Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

I need to be able to VPN in to my FreeBSD server from my Mac using IPSecuritas. I was wondering if anyone ever done something, I'm reading VPN over IPsec but that mainly covers if you had 2 nodes with 2 public IP address. My endpoint in IPSecuritas configured with MODE_CFG enabled so it'll have the other node to query my address from it's coming from. SSH is out of question, this is not a VPN solution, people who'd end up using VPN wouldn't know what to do, so I need very simple VPN the one that you get to use almost anywhere, you have a client and you have server, client makes a connection to server and boom, you in...

share|improve this question
or else what do you use in order to have VPN between your Mac OS X (client that you take your laptop everywhere) and server? – alexus Aug 27 '09 at 19:52

5 Answers

up vote 0 down vote

I've used OpenVPN and OpenVPN-AS extensively on FreeBSD gateways and a variety of clients. AS is a commercial option, but the client is better with more comprehensive support than that of the standard OpenVPN client. Setting it up really is a doddle with the instructions.

The commercial client is at http://www.openvpn.net/index.php/access-server/download-openvpn-as.html

share|improve this answer
The non-commercial client is openvpn.se – AledT Nov 9 '09 at 16:17
up vote 1 down vote

Try OpenVPN. I've used it going from OS X to Linux, and they say the server works great on FreeBSD.

share|improve this answer
Why the downvote? It's a valid answer, I would think... – Bill Weiss Nov 2 '10 at 16:12
up vote 1 down vote

Having set up IPSec in a simple tunnel mode between two hosts once, I swore I would try and stay away forever. In terms of alternatives to IPSec/IPSecuritas, you might want to investigate setting up a PPTP VPN, as Mac OS X (and other major operating systems) contain a PPTP client built-in. There are two good options for PPTP servers on FreeBSD:

  • net/mpd5 - my preferred option, based on the netgraph framework
  • net/poptop - the standard choice, available on Linux as well

OpenVPN is also a possibility, although I've never used it on Mac OS X and so can't comment on ease of set-up. A quick web search reveals a few GUI clients, so that might be worth investigating.

share|improve this answer
up vote 0 down vote

This is a fairly straight forward config on FreeBSD, if I understand you correctly. You want to create an IPSec (presuming tunnel mode) connection between your Apple and a FreeBSD machine, and because you have a dynamic IP for the Apple, you need to be able to authenticate the tunnel some how. I would presume you are using a PreShared key?

To perform client configuration (mode_cfg) I use racoon as the ISAKMP daemon on FreeBSD. This is part of the IPSEC-TOOLS package. It is available in the FreeBSD ports tree as 

Port:   racoon2-20090327c
Path:   /usr/ports/security/racoon2

You specify the Mode_CFG parameters in a separate section of the racoon.conf file. The setup is fairly straight forward on FreeBSD, if you understand the basics of IPSEC.

Points to bear in mind:

  • Your Kernel needs to have IPSEC and ESP compiled in.
  • You need to enable IP Forwarding (gateway_enable = "YES") in rc.conf.

And you should be able to make it all work... I have found FreeBSD to pretty stable as a VPN RAS server, and it is quite quick, compared to the smaller Cisco PIX firewalls (501/506/e)

share|improve this answer
raccoon was described in my original link, getting it to work is might be easy once you know what you doing and that is not my case, so when I start reading it, they said this is basically second phase of that article and first phase is to be able to make a connection from one host to another using GIF interface, but in order to do that I need to somehow tell FreeBSD that this IP can change, and thats where I'm getting into problems, before raccoon. raccoon helps to encrypt traffic between two hosts/networks – alexus Sep 13 '09 at 1:29
I have a working config like this (sans MOD_CFG) will look at that tomorrow and edit my answer. I am pretty sure that you need to get rid of those GIF interfaces to make it work (they are not really needed anyway if you are using ipsec-tools). In your setkey file, you need to specify the tunne parameter for the dynamic end as 0.0.0.0/0 and in racoon.conf user the "anonymous" keyword for both the policy and sa sections. – ColtonCat Sep 15 '09 at 8:08
up vote 0 down vote

I mostly use either IPsecuritas and pfSense. Or work via SSH Portforwarding. Look for the "-L" option.

share|improve this answer
IPsecuritas is for a client, I mainly need to know how to configure server side (FreeBSD) pfSense is a solution and can not be used in my case nor SSH Portforwarding as this is more like work around and very painful one especially if I need to do a lot of connections/ports dynamic ports – alexus Sep 8 '09 at 21:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.