0

could someone point me out how should look the config of ipsec (libreswan) the way that i could assign a static public ip per user id

  1. we use ipsec xauth/psk
  2. left (client) ipsec identifier
  3. based on left id right (server) assign static ip
  4. we use weekest encryption (for speed - security is no concern here)

i use the following config as roadwarrior but i need to made a kvm containmer per each client

version 2.0

config setup
  virtual-private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!192.168.42.0/24,%v4:!192.168.43.0/24
  protostack=netkey
  interfaces=%defaultroute
  uniqueids=no

conn shared
  left=%defaultroute
  leftid=x.x.x.x
  right=%any
  encapsulation=yes
  authby=secret
  pfs=no
  rekey=no
  keyingtries=5
  dpddelay=30
  dpdtimeout=120
  dpdaction=clear
  sha2-truncbug=yes
  phase2alg=aes256-sha1;modp1024
  keyexchange=ike
  ike=aes256-sha1;modp1024

conn xauth-psk
  auto=add
  leftsubnet=0.0.0.0/0
  rightaddresspool=192.168.43.10-192.168.43.250
  modecfgdns="8.8.8.8, 8.8.4.4"
  leftxauthserver=yes
  rightxauthclient=yes
  leftmodecfgserver=yes
  rightmodecfgclient=yes
  modecfgpull=yes
  xauthby=file
  ike-frag=yes
  ikev2=never
  cisco-unity=yes
  also=shared

i want to use a one single ip for transport (multiple tunnelss) but each client will have its own public ip for net traffic (payload)

                                     IPSEC XAUTH/PSK

client1  -----|                        |---- IP1 client1 <--> INTERNET
              |                        |
client2  --|  |      tunnel            |
           |--------  x.x.x.x  ------->|---- IP2 client2 <--> INTERNET 
             |  |                      |
....     ----|  |                      |----   .........
                |                      |
clientx  -------|                      |---- IPX clientx <--> INTERNET

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.