__plutorun: 004 "sample" #2: STATE_QUICK_I2: sent QI2, IPsec SA established secure 로그 Dec 9 15:51:55 wizard Pluto[1740]: Starting Pluto (FreeS/WAN Version 1.95) Dec 9 15:51:55 wizard Pluto[1740]: added connection description "sample" Dec 9 15:51:55 wizard Pluto[1740]: listening for IKE messages Dec 9 15:51:55 wizard Pluto[1740]: adding interface ipsec0/eth0 210.100.101.201 Dec 9 15:51:55 wizard Pluto[1740]: loading secrets from "/etc/ipsec.secrets" Dec 9 15:51:56 wizard Pluto[1740]: "sample" #1: initiating Main Mode Dec 9 15:51:56 wizard Pluto[1740]: "sample" #1: ISAKMP SA established Dec 9 15:51:56 wizard Pluto[1740]: "sample" #2: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+DISABLEARRIVALCHECK Dec 9 15:51:56 wizard Pluto[1740]: "sample" #2: sent QI2, IPsec SA established 6. 상호간에 ping 이 가는지 확인 [root@18 tmp]# ifconfig eth0 Link encap:Ethernet HWaddr 00:40:05:41:5B:E7 inet addr:192.168.0.4 Bcast:192.168.0.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:1273 errors:0 dropped:0 overruns:0 frame:0 TX packets:*33 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 Interrupt:11 Base address:0xfc00 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:11 errors:0 dropped:0 overruns:0 frame:0 TX packets:11 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 [root@18 tmp]# [root@18 tmp]# ping 192.168.1.2 PING 192.168.1.2 (192.168.1.2) from 192.168.0.4 : 56(84) bytes of data. 64 bytes from 192.168.1.2: icmp_seq=0 ttl=253 time=10.848 msec 64 bytes from 192.168.1.2: icmp_seq=1 ttl=253 time=9.085 msec 64 bytes from 192.168.1.2: icmp_seq=2 ttl=253 time=12.652 msec 64 bytes from 192.168.1.2: icmp_seq=3 ttl=253 time=8.510 msec 64 bytes from 192.168.1.2: icmp_seq=4 ttl=253 time=9.303 msec 64 bytes from 192.168.1.2: icmp_seq=5 ttl=253 time=13.094 msec 64 bytes from 192.168.1.2: icmp_seq=6 ttl=253 time=53.102 msec [root@wizard home]# ifconfig eth0 Link encap:Ethernet HWaddr 00:80:AD:8B:16:E5 inet addr:192.168.1.2 Bcast:192.168.1.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:1092056 errors:0 dropped:0 overruns:0 frame:0 TX packets:236880 errors:17 dropped:0 overruns:0 carrier:17 collisions:17050 txqueuelen:100 RX bytes:1179293193 (1124.6 Mb) TX bytes:16285303 (15.5 Mb) Interrupt:5 Base address:0x9000 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:61 errors:0 dropped:0 overruns:0 frame:0 TX packets:61 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:7567 (7.3 Kb) TX bytes:7567 (7.3 Kb) [root@wizard home]# [root@wizard home]# ping 192.168.0.4 PING 192.168.0.4 (192.168.0.4) from 192.168.1.2 : 56(84) bytes of data. 64 bytes from 192.168.0.4: icmp_seq=0 ttl=253 time=6.857 msec 64 bytes from 192.168.0.4: icmp_seq=1 ttl=253 time=8.335 msec 64 bytes from 192.168.0.4: icmp_seq=2 ttl=253 time=61.876 msec 64 bytes from 192.168.0.4: icmp_seq=3 ttl=253 time=7.355 msec 64 bytes from 192.168.0.4: icmp_seq=4 ttl=253 time=11.567 msec 64 bytes from 192.168.0.4: icmp_seq=5 ttl=253 time=12.989 msec 64 bytes from 192.168.0.4: icmp_seq=6 ttl=253 time=8.359 msec 64 bytes from 192.168.0.4: icmp_seq=7 ttl=253 time=7.387 msec 64 bytes from 192.168.0.4: icmp_seq=8 ttl=253 time=13.595 msec 64 bytes from 192.168.0.4: icmp_seq=9 ttl=253 time=8.736 msec 64 bytes from 192.168.0.4: icmp_seq=10 ttl=253 time=9.330 msec 64 bytes from 192.168.0.4: icmp_seq=11 ttl=253 time=7.318 msec --- 192.168.0.4 ping statistics --- 12 packets transmitted, 12 packets received, 0% packet loss round-trip min/avg/max/mdev = 6.857/13.642/61.876/*.704 ms [root@wizard home]# vpn서버뒤편의 클라이언트끼리 상호 접속 여부. [root@wizard home]# telnet 192.168.0.4 Trying 192.168.0.4... Connected to 192.168.0.4. Escape character is '^]'. Red Hat Linux release 7.1 (Seawolf) Kernel 2.4.2-2 on an i586 login: wizard Password: Last login: Mon Dec 9 16:54:57 from 192.168.1.2 [wizard@18 wizard]$ [root@18 tmp]# telnet 192.168.1.2 Trying 192.168.1.2... Connected to 192.168.1.2. Escape character is '^]'. Red Hat Linux Advanced Server release 2.1AS/i686 (Pensacola) login: sorcer Password: [sorcer@wizard sorcer]$ 디버깅 정보를 보면 [root@wizard home]# ipsec look 192.168.0.0/24 -> 192.168.1.0/24 => tun0x1002@210.100.102.201 esp0xe68c3947@210.100.102.201 (0) ipsec0->eth0 mtu=16260(1500)->1500 esp0x1b05eaf8@210.100.101.14 ESP_3DES_HMAC_MD5: dir=in src=210.100.102.201 iv_bits=64bits iv=0x317b708dfd4debaf ooowin=64 alen=128 aklen=128 eklen=192 life(c,s,h)=addtime(40,0,0) esp0xe68c3947@210.100.102.201 ESP_3DES_HMAC_MD5: dir=out src=210.100.101.14 iv_bits=64bits iv=0x739a6a540bccc356 ooowin=64 alen=128 aklen=128 eklen=192 life(c,s,h)=addtime(40,0,0) tun0x1001@210.100.101.14 IPIP: dir=in src=210.100.102.201 life(c,s,h)=addtime(40,0,0) tun0x1002@210.100.102.201 IPIP: dir=out src=210.100.101.14 life(c,s,h)=addtime(40,0,0) Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 210.100.101.1 0.0.0.0 UG 40 0 0 eth0 192.168.1.0 210.100.101.1 255.255.255.0 UG 40 0 0 ipsec0 210.100.101.0 0.0.0.0 255.255.255.0 U 40 0 0 eth0 210.100.101.0 0.0.0.0 255.255.255.0 U 40 0 0 ipsec0 모든 디버깅 정보를 보면 [root@wizard home]# ipsec barf + _________________________ version + ipsec --version Linux FreeS/WAN 1.95 See `ipsec --copyright' for copyright information. + _________________________ proc/version + cat /proc/version Linux version 2.4.19 (root@wizard.hehe.org) (gcc version 2.96 20000731 (Red Hat Linux 7.2 2.96-108.1)) #4 SMP 2002. 12. 09. (월) 14:13:50 KST + _________________________ proc/net/ipsec_eroute + sort +1 /proc/net/ipsec_eroute 0 192.168.0.0/24 -> 192.168.1.0/24 => tun0x1002@210.100.102.201 + _________________________ proc/net/ipsec_spi + cat /proc/net/ipsec_spi esp0x1b05eaf8@210.100.101.14 ESP_3DES_HMAC_MD5: dir=in src=210.100.102.201 iv_bits=64bits iv=0x317b708dfd4debaf ooowin=64 alen=128 aklen=128 eklen=192 life(c,s,h)=addtime(40,0,0) tun0x1002@210.100.102.201 IPIP: dir=out src=210.100.101.14 life(c,s,h)=addtime(40,0,0) esp0xe68c3947@210.100.102.201 ESP_3DES_HMAC_MD5: dir=out src=210.100.101.14 iv_bits=64bits iv=0x739a6a540bccc356 ooowin=64 alen=128 aklen=128 eklen=192 life(c,s,h)=addtime(40,0,0) tun0x1001@210.100.101.14 IPIP: dir=in src=210.100.102.201 life(c,s,h)=addtime(40,0,0) + _________________________ proc/net/ipsec_spigrp + cat /proc/net/ipsec_spigrp tun0x1002@210.100.102.201 esp0xe68c3947@210.100.102.201 tun0x1001@210.100.101.14 esp0x1b05eaf8@210.100.101.14 + _________________________ netstart-rn + netstat -nr Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 192.168.1.0 210.100.101.1 255.255.255.0 UG 40 0 0 ipsec0 192.168.0.0 0.0.0.0 255.255.255.0 U 40 0 0 eth1 210.100.101.0 0.0.0.0 255.255.255.0 U 40 0 0 eth0 210.100.101.0 0.0.0.0 255.255.255.0 U 40 0 0 ipsec0 127.0.0.0 0.0.0.0 255.0.0.0 U 40 0 0 lo 0.0.0.0 210.100.101.1 0.0.0.0 UG 40 0 0 eth0 + _________________________ proc/net/ipsec_tncfg + cat /proc/net/ipsec_tncfg ipsec0 -> eth0 mtu=16260(1500) -> 1500 ipsec1 -> NULL mtu=0(0) -> 0 ipsec2 -> NULL mtu=0(0) -> 0 ipsec3 -> NULL mtu=0(0) -> 0 + _________________________ proc/net/pf_key + cat /proc/net/pf_key sock pid socket next prev e n p sndbf Flags Type St d3fc0a00 673 d2d0e1c0 0 0 0 0 2 65535 00000000 3 1 + _________________________ proc/net/pf_key-star + cd /proc/net + egrep '^' pf_key_registered pf_key_supported pf_key_registered:satype socket pid sk pf_key_registered: 2 d2d0e1c0 673 d3fc0a00 pf_key_registered: 3 d2d0e1c0 673 d3fc0a00 pf_key_registered: 9 d2d0e1c0 673 d3fc0a00 pf_key_registered: 10 d2d0e1c0 673 d3fc0a00 pf_key_supported:satype exttype alg_id ivlen minbits maxbits pf_key_supported: 2 14 3 0 160 160 pf_key_supported: 2 14 2 0 128 128 pf_key_supported: 3 15 3 128 168 168 pf_key_supported: 3 14 3 0 160 160 pf_key_supported: 3 14 2 0 128 128 pf_key_supported: 9 15 1 0 32 32 pf_key_supported: 10 15 2 0 1 1 + _________________________ proc/sys/net/ipsec-star + cd /proc/sys/net/ipsec + egrep '^' debug_ah debug_eroute debug_esp debug_ipcomp debug_netlink debug_pfkey debug_radij debug_rcv debug_spi debug_tunnel debug_verbose debug_xform icmp inbound_policy_check tos debug_ah:0 debug_eroute:0 debug_esp:0 debug_ipcomp:0 debug_netlink:0 debug_pfkey:0 debug_radij:0 debug_rcv:0 debug_spi:0 debug_tunnel:0 debug_verbose:0 debug_xform:0 icmp:1 inbound_policy_check:1 tos:1 + _________________________ ipsec/status + ipsec auto --status 000 interface ipsec0/eth0 210.100.101.14 000 000 "sample": 192.168.0.0/24===210.100.101.14---210.100.101.1...210.100.102.1---210.100.102.201===192.168.1.0/24 000 "sample": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3 000 "sample": policy: RSASIG+ENCRYPT+TUNNEL+PFS+DISABLEARRIVALCHECK; interface: eth0; erouted 000 "sample": newest ISAKMP SA: #1; newest IPsec SA: #2; eroute owner: #2 000 000 #2: "sample" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 27650s; newest IPSEC; eroute owner 000 #2: "sample" esp.e68c3947@210.100.102.201 esp.1b05eaf8@210.100.101.14 tun.1002@210.100.102.201 tun.1001@210.100.101.14 000 #1: "sample" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2453s; newest ISAKMP + _________________________ ifconfig-a + ifconfig -a eth0 Link encap:Ethernet HWaddr 00:40:05:42:D7:BE inet addr:210.100.101.14 Bcast:210.100.101.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:479 errors:1 dropped:0 overruns:0 frame:0 TX packets:20 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:439988 (429.6 Kb) TX bytes:2100 (2.0 Kb) Interrupt:12 Base address:0xe400 eth1 Link encap:Ethernet HWaddr 00:40:05:42:C5:B5 inet addr:192.168.0.3 Bcast:192.168.0.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:1 dropped:0 overruns:0 frame:0 TX packets:1 errors:3 dropped:0 overruns:0 carrier:3 collisions:0 txqueuelen:100 RX bytes:0 (0.0 b) TX bytes:42 (42.0 b) Interrupt:11 Base address:0xe800 ipsec0 Link encap:Ethernet HWaddr 00:40:05:42:D7:BE inet addr:210.100.101.14 Mask:255.255.255.0 UP RUNNING NOARP MTU:16260 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) ipsec1 Link encap:IPIP Tunnel HWaddr NOARP MTU:0 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) ipsec2 Link encap:IPIP Tunnel HWaddr NOARP MTU:0 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) ipsec3 Link encap:IPIP Tunnel HWaddr NOARP MTU:0 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) tunl0 Link encap:IPIP Tunnel HWaddr NOARP MTU:1480 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) + _________________________ ipsec/directory + ipsec --directory /usr/local/lib/ipsec + _________________________ hostname/fqdn + hostname --fqdn wizard.hehe.org + _________________________ hostname/ipaddress + hostname --ip-address 210.100.101.14 + _________________________ uptime + uptime 12:41pm up 2 min, 1 user, load average: 0.06, 0.07, 0.02 + _________________________ ps + ps alxw + egrep -i 'ppid|pluto|ipsec|klips' F UID PID PPID PRI NI VSZ RSS WCHAN STAT TTY TIME COMMAND 040 0 666 1 9 0 1996 920 wait4 S ? 0:00 /bin/sh /usr/local/lib/ipsec/_plutorun --debug none --uniqueids 000 0 667 1 9 0 1396 500 pipe_w S ? 0:00 logger -p daemon.error -t ipsec__plutorun 040 0 668 666 9 0 1996 920 wait4 S ? 0:00 /bin/sh /usr/local/lib/ipsec/_plutorun --debug none --uniqueids 000 0 669 666 8 0 1984 904 pipe_w S ? 0:00 /bin/sh /usr/local/lib/ipsec/_plutoload --load %search --start 100 0 673 668 8 0 1984 884 do_sel S ? 0:00 /usr/local/lib/ipsec/pluto --nofork --debug-none 000 0 1021 942 9 0 2972 1036 wait4 S tty1 0:00 /bin/sh /usr/local/sbin/ipsec barf 000 0 1022 1021 16 0 2992 1080 wait4 S tty1 0:00 /bin/sh /usr/local/lib/ipsec/barf 040 0 1062 1022 16 0 2992 1080 - R tty1 0:00 /bin/sh /usr/local/lib/ipsec/barf + _________________________ ipsec/showdefaults + ipsec showdefaults routephys=eth0 routephys=eth0 routevirt=ipsec0 routevirt=ipsec0 routeaddr=210.100.101.14 routeaddr=210.100.101.14 routenexthop=210.100.101.1 routenexthop=210.100.101.1 defaultroutephys=eth0 defaultroutevirt=ipsec0 defaultrouteaddr=210.100.101.14 defaultroutenexthop=210.100.101.1 + _________________________ ipsec/conf + ipsec _include /etc/ipsec.conf + ipsec _keycensor #< /etc/ipsec.conf 1 # /etc/ipsec.conf - FreeS/WAN IPsec configuration file # More elaborate and more varied sample configurations can be found # in FreeS/WAN's doc/examples file, and in the HTML documentation. # basic configuration config setup interfaces=%defaultroute klipsdebug=none plutodebug=none plutoload=%search plutostart=%search # sample VPN connection conn sample left=210.100.102.201 leftsubnet=192.168.1.0/24 leftnexthop=210.100.102.1 right=210.100.101.14 rightsubnet=192.168.0.0/24 rightnexthop=210.100.101.1 auto=start auth=esp authby=rsasig leftrsasigkey=[sums to 0cf2...] # RSA 2048 bits wizard.hehe.org Mon Dec 9 14:25:22 2002 rightrsasigkey=[sums to 4391...] + _________________________ ipsec/secrets + ipsec _include /etc/ipsec.secrets + ipsec _secretcensor #< /etc/ipsec.secrets 1 : RSA { # RSA 2048 bits wizard.hehe.org Mon Dec 9 14:25:22 2002 # for signatures only, UNSAFE FOR ENCRYPTION #pubkey=[sums to 4391...] #IN KEY 0x4200 4 1 [sums to 95aa...] # (0x4200 = auth-only host-level, 4 = IPSec, 1 = RSA) Modulus: [...] PublicExponent: [...] # everything after this point is secret PrivateExponent: [...] Prime1: [...] Prime2: [...] Exponent1: [...] Exponent2: [...] Coefficient: [...] } # do not change the indenting of that "[sums to 7d9d...]" + _________________________ ipsec/ls-dir + ls -l /usr/local/lib/ipsec total 2252 -rwxr-xr-x 1 root root 11064 Dec 9 13:50 _confread -rwxr-xr-x 1 root root 46501 Dec 9 13:50 _copyright -rwxr-xr-x 1 root root 2163 Dec 9 13:50 _include -rwxr-xr-x 1 root root 1383 Dec 9 13:50 _keycensor -rwxr-xr-x 1 root root 3495 Dec 9 13:50 _plutoload -rwxr-xr-x 1 root root 3622 Dec 9 13:50 _plutorun -rwxr-xr-x 1 root root 7272 Dec 9 13:50 _realsetup -rwxr-xr-x 1 root root 1904 Dec 9 13:50 _secretcensor -rwxr-xr-x 1 root root 6076 Dec 9 13:50 _startklips -rwxr-xr-x 1 root root 5262 Dec 9 13:50 _updown -rwxr-xr-x 1 root root 10839 Dec 9 13:50 auto -rwxr-xr-x 1 root root 6436 Dec 9 13:50 barf -rwxr-xr-x 1 root root 222435 Dec 9 13:49 eroute -rwxr-xr-x 1 root root 2829 Dec 9 13:50 ipsec -rw-r--r-- 1 root root 1950 Dec 9 13:50 ipsec_pr.template -rwxr-xr-x 1 root root 161674 Dec 9 13:49 klipsdebug -rwxr-xr-x 1 root root 2437 Dec 9 13:50 look -rwxr-xr-x 1 root root 16172 Dec 9 13:50 manual -rwxr-xr-x 1 root root 1227 Dec 9 13:50 newhostkey -rwxr-xr-x 1 root root 135346 Dec 9 13:49 pf_key -rwxr-xr-x 1 root root 767643 Dec 9 13:50 pluto -rwxr-xr-x 1 root root 52682 Dec 9 13:50 ranbits -rwxr-xr-x 1 root root 74090 Dec 9 13:50 rsasigkey -rwxr-xr-x 1 root root 16671 Dec 9 13:50 send-pr lrwxrwxrwx 1 root root 22 Dec 9 13:50 setup -> /etc/rc.d/init.d/ipsec -rwxr-xr-x 1 root root 1041 Dec 9 13:50 showdefaults -rwxr-xr-x 1 root root 3484 Dec 9 13:50 showhostkey -rwxr-xr-x 1 root root 245541 Dec 9 13:49 spi -rwxr-xr-x 1 root root 199997 Dec 9 13:49 spigrp -rwxr-xr-x 1 root root 68605 Dec 9 13:49 tncfg -rwxr-xr-x 1 root root 130611 Dec 9 13:50 whack + _________________________ ipsec/updowns ++ ls /usr/local/lib/ipsec ++ egrep updown + cat /usr/local/lib/ipsec/_updown 쭈욱~~~~~~~ 나옵니다. * www.freeswan.org 의 문서와 ipsec 맨페이지를 꼭 읽어보십시오.
Copyleft
1999-2026 by
JSBoard Open Project
Theme Designed by
IDOO
All right reserved