1

I am working on a project which needs to call a web service that can only be accessed whilst being connected via a VPN. The legacy platform that we're migrating from ran on OpenBSD and used the built-in IPSec tools to create the connection.

The following config is how the connection is established. Can anyone help me as to how I'd go about creating this VPN connection on a Windows 7 machine. I've been researching on-line but don't understand enough of the existing script to attempt creating the connection on Windows. I understand there used to be a tool called ipseccmd.exe which seems to have parameters that match some of these but I don't think this included in the later versions of Windows?

Here is the OpenBSD config extract: (I have the required IP addresses for the $variables etc.)

ike esp from $dev_server to $destination_lan peer $destination_peer \
        main auth hmac-md5 enc aes-256 group modp1024 \
        quick auth hmac-md5 enc aes-256 group modp1024 \
        psk "pre_shared_key_goes_here"

"

Improve this question

2 Answers 2

Reset to default
2

Use Windows Firewall's Connection Security Rules to configure IPsec on Windows 7.

Open the Start Menu, search for "Windows Firewall with Advanced Security". Open it. In the left-hand panel, right-click on "Windows Firewall with Advanced Security". Select "Properties". Open the tab labelled "IPsec Settings". Click on "Customize".

In the section labelled "Key exchange (Main Mode)", click "Customize".
Click "Add" and select "MD5" as the integrity algorithm, "AES-CBC 256" for the encryption algorithm, and "Diffie-Hellman Group 2" for the key exchange algorithm. Click "OK". Click "OK".

In the section labelled "Data protection (Quick Mode)", click "Customize".
Check "Require encryption for all connection security rules that use these settings".
Click "Add" and select "ESP", select "MD5" as the integrity algorithm, and select "AES-CBC 256" for the encryption algorithm.
Click "OK". Click "OK". Click "OK". Click "OK".

In the left-hand panel, right-click on "Connection Security Rules". Select "New Rule" Select "Tunnel". Click "Next>". Click "Next>". Click "Next>". Click "Add" and enter $dev_server. Click "OK". Click the upper "Edit" and enter $dev_server. Click on the lower "Edit" and enter $destination_peer. Click "Next>". Select "Advanced" and click "Customize". In the section labelled "First authentication", click "Add". Select "Preshared key". Enter the preshared key. Click "OK". Click "OK". Click "Next>". Click "Next>". Enter a name for the rule. Click "Finish"

EDIT: added steps to configure IPsec.

Improve this answer
6
  • 1
    Adding detail on how to accomplish the task would improve the answer.
    – Dave M
    May 29, 2015 at 18:52
  • Open Windows Firewall, right click on connection security rules, select new rule. Follow the wizard. (I don't mean to be so brief, but the question implies knowledge of IPsec and is trying to find it in Windows)
    – ztk
    May 29, 2015 at 20:56
  • Thanks for the answer but actually I have very little knowledge in this area. Do you know the steps needed to actually get this particular config set up as a rule in the Windows Firewall? Thanks
    – harman_kardon
    May 29, 2015 at 22:21
  • Thanks for the extra detail - will try this out at work tomorrow!
    – harman_kardon
    Jun 1, 2015 at 20:40
  • Where should the $destination_lan variable be used (e.g. 1.1.1.1./32) ?
    – harman_kardon
    Jun 8, 2015 at 8:38
1

alternately, use netsh advfirewall consec add rule from the command line. You get some useful help text when you type just that.

Note that you need the "advanced firewall" that comes with windows 7 professional (I think) and enterprise (I'm sure). I don't think it is part of the "home" edition.

It's a complicated topic, and the answer is going to depend on how the other end of your tunnel is configured. I'm not familiar with OpenBSD's ipsec implementation, but my guess is that you need to do "lan-to-lan" mode on windows, even though one of your endpoints is not a LAN, it's just a single machine. (technically, i guess it's a /32 LAN with one member :)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .