Advice for VPN - RTNETLINK error

[sandman42]

Hi,
I'd need to set up a VPN in order to allow a remote commuter linux box running FC4 to connect to headquarter LAN.

Remote has a router and a dynamic public address, while the private is fixed, and headquarter has a zyxel firewall where the vpn is set up.

I'm trying to set up an IPSec tunnel using a preshared key that is a clear text password

Pratically speaking, remote is:

IP: 192.168.2.2/24
Default GW is: 192.168.2.1 (the router)
public IP: dynamic

Headquarter has:

firewall public IP: 1.2.3.4 (fake of course!)
firewall private IP: 192.168.1.1
private network is 192.168.1.0/24

The question is:
how should I fill the ipsec wizard fields in Desktop -> Ssystem settings -> Network, IpSec tab?

What I do is to select network to network encryption, then manual encrytion with a fixed key, then:

Local network address 192.168.2.0
Local subnet mask 255.255.255.0
Local network gateway: 192.168.2.1

In the next page I set:

Remote IP address: 1.2.3.4
Remote network address: 192.168.1.0
Remote subnet mask 255.255.255.0
Remote network gateway 192.168.1.1

In the next page I set authentication and encryption pw and leave the other fields blank
After applying all, if I click on activate I have and error: RTNETLINK: invalid argument

Of course, nothing works, while trying with a windoze client with the same settings as the linux box and safenet remote lt as client everything works.

What am I doing wrong? :confused: :confused:
Should I use another way to set up VPN? Which client should I use? I have read somewhere that openvpn does not work with zywall firewalls.

Could U please help me?

Thanks in advance!

sandman

[Vuke69]

The /etc/sysconfig/network-scripts/ifup-ipsec script is incorrect.

The src has to be local to the box, or ip route will fail.

For IPSEC tunnels I use the local ip on the internal side of the endpoint to use as the source. eg., if your firewall/endpoint has two interfaces, eth0 on the local network 192.168.1.1, and eth1 on the internet 24.24.24.24, use 192.168.1.1 for the src address.

To fix this edit the script as follows.

At about line 111 add the following:
if [ -z "$FSRC" ]; then
FSRC=`ip -o route get to $SRCNET | sed "s|.*src \([^ ]*\).*|\1|"`
fi


Then at about line 154 & 209 change:
ip route add to $DSTNET via $SRCGW src $SRCGW
to
ip route add to $DSTNET via $SRCGW src $FSRC

Good luck
Reply With Quote