IPsec VPN

jantman · 01-15-2007, 05:53 PM

I have a substantial Linux network at home. I'm currently in a dorm at college and want to connect to my home network using an IPsec VPN. I have no experience with VPNs, but have read all of the tutorials and docs I could find.

The setup is as follows:

My server (Netgear FVS318, or m0n0wall, or a SuSE box if need be) is on a fiber Internet connection with a dynamic IP. I have dynamic DNS setup through dyndns.org. My client is a desktop at school that is behind a NAT firewall and has no dedicated Internet IP.

Is there any way to still use OpenSWAN on the client? I looked through the docs, but the "left" and "right" parameters call for IP addresses. The server doesn't have a static IP, and the client doesn't have an IP that can be seen by anyone off the LAN.

Any ideas?

Thanks,
Jason

Micro420 · 01-15-2007, 07:44 PM

I am not familiar with OpenSWAN, but have you looked at using OpenVPN or SSH tunneling?

To find your home IP address, you could ping the dynamic dns. To find your ip address at the college, you could go to whatismyip.com

I use OpenVPN, and even though I'm behind a NAT, I am still able to VPN into my remote network. As long as I have my destination IP address, I can get in. If for reason OpenSWAN requires your source IP address BEHIND the NAT, then you have to talk to the admin and have him/her forward ports. I doubt this is the case, though.

jantman · 01-15-2007, 08:30 PM

SSH tunneling won't work through NAT. I haven't looked into OpenVPN.

Forwarding ports through the University's NAT isn't an option.

I understand the part about the Internet IP with whatismyip.com. I was just assuming that it needed some IP to the client machine - assuming it will work with NAT, that's OK.

As to getting the IP of my DynamicDNS... that defeats the purpose of the dynamic DNS. The IP lease is for about 26 hours. This means that I'd need to re-edit my IPsec cilent configuration every day. Is there any way to do a one-time configuration and have it *work*?

Micro420 · 01-16-2007, 12:11 AM

If you use OpenVPN then you can just put your dynamic dns name into the OpenVPN configuration file. you don't have to use an IP address with OpenVPN. Other than that, I cannot help you unless it relates to OpenVPN as I am not familiar with OpenSWAN or other VPN tools in Linux, maybe besides PPTP, but that is to connect to a Windows machine.