I need to be able to VPN in to my FreeBSD server from my Mac using IPSecuritas. I was wondering if anyone ever done something, I'm reading VPN over IPsec but that mainly covers if you had 2 nodes with 2 public IP address. My endpoint in IPSecuritas configured with MODE_CFG enabled so it'll have the other node to query my address from it's coming from. SSH is out of question, this is not a VPN solution, people who'd end up using VPN wouldn't know what to do, so I need very simple VPN the one that you get to use almost anywhere, you have a client and you have server, client makes a connection to server and boom, you in...
Having set up IPSec in a simple tunnel mode between two hosts once, I swore I would try and stay away forever. In terms of alternatives to IPSec/IPSecuritas, you might want to investigate setting up a PPTP VPN, as Mac OS X (and other major operating systems) contain a PPTP client built-in. There are two good options for PPTP servers on FreeBSD:
net/mpd5- my preferred option, based on the netgraph framework
net/poptop- the standard choice, available on Linux as well
OpenVPN is also a possibility, although I've never used it on Mac OS X and so can't comment on ease of set-up. A quick web search reveals a few GUI clients, so that might be worth investigating.
Try OpenVPN. I've used it going from OS X to Linux, and they say the server works great on FreeBSD.
This is a fairly straight forward config on FreeBSD, if I understand you correctly. You want to create an IPSec (presuming tunnel mode) connection between your Apple and a FreeBSD machine, and because you have a dynamic IP for the Apple, you need to be able to authenticate the tunnel some how. I would presume you are using a PreShared key?
To perform client configuration (mode_cfg) I use racoon as the ISAKMP daemon on FreeBSD. This is part of the IPSEC-TOOLS package. It is available in the FreeBSD ports tree as
Port: racoon2-20090327c Path: /usr/ports/security/racoon2
You specify the Mode_CFG parameters in a separate section of the racoon.conf file. The setup is fairly straight forward on FreeBSD, if you understand the basics of IPSEC.
Points to bear in mind:
- Your Kernel needs to have IPSEC and ESP compiled in.
- You need to enable IP Forwarding (gateway_enable = "YES") in rc.conf.
And you should be able to make it all work... I have found FreeBSD to pretty stable as a VPN RAS server, and it is quite quick, compared to the smaller Cisco PIX firewalls (501/506/e)
I've used OpenVPN and OpenVPN-AS extensively on FreeBSD gateways and a variety of clients. AS is a commercial option, but the client is better with more comprehensive support than that of the standard OpenVPN client. Setting it up really is a doddle with the instructions.
The commercial client is at http://www.openvpn.net/index.php/access-server/download-openvpn-as.html