Below is an example OpenSwan configuration file with a brief explanation of each line.<\/p>\n
conn <connname> type=tunnel<\/strong> authby=secret<\/strong> auth=esp<\/strong> left=80.74.16.163<\/strong> auto=start<\/strong> Below is an example OpenSwan configuration file with a brief explanation of each line. conn <connname> type=tunnel the type of the connection; currently the accepted values are tunnel (the default) signifying a host-to-host, host-to-subnet, or subnet-to-subnet tunnel; transport, signifying host-to-host transport mode; passthrough, signifying that no IPsec processing should be done at all; drop, signifying […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[435,465,522,523],"class_list":["post-749","post","type-post","status-publish","format-standard","hentry","category-linux","tag-linux-ipsec","tag-linux-vpn","tag-openswan-ipsec","tag-openswan-vpn"],"_links":{"self":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts\/749","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/comments?post=749"}],"version-history":[{"count":1,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts\/749\/revisions"}],"predecessor-version":[{"id":4776,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts\/749\/revisions\/4776"}],"wp:attachment":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/media?parent=749"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/categories?post=749"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/tags?post=749"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n<\/strong><\/p>\n
\nthe type of the connection; currently the accepted values are tunnel (the default) signifying a host-to-host, host-to-subnet, or subnet-to-subnet tunnel; transport, signifying host-to-host transport mode; passthrough, signifying that no IPsec processing should be done at all; drop, signifying that packets should be discarded; and reject, signifying that packets should be discarded and a diagnostic ICMP returned.<\/em><\/p>\n
\nHow the two security gateways should authenticate each other; acceptable values are \u201csecret\u201d for shared secrets, \u201crsasig\u201d for RSA digital signatures (the default), secret|rsasig for either, and never if negotiation is never to be attempted or accepted (useful for shunt-only conns). Digital signatures are superior in every way to shared secrets.<\/em><\/p>\n
\nWhether authentication should be done as part of ESP encryption, or separately using the AH protocol; acceptable values are esp (the default) and ah.<\/em>
\n
\nesp=3des-md5-96
\n<\/strong>(encrypted Secure Payload) defines what cipher, hash and PFSGroup you wish to use for the connection.<\/em><\/p>\n # ONLY allow AES 256bit w\/MD5\n esp=!aes256-md5\n # Prefer aes, 3des, blowfish in that order, but permit other combinations\n esp=aes,3des,blowfish\n # Only permit AES or 3DES with MD5 or SHA1\n esp=!aes-md5,!aes-sha1,!3des-md5,!3des-sha1<\/pre>\n
\n(required) the IP address of the left participant\u2019s pub-lic-network interface, in any form accepted byipsec_ttoaddr(3) or one of several magic values.<\/em>
\n
\nleftsubnet=192.168.0.0\/16<\/strong>
\nprivate subnet behind the left participant, expressed as network\/netmask (actually, any form acceptable to ipsec_ttosubnet(3)); if omitted, essentially assumed to be left\/32, signifying that the left end of the connection goes to the left participant only <\/em>
\n
\nright=85.234.71.226<\/strong>
\n(required) the IP address of the right participant\u2019s pub-lic-network interface.<\/em>
\n
\nrightsubnet=192.168.1.0\/24<\/strong>
\nprivate subnet behind the right participant, expressed as network\/netmask.<\/em>
\n
\nkeyingtries=3<\/strong>
\nhow many attempts (a whole number or %forever<\/strong>) should be made to negotiate a connection, or a replacement for one, before giving up (default %forever<\/strong>). The value %forever<\/strong> means \u201cnever give up\u201d (obsolete: this can be written 0). Relevant only locally, other end need not agree on it. <\/em>
\n
\npfs=no
\n<\/strong>Whether Perfect Forward Secrecy of keys is desired on the connection\u2019s keying channel (with PFS, penetration of the key-exchange protocol does not compromise keys negotiated earlier); acceptable values are yes (the default) and no. <\/em>
\n
\nrekey=yes<\/strong>
\nwhether a connection should be renegotiated when it is about to expire; acceptable values are yes<\/strong> (the default) and no<\/strong>. The two ends need not agree, but while a value of no<\/strong> prevents Pluto from requesting renegotiation, it does not prevent responding to renegotiation requested from the other end, so no<\/strong> will be largely ineffective unless both ends agree on it. <\/em><\/p>\n
\nauto starts the vpn tunnel on a ipsec service restart.<\/em>
\n
\nkeyexchange=ike<\/strong>
\nmethod of key exchange; the default and currently the only accepted value is ike <\/em>
\n
\nikelifetime=1h<\/strong>
\nHow long the connection to the other key-management daemon should last before being renegotiated; acceptable values as for keylife (default set by ipsec_pluto(8), currently 1h, maximum 8h).<\/em>
\n
\nkeylife=8h<\/strong>
\nhow long a particular instance of a connection (a set of encryption\/authentication keys for user packets) should last, from successful negotiation to expiry; acceptable values are an integer optionally followed by s (a time in seconds) or a decimal number followed by m, h, or d (a time in minutes, hours, or days respectively) (default 8.0h, maximum 24h). Normally, the connection is renegotiated (via the keying channel) before it expires. The two ends need not exactly agree on keylife, although if they do not, there will be some clutter of superseded connections on the end which thinks the lifetime is longer.<\/em>
\n
\ndpdaction=restart<\/strong>
\nWhen a DPD enabled peer is declared dead, what action should be taken. hold (default) means the eroute will be put into %hold status, while clear means the eroute and SA with both be cleared. dpdaction=clear is really only usefull on the server of a Road Warrior config. <\/em>
\n
\ndpddelay=30<\/strong>
\nSet the delay (in seconds) between Dead Peer Dectection (RFC 3706) keepalives (R_U_THERE, R_U_THERE_ACK) that are sent for this connection (default 30 seconds). If dpdtimeout is set, but not dpddelay, dpddelay will be set to the default. <\/em>
\n
\ndpdtimeout=120
\n<\/strong>Set the length of time (in seconds) we will idle without hearing either an R_U_THERE poll from our peer, or an R_U_THERE_ACK reply. After this period has elapsed with no response and no traffic, we will declare the peer dead, and remove the SA (default 120 seconds). If dpddelay is set, but not dpdtimeout, dpdtimeout will be set to the default. <\/em><\/p>\n","protected":false},"excerpt":{"rendered":"