 |
|
|
|
|
>> Read No. 3142 article |
|
|
리넉에서 FreeS/WAN 이용한 VPN 게이트웨이서버.
|
 |
|
|
|
등록 2002-12-10 19:19:00
조회 6
이름 Wizard
|
|
|
pc 가 한대 더 생겨서 한번 해봤습니다.
자세하게 설명을 하지는 않았습니다...
인터넷 뒤져보시면 자료가 많이 있을겁니다. 참고 하시구요.
(IP 는 바꿨습니다.)
|------| |------| |------|
|------| | | ----------- | | ---------------------------------- | | -----------------
---- | | |------| |------| |------|
|------| (210.100.102.14) (210.100.102.1:라우터) (210.1
00.101.1:라우터) (210.100.101.201) (192.168.1.1)
(192.168.0.3) |
| |
| |
| |-----|
|------| | |
| |
| |-----|
|------| (192.168.1.2)
(192.168.
0.4) 기본 구조는 위와 같습니다.(그림이 깨지는군요) <준비물> freeswan-1.95 or highe
r gcc or egcs glibc GMP(GNU MULTI PRECISION): Pluto 데몬의 공개키 계산에 필요.
ncurses library (make menuconfig 할때 필요)
kernel source
kernel headers
1.커널을 다운받아서 컴파일,설치 합니다.(반드시 선행되어야 합니다. 새 커널을 다운받을
필요는 없으나, 커널 컴파일이 되어 있어야 하며 network options 부분도 적절히 설정되어 있
어야 합니다. kernel/user netlink socket netlink device emulation
이 두부분은 반드시 설정하셔야 합니다.)
2.FreeS/WAN 을 다운받습니다.
3.압축을 풀고 FreeS/WAN 소스 디렉으로 이동하여 다음과 같이 합니다.
(첫번째 방법)
---> make menugo
(하시면 커널 설정화면이 나오는데,네트워크 옵션에 찾아보시면 ipsec 관련부분에
체크 되어 있는지 확인합니다.
이것은 커널에 FreeS/WAN 패치를 하고,make bzImage 까지 과정입니다.)
커널 이미지까지 만들었으면 다음으로.
---> make kinstall
(make modules_install 까지의 과정입니다.)
(두번째 방법)
---> make menumod (위의 make menugo 와 같습니다.)
---> make minstall (위의 make kinstall 과 같습니다만, 모듈로서 설치하는것입니다.물론
make kinstall 은 직접커널이겠지요.)
(세번째 방법)
make insert
make programs
make install (여기까지는 FreeS/WAN 소스디렉에서)
cd ../linux-2.4.19
make menuconfig
make dep;make clean;make bzImage
make install
make modules
make modules_install
위의 어떤 방법이건 간에 패치한후에 커널 설정시, IPSEC OPTIONS 부분에 모두
체크 되어 있어야 합니다.
각 편한 방법으로 설치를 한후, lilo.conf 를 적절히 수정하고 재부팅합니다.
재부팅하는 과정에서
Starting ipsec [ok]
라고 보일겁니다.
message 파일과 secure 파일의 로그도 살펴보세요.
< ipsec에 필요한 네트워크 설정>
※각각의 게이트웨이 서버에서 TCP/IP 포워딩을 가능하게
1.
vi /etc/sysctl.conf
# 패킷 포워딩기능 활성화
net.ipv4.ip_forward = 1
/etc/rc.d/init.d/network restart
※ipsec 이 제대로 작동하려면 IP스푸핑 방지를 위한 rp_filter 기능을 꺼야 합니다.
2.
echo 0 > /proc/sys/net/ipv4/conf/ipsec0/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter
참고로 저는 간단한 테스트를 위한 것이었기 때문에, 대충
/etc/rc.d/rc.local 파일에
echo 0 > /proc/sys/net/ipv4/conf/ipsec0/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
로 설정을 했습니다만....
별 문제는 없더군요..
<network to network 설정>
--RSA 키를 이용한 설정--
210.100.102.14 이나 101.* 나 상관없습니다. 아무 vpn 서버 하나를 잡고
다음과 같이 설정을 합니다.
[root@wizard /tmp]# ipsec newhostkey --output /etc/ipsec.secrets
(버전 1.95는 --output 이란 옵션이 없더군요.
ipsec newhostkey > /etc/ipsec.secrets 로 하시면 될겁니다.)
[root@wizard /tmp]# vi /etc/ipsec.secrets
#pubkey=0sAQOdTJKI2sF3gdm2AgZ95i1eodi08krIvF30nfVr1NmCA3uhcM3BiLHOQl/6sK
0vBXVXbokftRXcfp0JeCcTFldOFIQyVW24xWn3OgAuQlcPtyh34pSoQD1ynqIgrwvUZTYNp0b+9hRqdv
0v3rus+4Q8PNZudqqJPakKL3t/36c+JQ==
#IN KEY 0x4200 4 1 AQOdTJKI2sF3gdm2AgZ95i1eodi08krIvF30nfVr1NmCA3uhcM3Bi
LHOQl/6sK0vBXVXbokftRXcfp0JeCcTFldOFIQyVW24xWn3OgAuQlcPtyh34pSoQD1ynqIgrwvUZTYNp
0b+9hRqdv0v3rus+4Q8PNZudqqJPakKL3t/36c+JQ==
# (0x4200 = auth-only host-level, 4 = IPSec, 1 = RSA)
위에 #pubkey= 로 시작되는 곳이 공개키값입니다.
이 값을 ipsec.conf 파일에 넣으셔야 합니다.
[root@wizard /tmp]# ipsec showhostkey --left >> /etc/ipsec.conf
하시면 될겁니다.
다음과 같을겁니다.
[root@wizard /tmp]# vi /etc/ipsec.conf
# /etc/ipsec.conf - FreeS/WAN IPsec configuration file
# More elaborate and more varied sample configurations can be found
# in FreeS/WAN's doc/examples file, and in the HTML documentation.
# basic configuration
config setup
interfaces=%defaultroute
klipsdebug=none
plutodebug=none
plutoload=%search
plutostart=%search
# sample VPN connection
conn sample
left=210.100.102.14 (eth0,ipsec0)
leftsubnet=192.168.1.0/24
leftnexthop=210.100.102.1 (라우터)
right=210.100.101.201 (eth0,ipsec0)
rightsubnet=192.168. /24
rightnexthop=210.100.101.1 (라우터)
auto=start
auth=esp
authby=rsasig
leftrsasigkey=0sAQOdTJKI2sF3gdm2AgZ95i1eodi08krIvF30nfVr1NmCA3uhcM3BiLHOQl/6sK
0vBXVXbokftRXcfp0JeCcTFldOFIQyVW24xWn3OgAuQlcPtyh34pSoQD1ynqIgrwvUZTYNp0b+9hRqdv
0v3rus+4Q8PNZudqqJPakKL3t/36c+JQ==
그런 다음
1.
위에서 작성한 ipsec.conf 파일을 210.100.101.201 vpn 서버로 복사합니다.
2.
210.100.101.201 의 vpn 서버에서는 ipsec.secrets 파일만 새로 생성해주면 됩니다.
ipsec newhostkey --output /etc/ipsec.secrets(1.99버전)
ipsec newhostkey > /etc/ipsec.secrets (1.95버전) 하면 됩니다.
3.
ipsec showhostkey --right > /etc/ipsec.conf
하셔서 rightrsasigkey 값을 넣어줍니다.
[root@18 /tmp]# vi /etc/ipsec.conf
# /etc/ipsec.conf - FreeS/WAN IPsec configuration file
# More elaborate and more varied sample configurations can be found
# in FreeS/WAN's doc/examples file, and in the HTML documentation.
# basic configuration
config setup
interfaces=%defaultroute
klipsdebug=none
plutodebug=none
plutoload=%search
plutostart=%search
# sample VPN connection
conn sample
left=210.100.102.14
leftsubnet=192.168.1.0/24
leftnexthop=210.100.102.1
right=210.100.101.201
rightsubnet=192.168./24
rightnexthop=210.100.101.1
auto=start
auth=esp
authby=rsasig
leftrsasigkey=0sAQOdTJKI2sF3gdm2AgZ95i1eodi08krIvF30nfVr1NmCA3uhcM3BiLHOQl/6sK
0vBXVXbokftRXcfp0JeCcTFldOFIQyVW24xWn3OgAuQlcPtyh34pSoQD1ynqIgrwvUZTYNp0b+9hRqdv
0v3rus+4Q8PNZudqqJPakKL3t/36c+JQ==
rightrsasigkey=0sAQO0DhPMnLbfGHjEcoNHKg32NHrxzKgqFNe+hNZdLtWC5Fb566V+mZYR+e2nRQ
HiPQO5agSnftfpJY41+47YEKHEwEmkkKtGHZDM1xpMTBInjYYfn9GA48iSRymxUVyX8oQVlUBczovZtw
WzutNVxKOQ6pXMMttkTo/eOAHXUmr2eQ
그럼 위처럼 보일겁니다.
4.
이 파일을 다시 210.100.102.14 vpn 서버로 복사합니다. 기존의 것은 rightrsasigkey 값이 없기 때문
이죠. 이렇게 되면 양 vpn 서버의 ipsec.conf 파일은 완전히 동일해집니다.
5.
이제 양 vpn 서버에서 ipsec 데몬을 띄워주기만 하면 됩니다.
/etc/rc.d/init.d/ipsec start
message 로그를 살펴보면 아래와 같이 나와야 합니다.
Dec 9 15:51:55 wizard 12월 9 15:51:55 ipsec_setup: Starting FreeS/WAN IPsec 1.95...
Dec 9 15:51:55 wizard ipsec_setup: KLIPS debug `none'
Dec 9 15:51:55 wizard ipsec_setup: KLIPS ipsec0 on eth0 210.100.101.201/255.255.255.0 broadcast 210.100.101.255
Dec 9 15:51:55 wizard ipsec_setup: ...FreeS/WAN IPsec started
Dec 9 15:51:56 wizard ipsec__plutorun: 104 "sample" #1: STATE_MAIN_I1: initiate
Dec 9 15:51:56 wizard ipsec__plutorun: 106 "sample" #1: STATE_MAIN_I2: sent MI2, expecting MR2
Dec 9 15:51:56 wizard ipsec__plutorun: 108 "sample" #1: STATE_MAIN_I3: sent MI3, expecting MR3
Dec 9 15:51:56 wizard ipsec__plutorun: 004 "sample" #1: STATE_MAIN_I4: ISAKMP SA established
Dec 9 15:51:56 wizard ipsec__plutorun: 112 "sample" #2: STATE_QUICK_I1: initiate
Dec 9 15:51:56 wizard ipsec__plutorun: 004 "sample" #2: STATE_QUICK_I2: sent QI2, IPsec SA established
secure 로그
Dec 9 15:51:55 wizard Pluto[1740]: Starting Pluto (FreeS/WAN Version 1.95)
Dec 9 15:51:55 wizard Pluto[1740]: added connection description "sample"
Dec 9 15:51:55 wizard Pluto[1740]: listening for IKE messages
Dec 9 15:51:55 wizard Pluto[1740]: adding interface ipsec0/eth0 210.100.101.201
Dec 9 15:51:55 wizard Pluto[1740]: loading secrets from "/etc/ipsec.secrets"
Dec 9 15:51:56 wizard Pluto[1740]: "sample" #1: initiating Main Mode
Dec 9 15:51:56 wizard Pluto[1740]: "sample" #1: ISAKMP SA established
Dec 9 15:51:56 wizard Pluto[1740]: "sample" #2: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+DISABLEARRIVALCHECK
Dec 9 15:51:56 wizard Pluto[1740]: "sample" #2: sent QI2, IPsec SA established
6.
상호간에 ping 이 가는지 확인
[root@18 tmp]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:40:05:41:5B:E7
inet addr:192.168.0.4 Bcast:192.168.0.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1273 errors:0 dropped:0 overruns:0 frame:0
TX packets:*33 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
Interrupt:11 Base address:0xfc00
lo Link encap:Local Loopback
inet addr:127..1 Mask:255..0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:11 errors:0 dropped:0 overruns:0 frame:0
TX packets:11 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
[root@18 tmp]#
[root@18 tmp]# ping 192.168.1.2
PING 192.168.1.2 (192.168.1.2) from 192.168.0.4 : 56(84) bytes of data.
64 bytes from 192.168.1.2: icmp_seq=0 ttl=253 time=10.848 msec
64 bytes from 192.168.1.2: icmp_seq=1 ttl=253 time=9.085 msec
64 bytes from 192.168.1.2: icmp_seq=2 ttl=253 time=12.652 msec
64 bytes from 192.168.1.2: icmp_seq=3 ttl=253 time=8.510 msec
64 bytes from 192.168.1.2: icmp_seq=4 ttl=253 time=9.303 msec
64 bytes from 192.168.1.2: icmp_seq=5 ttl=253 time=13.094 msec
64 bytes from 192.168.1.2: icmp_seq=6 ttl=253 time=53.102 msec
[root@wizard home]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:80:AD:8B:16:E5
inet addr:192.168.1.2 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1092056 errors:0 dropped:0 overruns:0 frame:0
TX packets:236880 errors:17 dropped:0 overruns:0 carrier:17
collisions:17050 txqueuelen:100
RX bytes:1179293193 (1124.6 Mb) TX bytes:16285303 (15.5 Mb)
Interrupt:5 Base address:0x9000
lo Link encap:Local Loopback
inet addr:127..1 Mask:255..0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:61 errors:0 dropped:0 overruns:0 frame:0
TX packets:61 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:7567 (7.3 Kb) TX bytes:7567 (7.3 Kb)
[root@wizard home]#
[root@wizard home]# ping 192.168.0.4
PING 192.168.0.4 (192.168.0.4) from 192.168.1.2 : 56(84) bytes of data.
64 bytes from 192.168.0.4: icmp_seq=0 ttl=253 time=6.857 msec
64 bytes from 192.168.0.4: icmp_seq=1 ttl=253 time=8.335 msec
64 bytes from 192.168.0.4: icmp_seq=2 ttl=253 time=61.876 msec
64 bytes from 192.168.0.4: icmp_seq=3 ttl=253 time=7.355 msec
64 bytes from 192.168.0.4: icmp_seq=4 ttl=253 time=11.567 msec
64 bytes from 192.168.0.4: icmp_seq=5 ttl=253 time=12.989 msec
64 bytes from 192.168.0.4: icmp_seq=6 ttl=253 time=8.359 msec
64 bytes from 192.168.0.4: icmp_seq=7 ttl=253 time=7.387 msec
64 bytes from 192.168.0.4: icmp_seq=8 ttl=253 time=13.595 msec
64 bytes from 192.168.0.4: icmp_seq=9 ttl=253 time=8.736 msec
64 bytes from 192.168.0.4: icmp_seq=10 ttl=253 time=9.330 msec
64 bytes from 192.168.0.4: icmp_seq=11 ttl=253 time=7.318 msec
--- 192.168.0.4 ping statistics ---
12 packets transmitted, 12 packets received, 0% packet loss
round-trip min/avg/max/mdev = 6.857/13.642/61.876/*.704 ms
[root@wizard home]#
vpn서버뒤편의 클라이언트끼리 상호 접속 여부.
[root@wizard home]# telnet 192.168.0.4
Trying 192.168.0.4...
Connected to 192.168.0.4.
Escape character is '^]'.
Red Hat Linux release 7.1 (Seawolf)
Kernel 2.4.2-2 on an i586
login: wizard
Password:
Last login: Mon Dec 9 16:54:57 from 192.168.1.2
[wizard@18 wizard]$
[root@18 tmp]# telnet 192.168.1.2
Trying 192.168.1.2...
Connected to 192.168.1.2.
Escape character is '^]'.
Red Hat Linux Advanced Server release 2.1AS/i686 (Pensacola)
login: sorcer
Password:
[sorcer@wizard sorcer]$
디버깅 정보를 보면
[root@wizard home]# ipsec look
192.168./24 -> 192.168.1.0/24 => tun0x1002@210.100.102.201 esp0xe68c3947@210.100.102.201 (0)
ipsec0->eth0 mtu=16260(1500)->1500
esp0x1b05eaf8@210.100.101.14 ESP_3DES_HMAC_MD5: dir=in src=210.100.102.201 iv_bits=64bits iv=0x317b708dfd4debaf ooowin
=64 alen=128 aklen=128 eklen=192 life(c,s,h)=addtime(40,0,0) esp0xe68c3947@210.100.102.201 ESP_3DES_HMAC_MD5: dir=out sr
c=210.100.101.14 iv_bits=64bits iv=0x739a6a540bccc356 ooowin=64 alen=128 aklen=128 eklen=192 life(c,s,h)=addtime(40,0,0)
tun0x1001@210.100.101.14 IPIP: dir=in src=210.100.102.201 life(c,s,h)=addtime(40,0,0) tun0x1002@210.100.102.201 IPIP:
dir=out src=210.100.101.14 life(c,s,h)=addtime(40,0,0) Destination Gateway Genmask Flags
MSS Window irtt Iface .0.0 210.100.101.1 .0.0 UG 40 0 0
eth0 192.168.1.0 210.100.101.1 255.255.255.0 UG 40 0 0 ipsec0
210.100.101.0 .0.0 255.255.255.0 U 40 0 0 eth0
210.100.101.0 .0.0 255.255.255.0 U 40 0 0 ipsec0
모든 디버깅 정보를 보면
[root@wizard home]# ipsec barf
+ _________________________ version
+ ipsec --version
Linux FreeS/WAN 1.95
See `ipsec --copyright' for copyright information.
+ _________________________ proc/version
+ cat /proc/version
Linux version 2.4.19 (root at wizard.hehe.org) (gcc version 2.96 20000731 (Red Hat Linux 7.2 2.96-108.1)) #4 SMP 2002. 12.
09. (월) 14:13:50 KST + _________________________ proc/net/ipsec_eroute
+ sort +1 /proc/net/ipsec_eroute
0 192.168./24 -> 192.168.1.0/24 => tun0x1002@210.100.102.201 + _________________________ pr
oc/net/ipsec_spi + cat /proc/net/ipsec_spi
esp0x1b05eaf8@210.100.101.14 ESP_3DES_HMAC_MD5: dir=in src=210.100.102.201 iv_bits=64bits iv=0x317b708dfd4debaf ooowin
=64 alen=128 aklen=128 eklen=192 life(c,s,h)=addtime(40,0,0) tun0x1002@210.100.102.201 IPIP: dir=out src=210.100.101.14
life(c,s,h)=addtime(40,0,0) esp0xe68c3947@210.100.102.201 ESP_3DES_HMAC_MD5: dir=out src=210.100.101.14 iv_bits=64bits i
v=0x739a6a540bccc356 ooowin=64 alen=128 aklen=128 eklen=192 life(c,s,h)=addtime(40,0,0) tun0x1001@210.100.101.14 IPIP: d
ir=in src=210.100.102.201 life(c,s,h)=addtime(40,0,0) + _________________________ proc/net/ipsec_spigrp
+ cat /proc/net/ipsec_spigrp
tun0x1002@210.100.102.201 esp0xe68c3947@210.100.102.201 tun0x1001@210.100.101.14 esp0x1b05eaf8@210.100.101.14 + ________
_________________ netstart-rn + netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
192.168.1.0 210.100.101.1 255.255.255.0 UG 40 0 0 ipsec0
192.168. .0.0 255.255.255.0 U 40 0 0 eth1
210.100.101.0 .0.0 255.255.255.0 U 40 0 0 eth0
210.100.101.0 .0.0 255.255.255.0 U 40 0 0 ipsec0
127..0 .0.0 255..0 U 40 0 0 lo
.0.0 210.100.101.1 .0.0 UG 40 0 0 eth0
+ _________________________ proc/net/ipsec_tncfg
+ cat /proc/net/ipsec_tncfg
ipsec0 -> eth0 mtu=16260(1500) -> 1500
ipsec1 -> NULL mtu=0(0) -> 0
ipsec2 -> NULL mtu=0(0) -> 0
ipsec3 -> NULL mtu=0(0) -> 0
+ _________________________ proc/net/pf_key
+ cat /proc/net/pf_key
sock pid socket next prev e n p sndbf Flags Type St
d3fc0a00 673 d2d0e1c0 0 0 0 0 2 65535 00000000 3 1
+ _________________________ proc/net/pf_key-star
+ cd /proc/net
+ egrep '^' pf_key_registered pf_key_supported
pf_key_registered:satype socket pid sk
pf_key_registered: 2 d2d0e1c0 673 d3fc0a00
pf_key_registered: 3 d2d0e1c0 673 d3fc0a00
pf_key_registered: 9 d2d0e1c0 673 d3fc0a00
pf_key_registered: 10 d2d0e1c0 673 d3fc0a00
pf_key_supported:satype exttype alg_id ivlen minbits maxbits
pf_key_supported: 2 14 3 0 160 160
pf_key_supported: 2 14 2 0 128 128
pf_key_supported: 3 15 3 128 168 168
pf_key_supported: 3 14 3 0 160 160
pf_key_supported: 3 14 2 0 128 128
pf_key_supported: 9 15 1 0 32 32
pf_key_supported: 10 15 2 0 1 1
+ _________________________ proc/sys/net/ipsec-star
+ cd /proc/sys/net/ipsec
+ egrep '^' debug_ah debug_eroute debug_esp debug_ipcomp debug_netlink debug_pfkey debug_radij debug_rcv debug_spi debug
_tunnel debug_verbose debug_xform icmp inbound_policy_check tos debug_ah:0
debug_eroute:0
debug_esp:0
debug_ipcomp:0
debug_netlink:0
debug_pfkey:0
debug_radij:0
debug_rcv:0
debug_spi:0
debug_tunnel:0
debug_verbose:0
debug_xform:0
icmp:1
inbound_policy_check:1
tos:1
+ _________________________ ipsec/status
+ ipsec auto --status
000 interface ipsec0/eth0 210.100.101.14
000
000 "sample": 192.168./24===210.100.101.14---210.100.101.1...210.100.102.1---210.100.102.201===192.168.1.0/24
000 "sample": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3
000 "sample": policy: RSASIG+ENCRYPT+TUNNEL+PFS+DISABLEARRIVALCHECK; interface: eth0; erouted
000 "sample": newest ISAKMP SA:#1; newest IPsec SA:#2; eroute owner: #2
000
000 #2: "sample" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 27650s; newest IPSEC; eroute owner
000 #2: "sample" esp.e68c3947@210.100.102.201 esp.1b05eaf8@210.100.101.14 tun.1002@210.100.102.201 tun.1001@210.100.101.
14 000 #1: "sample" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2453s; newest ISAKMP + __________________
_______ ifconfig-a + ifconfig -a
eth0 Link encap:Ethernet HWaddr 00:40:05:42:D7:BE
inet addr:210.100.101.14 Bcast:210.100.101.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:479 errors:1 dropped:0 overruns:0 frame:0
TX packets:20 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:439988 (429.6 Kb) TX bytes:2100 (2.0 Kb)
Interrupt:12 Base address:0xe400
eth1 Link encap:Ethernet HWaddr 00:40:05:42:C5:B5
inet addr:192.168.0.3 Bcast:192.168.0.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:1 dropped:0 overruns:0 frame:0
TX packets:1 errors:3 dropped:0 overruns:0 carrier:3
collisions:0 txqueuelen:100
RX bytes:0 ( b) TX bytes:42 (42.0 b)
Interrupt:11 Base address:0xe800
ipsec0 Link encap:Ethernet HWaddr 00:40:05:42:D7:BE
inet addr:210.100.101.14 Mask:255.255.255.0
UP RUNNING NOARP MTU:16260 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:10
RX bytes:0 ( b) TX bytes:0 ( b)
ipsec1 Link encap:IPIP Tunnel HWaddr
NOARP MTU:0 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:10
RX bytes:0 ( b) TX bytes:0 ( b)
ipsec2 Link encap:IPIP Tunnel HWaddr
NOARP MTU:0 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:10
RX bytes:0 ( b) TX bytes:0 ( b)
ipsec3 Link encap:IPIP Tunnel HWaddr
NOARP MTU:0 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:10
RX bytes:0 ( b) TX bytes:0 ( b)
lo Link encap:Local Loopback
inet addr:127..1 Mask:255..0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 ( b) TX bytes:0 ( b)
tunl0 Link encap:IPIP Tunnel HWaddr
NOARP MTU:1480 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 ( b) TX bytes:0 ( b)
+ _________________________ ipsec/directory
+ ipsec --directory
/usr/local/lib/ipsec
+ _________________________ hostname/fqdn
+ hostname --fqdn
wizard.hehe.org
+ _________________________ hostname/ipaddress
+ hostname --ip-address
210.100.101.14
+ _________________________ uptime
+ uptime
12:41pm up 2 min, 1 user, load average: 0.06, 0.07, 0.02
+ _________________________ ps
+ ps alxw
+ egrep -i 'ppid|pluto|ipsec|klips'
F UID PID PPID PRI NI VSZ RSS WCHAN STAT TTY TIME COMMAND
040 0 666 1 9 0 1996 920 wait4 S ? 0:00 /bin/sh /usr/local/lib/ipsec/_plut
orun --debug none --uniqueids 000 0 667 1 9 0 1396 500 pipe_w S ? 0:00 logge
r -p daemon.error -t ipsec__plutorun 040 0 668 666 9 0 1996 920 wait4 S ? 0:0
0 /bin/sh /usr/local/lib/ipsec/_plutorun --debug none --uniqueids 000 0 669 666 8 0 1984 904 pipe_
w S ? 0:00 /bin/sh /usr/local/lib/ipsec/_plutoload --load %search --start 100 0 673 668
8 0 1984 884 do_sel S ? 0:00 /usr/local/lib/ipsec/pluto --nofork --debug-none 000 0
1021 942 9 0 2972 1036 wait4 S tty1 0:00 /bin/sh /usr/local/sbin/ipsec barf 000 0 102
2 1021 16 0 2992 1080 wait4 S tty1 0:00 /bin/sh /usr/local/lib/ipsec/barf 040 0 1062
1022 16 0 2992 1080 - R tty1 0:00 /bin/sh /usr/local/lib/ipsec/barf + _____________________
____ ipsec/showdefaults + ipsec showdefaults
routephys=eth0
routephys=eth0
routevirt=ipsec0
routevirt=ipsec0
routeaddr=210.100.101.14
routeaddr=210.100.101.14
routenexthop=210.100.101.1
routenexthop=210.100.101.1
defaultroutephys=eth0
defaultroutevirt=ipsec0
defaultrouteaddr=210.100.101.14
defaultroutenexthop=210.100.101.1
+ _________________________ ipsec/conf
+ ipsec _include /etc/ipsec.conf
+ ipsec _keycensor
#< /etc/ipsec.conf 1
# /etc/ipsec.conf - FreeS/WAN IPsec configuration file
# More elaborate and more varied sample configurations can be found
# in FreeS/WAN's doc/examples file, and in the HTML documentation.
# basic configuration
config setup
interfaces=%defaultroute
klipsdebug=none
plutodebug=none
plutoload=%search
plutostart=%search
# sample VPN connection
conn sample
left=210.100.102.201
leftsubnet=192.168.1.0/24
leftnexthop=210.100.102.1
right=210.100.101.14
rightsubnet=192.168./24
rightnexthop=210.100.101.1
auto=start
auth=esp
authby=rsasig
leftrsasigkey=[sums to 0cf2...]
# RSA 2048 bits wizard.hehe.org Mon Dec 9 14:25:22 2002
rightrsasigkey=[sums to 4391...]
+ _________________________ ipsec/secrets
+ ipsec _include /etc/ipsec.secrets
+ ipsec _secretcensor
#< /etc/ipsec.secrets 1
: RSA {
# RSA 2048 bits wizard.hehe.org Mon Dec 9 14:25:22 2002
# for signatures only, UNSAFE FOR ENCRYPTION
#pubkey=[sums to 4391...]
#IN KEY 0x4200 4 1 [sums to 95aa...]
# (0x4200 = auth-only host-level, 4 = IPSec, 1 = RSA)
Modulus: [...]
PublicExponent: [...]
# everything after this point is secret
PrivateExponent: [...]
Prime1: [...]
Prime2: [...]
Exponent1: [...]
Exponent2: [...]
Coefficient: [...]
}
# do not change the indenting of that "[sums to 7d9d...]"
+ _________________________ ipsec/ls-dir
+ ls -l /usr/local/lib/ipsec
total 2252
-rwxr-xr-x 1 root root 11064 Dec 9 13:50 _confread
-rwxr-xr-x 1 root root 46501 Dec 9 13:50 _copyright
-rwxr-xr-x 1 root root 2163 Dec 9 13:50 _include
-rwxr-xr-x 1 root root 1383 Dec 9 13:50 _keycensor
-rwxr-xr-x 1 root root 3495 Dec 9 13:50 _plutoload
-rwxr-xr-x 1 root root 3622 Dec 9 13:50 _plutorun
-rwxr-xr-x 1 root root 7272 Dec 9 13:50 _realsetup
-rwxr-xr-x 1 root root 1904 Dec 9 13:50 _secretcensor
-rwxr-xr-x 1 root root 6076 Dec 9 13:50 _startklips
-rwxr-xr-x 1 root root 5262 Dec 9 13:50 _updown
-rwxr-xr-x 1 root root 10839 Dec 9 13:50 auto
-rwxr-xr-x 1 root root 6436 Dec 9 13:50 barf
-rwxr-xr-x 1 root root 222435 Dec 9 13:49 eroute
-rwxr-xr-x 1 root root 2829 Dec 9 13:50 ipsec
-rw-r--r-- 1 root root 1950 Dec 9 13:50 ipsec_pr.template
-rwxr-xr-x 1 root root 161674 Dec 9 13:49 klipsdebug
-rwxr-xr-x 1 root root 2437 Dec 9 13:50 look
-rwxr-xr-x 1 root root 16172 Dec 9 13:50 manual
-rwxr-xr-x 1 root root 1227 Dec 9 13:50 newhostkey
-rwxr-xr-x 1 root root 135346 Dec 9 13:49 pf_key
-rwxr-xr-x 1 root root 767643 Dec 9 13:50 pluto
-rwxr-xr-x 1 root root 52682 Dec 9 13:50 ranbits
-rwxr-xr-x 1 root root 74090 Dec 9 13:50 rsasigkey
-rwxr-xr-x 1 root root 16671 Dec 9 13:50 send-pr
lrwxrwxrwx 1 root root 22 Dec 9 13:50 setup -> /etc/rc.d/init.d/ipsec
-rwxr-xr-x 1 root root 1041 Dec 9 13:50 showdefaults
-rwxr-xr-x 1 root root 3484 Dec 9 13:50 showhostkey
-rwxr-xr-x 1 root root 245541 Dec 9 13:49 spi
-rwxr-xr-x 1 root root 199997 Dec 9 13:49 spigrp
-rwxr-xr-x 1 root root 68605 Dec 9 13:49 tncfg
-rwxr-xr-x 1 root root 130611 Dec 9 13:50 whack
+ _________________________ ipsec/updowns
++ ls /usr/local/lib/ipsec
++ egrep updown
+ cat /usr/local/lib/ipsec/_updown
쭈욱~~~~~~~ 나옵니다.
* www.freeswan.org 의 문서와 ipsec 맨페이지를 꼭 읽어보십시오.
|
|
|
페이지로딩: [ 1.41 초 ]
작업시간: [ 0.03 초 ]
|
|
|
|
![[TOP]](/images/color///top.gif)
|
|
|
|
|
|
|
![[ 적수네 동네 ]](/images/button/lsn.gif){kind=small}
![[ 리눅스 상표권 독점 반대 ]](/images/button/savelinux.gif){kind=small}
![[ 한글 리눅스 문서 프로젝트 ]](/images/button/kldp1.gif){kind=small}
![[ KrLine ]](/images/button/linux01.gif){kind=small}
![[ 사랑넷 ]](/images/button/sarangnet.jpg){kind=small}
![[ Valid HTML 4.0! ]](/images/button/w3.gif){kind=small}
![[ SlashDot ]](/images/button/slashbutton.gif){kind=small}
![[ Freshmeat ]](/images/button/freshmeat.gif){kind=small}