1. Skip to Menu
  2. Skip to Content
  3. Skip to Footer>
Image 1

WE Solutions / Our services

  • Previous
  • Next
  • Stop
  • Play

SAMBA/LDAP

Thin Client Server

Postfix Mail Server

Postfix Mail Server

HA Clustering

VPN IPSec - Dynamic DNS

PDF Print E-mail

Written by Mr. Sontaya Photibut Saturday, 02 May 2009 16:13

การติดตั้ง VPN IPSec + Dynamic DNS ด้วยโปรแกรม OpenSWAN กับ ZyXELL VPN

Protocal ที่ควรรู้

IPsec : UDP (Port 500 Dest)

ESP : (Port 50 IP Protocal)

PPTP : ( Port 1723 TCP Dest)

GRE : (Port 51 IP Protocal) 

1. เริ่มติดตั้ง โปรแกรมกันดีกว่าครับ

Yast -> Software -> Software Managerment

- ipsec-tools

- openswan

2. ทำสำเนาไฟล์ cript

# cp /etc/ipsec.conf  /etc/ipsec.conf-origianl

# vi /etc/ipsec.conf

แก้ไขไฟล์ตามนี้ครับ 

 # /etc/ipsec.conf - Openswan IPsec configuration file
# RCSID $Id: ipsec.conf.in,v 1.15.2.2 2005/11/14 20:10:27 paul Exp $

# This file: /usr/share/doc/packages/openswan/ipsec.conf-sample
#
# Manual: ipsec.conf.5


version 2.0 # conforms to second version of ipsec.conf specification

# basic configuration
config setup
# plutodebug / klipsdebug = "all", "none" or a combation from below:
# "raw crypt parsing emitting control klips pfkey natt x509 private"
# eg:
# plutodebug="control parsing"
#
# Only enable klipsdebug=all if you are a developer
#
# NAT-TRAVERSAL support, see README.NAT-Traversal
# nat_traversal=yes
# virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%4:172.16.0.0/12
#
# Certificate Revocation List handling:
#crlcheckinterval=600
#strictcrlpolicy=yes
#
# Change rp_filter setting? (default is 0, disabled)
# See also setting in the /etc/sysctl.conf file!
#rp_filter=%unchanged
#
# Workaround to setup all tunnels immediately, since the new default
# of "plutowait=no" causes "Resource temporarily unavailable" errors
# for the first connect attempt over each tunnel, that is delayed to
# be established later / on demand.
#
plutowait=yes
forwardcontrol=no
nat_traversal=yes
# default settings for connections
conn %default
# keyingtries default to %forever
#keyingtries=3
# Sig keys (default: %dnsondemand)
### leftrsasigkey=%cert
### rightrsasigkey=%cert
# Lifetimes, defaults are 1h/8hrs
#ikelifetime=20m
#keylife=1h
#rekeymargin=8m
### deyexchange=ike

#Disable Opportunistic Encryption
# include /etc/ipsec.d/examples/no_oe.conf

# Add connections here

# sample VPN connection
#conn sample
# # Left security gateway, subnet behind it, nexthop toward right.
# left=10.0.0.1
# leftsubnet=172.16.0.0/24
# leftnexthop=10.22.33.44
# # Right security gateway, subnet behind it, nexthop toward left.
# right=10.12.12.1
# rightsubnet=192.168.0.0/24
# rightnexthop=10.101.102.103
# # To authorize this connection, but not actually start it,
# # at startup, uncomment this.
# #auto=start
###############################################
conn service-headoffice
type=tunnel
left=125.24.xxx.xxx # IP Router Servece
leftnexthop=%defaultroute
leftsubnet=192.168.1.0/24
right=125.24.xxx.xxx # IP Router Head Office
rightnexthop=%defaultroute
rightsubnet=192.168.11.0/24
keyexchange=ike
auth=esp
auto=start
authby=secret
pfs=no

conn packetdefault
auto=ignore

conn clear
auto=ignore

conn private
auto=ignore

conn private-or-clear
auto=ignore

conn clear-or-private
auto=ignore

3. Restart Openswan

#rcipsec restart

4. สร้าง Pre-Shared Keys (PSK)

# ipsec ranbits --continuous 64

0x1234*************** (ตัวอย่างเท่านั้น)

- copy รหัสที่เห็น แล้วนำไปวางที่ไฟล์ ipsec.secrets

# vi /etc/ipsec.secrets

 เพิ่มคำสั่งนั้ในบรรทัดสุดท้าย

### Additional line by SuSEThailand.com ###
125.24.xxx.xxx 125.24.xxx.xxx : PSK "0x1234***************"



5. คอนฟิก Zywall VPN

- Login to web-base config หรือใช้ Telnet ก็ได้ตามสะดวกครับ

- เลือก VPN menu

-  คลิก ปุ่ม Edit

 -  คลิกที่ช่อง Acctive

    Name : Service-Ho

    Key Management = IKE

    Negofiation Mode = Main


- คลิกที่ช่อง Server Mode

Local

- คลิกเลือก site to site

    Address Type : Subnet Address

    Starting IP Address : 192.168.11.0

    Ending IP Address/Subnet Mask : 255.255.255.0

    DNS Server(for IPSec VPN) = 203.113.24.199 

*** IP Address นี้เป็น DNS ของ TOT ครับ ถ้าคุณใช้ Public IP ก็ให้ใส่ตัวนั้น ในกรณีนี้เป็นการคอนฟิกให้ใช้ Dynamic IP Address ครับ

Authentication Method

- คลิกเลือก Pre-Shard Key : 0x1234***********

    Local ID Type = IP

    content = 0.0.0.0

    Peer ID Type = IP

    content = 0.0.0.0

    My IP Address = 0.0.0.0 (ถ้าคุณมี Public IP ก็ให้ใส่ครับ) 

    Secure Gateway Address = myhost.dyndns.org

    Encapsulation Mode = Tunnel

- เลือก ESP

    Encryption Algorithm = 3DES

    Authentication Algorithm = SHA1

กด Apply ครับ

- เลือก Firewall menu

ทำการเพิ่ม protocal IKE เข้าไปในส่วนของ WAN/WAN ครับ.

6. ที่เครื่อง Linux Server

# rcipsec restart

# ipsec auto --up service-headoffice

# ipsec auto --status

7. ทดสอบ VPN

# ping 192.168.11.x

8. ตรวจสอบ Router

# netstat -nr

# tcpdump -n -i eth1 icmp

9. ตรวจสอบ Syslog Error Messages

# tail -f /var/log/messages

 

เสร็จขั้นตอนการทำ IPSec VPN + Dynamic DNS

 

 

 


Comments (0)Add Comment

Write comment

security code
Write the displayed characters


busy
 

SUSE Linux Enterprise Cool Solutions

  • Why You'll Want To Be At ATT Live 2012

    Memories of ATT Live 2010 are still fresh in my mind. It was a great event at a great location, The M in Las Vegas, NV. Novell customers and partners alike told us they were very happy with it. The Novell Training team was also extremely pleased with how it turned out. The venue was great, the location was perfect, and let's not forget how effective and beneficial the training was. I am excited to be part of the team again that is putting together ATT Live 2012. Due to the Attachmate acquisition, the heritage Novell/SUSE Training team is now also responsible for NetIQ training, so this is an exciting time for us and even greater opportunity than ever before for you.

    The main reason you'll want to attend ATT Live 2012 is: you get 4 days of intense, hands-on training geared specifically for people like you--system administrators, network engineers and IT specialists--who actually do the job of administering Novell, SUSE and NetIQ products. You get the real world, day-to-day administration, usability, troubleshooting, and tips & tricks training you need to succeed on the job.

    I blogged a little bit about ATT Live a couple months ago but the planning for the event is more complete now and there's more detailed information to share today that I wanted make you aware of. In addition to the general facts that ATT Live 2012 will be held May 15-18 at The M Resort Spa and Casino in Las Vegas, NV, I wanted to point out several exciting things you'll want to look at today:

    This year we are offering nearly 80 unique 2- and 4-hour sessions with:

    • 6 tracks dedicated to the Novell products ZEN, OES and GW
    • 3 NetIQ tracks focused on ISM, Sentinel, and legacy NetIQ products
    • 3 SUSE tracks focused on SLES administration, usability and troubleshooting

    At ATT Live 2012 you'll be rubbing shoulders with product managers, subject matter experts, and front & backline support engineers who will be helping the Training team to deliver more learning tracks and unique sessions than ever before.

    Once you're at the M Resort you'll find this to be a very affordable training event. The conference room rate is only $120 per night. The food is great (The M has the best buffet in Las Vegas) and breakfast and lunch all 4 days are covered by your conference registration. And you'll only be 10 minutes from the airport and from The Strip with free shuttles to and from both destinations.

    If you have questions or suggestions regarding ATT Live 2012, you can check the website or email the team at ATTLive@novell.com.

    As for me, I'll be blogging more about ATT Live 2012 in the weeks to come to provide more detailed information about the content of the sessions themselves. This is, after all, a technical training conference and it's the technical stuff that matters most to you so I'll be diving into that so you'll have more of an idea about what you'll be getting in return for your training investment.

    Please follow Novell, SUSE, and NetIQ Training on:
    http://twitter.com/novell_training
    http://www.facebook.com/NovellTraining

  • SUSE Linux Enterprise Server now available on Dell Cloud

    Good news for Dell customers. SUSE Linux Enterprise Server is now available to customers through Dell's new public cloud offering, Dell Cloud with VMware vCloud® Datacenter Service.

    SUSE Linux Enterprise Server is the first Linux operating system available to customers through the Dell Cloud. Now, Dell customers can efficiently run a wide range of ISV applications, on a pay-per-use basis, with maximum performance, while receiving streamlined support from Dell and SUSE.

    Learn more.

  • Relocating non-persistent parts of Firefox profile.

    Whilst the previous Cool Solution only redirected urlclassifer3.sqlite, this method redirected urlclassifer3.sqlite, Cache, OfflineCache and the fastloader files XUL.mfasl XPC.mfasl. This method also uses environment variables rather than creating a symbolic link, so it's cleaner.

    I figured out this solution after reading a bug report at https://bugzilla.mozilla.org/show_bug.cgi?id=239254

    The trick is to launch Firefox with both $XRE_PROFILE_PATH set to the location of the profile that's being used and $XRE_PROFILE_LOCAL_PATH set to where you want Cache, urlclassifer3.sqlite etc to be. Like the previous Cool Solution, a wrapper script called firefox in /usr/local/bin takes care of that. Also like the previous Cool Solution, this wrapper script makes use of another script findfirefoxprofilepath, also attached, which works out the location of the user's Firefox profile (it's output is set as the value of $XRE_PROFILE_PATH). The firefox script expects the findfirefoxprofilepath script to be in /usr/local/sbin.

    If $XDG_CACHE_HOME is set, the firefox script sets $XRE_PROFILE_LOCAL_PATH to somewhere in there. (It will always use the same location so the files will persist across sessions, assuming they're not deleted by something else.) If $XDG_CACHE_HOME is not set then a new directory will be created each time using mktemp.

    I've had this script in use in a production environment for about five months with no apparent problems and I've tested it with newer versions of Firefox than are currently in SLED. Hopefully Firefox will one day support the XDG directory specification and then a wrapper script such as this will not be necessary, you can just set $XDG_CACHE_HOME and be done with it. (I already set $XDG_CACHE_HOME to somewhere outside the user's home directory, hence why this wrapper scripts makes use of it if it's set.) The bugzilla entries for such support were raised some years ago though so I'm not expecting such support to appear any time soon.

    AttachmentSize
    firefox_wrapper_scripts.tbz2.16 KB
  • Ever search for KB TIDs/Articles? Take this survey and you could win a $20 Amazon gift card

    Do you ever look up TIDS/Articles in the Knowledgebase? They're making some changes to the way the Knowledgebase search process works, and they want to get some input from you. Take a VERY short survey, and we'll enter you in a drawing for three $20 Amazon Gift Cards.

    Don't be shy!

    https://www.surveymonkey.com/s/Knowledgebase-search

  • How to set up AutoAdminLogon with the Novell Client for Linux on SLE 11

    Setup Process:

    Step #1 - Configure the desktop to automatically login.

    1. Launch YaST or YaST2
    2. Click on System-->Sysconfig Editor-->Desktop-->Displaymanager-->displaymanager_autologin
    3. Enter the username used in logging into the desktop.
    4.  
      Now after the workstation is rebooted, the workstation should automatically do a local login to the desktop.

    Step #2 - Configure the Novell Client for Linux to automatically login.

    Option A: Use a script

    • Edit and append the following lines to the /home/<username>/.profile.
    NOTE: Lines in bold (found at the beginning) should be changed with your specific information
    #===================================
     
    #USER="<mylocaluser>"
    USER="<username>"
     
    #SERVER="<myserver.novell.com>"
    SERVER="<dns or IP>"
     
    #VOLUME="SYS"
    VOLUME="<volume>"
     
    #EDIR_USER="<admin>"
    EDIR_USER="<edir user>"
     
    #EDIR_PASWORD="<novell>"
    EDIR_PASWORD="<password>"
     
    #EDIR_USER_CONTEXT="<ou=users,o=novell>"
    EDIR_USER_CONTEXT="<edir context for user>"
     
    #MAPLOCATION="</home/jmeldrum/Desktop/mymap>"
    MAPLOCATION="<map location and name>"
     
    
    loggedIn="$(nwconnections | sed -n "/[0-9]/p")"
     
    if [ $(whoami) == "$USER" ]; then
            if [ -z "$loggedIn" ]; then
                    echo "=========`date` ================" >> /tmp/mylogin.log
                    /opt/novell/ncl/bin/nwmap -d $MAPLOCATION -s SERVER -v $VOLUME -u $EDIR_USER -p $EDIR_PASWORD-c $EDIR_USER_CONTEXT 2&1 >> /tmp/mylogin.log
            fi
    else
            echo "$(whoami) does not match user $USER" >> /tmp/mylogin.log
    fi
    #===================================
    

    Option B: Setup Integrated Login

    AutoAdminLogon is now setup.