Linux VPN Masquerade HOWTO

John D. Hardin

1. Introduction

• 1.1 Introduction
• 1.2 Feedback, Credits & Resources
• 1.3 Copyright & Disclaimer

2. Background Knowledge

• 2.1 What is a VPN?
• 2.2 What is IPsec?
• 2.3 What is PPTP?
• 2.4 Why masquerade a VPN client?
• 2.5 Can several clients on my local network use IPsec simultaneously?
• 2.6 Can several clients on my local network use PPTP simultaneously?
• 2.7 Can I access the remote network from my entire local network?
• 2.8 Why masquerade the VPN server?
• 2.9 Why patch the Linux kernel?
• 2.10 Current Status

3. Configuring the Linux firewall

• 3.1 Example network
• 3.2 Determining what needs to be done on the firewall
• 3.3 Patching and configuring the 2.0.x kernel for VPN Masquerade support
• 3.4 Patching and configuring the 2.2.x kernel for VPN Masquerade support
• 3.5 ipfwadm setup for a Private-IP VPN Client or Server
• 3.6 ipchains setup for a Private-IP VPN Client or Server
• 3.7 A note about dynamic IP addressing
• 3.8 Additional setup for a Private-IP VPN Server
• 3.9 ipfwadm setup for a Registered-IP VPN Server
• 3.10 ipfwadm setup for a Registered-IP VPN Client

4. Configuring the VPN client

• 4.1 Configuring a MS W'95 or W'98 client
• 4.2 Configuring a MS NT client

5. Troubleshooting

• 5.1 Testing
• 5.2 Possible problems
• 5.3 Troubleshooting
• 5.4 MS PPTP Clients and domain-name issues
• 5.5 MS PPTP Clients and Novell IPX
• 5.6 MS network password issues
• 5.7 If your IPsec session always dies after a certain amount of time

6. IPsec masquerade technical notes and special security considerations

• 6.1 Limitations and weaknesses of IPsec masquerade
• 6.2 Proper routing of inbound encrypted traffic