2

I need to be able to VPN in to my FreeBSD server from my Mac using IPSecuritas. I was wondering if anyone ever done something, I'm reading VPN over IPsec but that mainly covers if you had 2 nodes with 2 public IP address. My endpoint in IPSecuritas configured with MODE_CFG enabled so it'll have the other node to query my address from it's coming from. SSH is out of question, this is not a VPN solution, people who'd end up using VPN wouldn't know what to do, so I need very simple VPN the one that you get to use almost anywhere, you have a client and you have server, client makes a connection to server and boom, you in...

Improve this question
1
  • or else what do you use in order to have VPN between your Mac OS X (client that you take your laptop everywhere) and server?
    – alexus
    Aug 27, 2009 at 19:52

5 Answers 5

Reset to default
1

Having set up IPSec in a simple tunnel mode between two hosts once, I swore I would try and stay away forever. In terms of alternatives to IPSec/IPSecuritas, you might want to investigate setting up a PPTP VPN, as Mac OS X (and other major operating systems) contain a PPTP client built-in. There are two good options for PPTP servers on FreeBSD:

  • net/mpd5 - my preferred option, based on the netgraph framework
  • net/poptop - the standard choice, available on Linux as well

OpenVPN is also a possibility, although I've never used it on Mac OS X and so can't comment on ease of set-up. A quick web search reveals a few GUI clients, so that might be worth investigating.

Improve this answer
1

Try OpenVPN. I've used it going from OS X to Linux, and they say the server works great on FreeBSD.

Improve this answer
1
  • Why the downvote? It's a valid answer, I would think...
    – Bill Weiss
    Nov 2, 2010 at 16:12
0

I mostly use either IPsecuritas and pfSense. Or work via SSH Portforwarding. Look for the "-L" option.

Improve this answer
1
  • IPsecuritas is for a client, I mainly need to know how to configure server side (FreeBSD) pfSense is a solution and can not be used in my case nor SSH Portforwarding as this is more like work around and very painful one especially if I need to do a lot of connections/ports dynamic ports
    – alexus
    Sep 8, 2009 at 21:17
0

This is a fairly straight forward config on FreeBSD, if I understand you correctly. You want to create an IPSec (presuming tunnel mode) connection between your Apple and a FreeBSD machine, and because you have a dynamic IP for the Apple, you need to be able to authenticate the tunnel some how. I would presume you are using a PreShared key?

To perform client configuration (mode_cfg) I use racoon as the ISAKMP daemon on FreeBSD. This is part of the IPSEC-TOOLS package. It is available in the FreeBSD ports tree as 

Port:   racoon2-20090327c
Path:   /usr/ports/security/racoon2

You specify the Mode_CFG parameters in a separate section of the racoon.conf file. The setup is fairly straight forward on FreeBSD, if you understand the basics of IPSEC.

Points to bear in mind:

  • Your Kernel needs to have IPSEC and ESP compiled in.
  • You need to enable IP Forwarding (gateway_enable = "YES") in rc.conf.

And you should be able to make it all work... I have found FreeBSD to pretty stable as a VPN RAS server, and it is quite quick, compared to the smaller Cisco PIX firewalls (501/506/e)

Improve this answer
2
  • raccoon was described in my original link, getting it to work is might be easy once you know what you doing and that is not my case, so when I start reading it, they said this is basically second phase of that article and first phase is to be able to make a connection from one host to another using GIF interface, but in order to do that I need to somehow tell FreeBSD that this IP can change, and thats where I'm getting into problems, before raccoon. raccoon helps to encrypt traffic between two hosts/networks
    – alexus
    Sep 13, 2009 at 1:29
  • I have a working config like this (sans MOD_CFG) will look at that tomorrow and edit my answer. I am pretty sure that you need to get rid of those GIF interfaces to make it work (they are not really needed anyway if you are using ipsec-tools). In your setkey file, you need to specify the tunne parameter for the dynamic end as 0.0.0.0/0 and in racoon.conf user the "anonymous" keyword for both the policy and sa sections.
    – ColtonCat
    Sep 15, 2009 at 8:08
0

I've used OpenVPN and OpenVPN-AS extensively on FreeBSD gateways and a variety of clients. AS is a commercial option, but the client is better with more comprehensive support than that of the standard OpenVPN client. Setting it up really is a doddle with the instructions.

The commercial client is at http://www.openvpn.net/index.php/access-server/download-openvpn-as.html

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .