5

I use dd-wrt as my home router setup and that's been working fine. Now I wanted to figure out a way to be able to use my iPad to set up a IPSec tunnel to my home network while I'm on the road.

PPTP is pretty much insecure at this point so I want to use something IPSec based. Based on what I can find, dd-wrt does not support IPSec. So I thought it might be possible to set up a linux box with racoon in my home network as the VPN terminator.

So in graphical form,

iPad (on the road) ------- [Internet] ------ [dd-wrt@home] ---- [linuxbox@home]

On dd-wrt, I've set up the following:

  • Forward both port 500 and 4500 to the linux box (udp/tcp)
  • SPI firewall is enabled
  • IPSec & L2TP passthrough are enabled

On the linux box, IPv4 forwarding is enabled

Here is the racoon setup

log debug;
#log notify;
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";

listen {
        adminsock disabled ;
}

mode_cfg {
        network4 192.168.1.210 ;
        pool_size 10 ;
        netmask4 255.255.255.0 ;
        dns4 192.168.1.1 ;
        wins4 192.168.1.11 ;
}

remote anonymous {
        exchange_mode aggressive ;
        #my_identifier fqdn "vpn.foo.org" ;
        peers_identifier fqdn "vpn.foo.org" ;
        lifetime time 24 hour ;
        proposal_check claim ;
        generate_policy on ;
        nat_traversal on ;
        dpd_delay 20 ;
        proposal {
                encryption_algorithm aes ;
                hash_algorithm sha1 ;
                authentication_method xauth_psk_server ;
                dh_group 2 ;
        }
}

sainfo anonymous {
        pfs_group 2;
        lifetime time 24 hour ;
        encryption_algorithm aes ;
        authentication_algorithm hmac_sha1 ;
        compression_algorithm deflate ;
}

So a pretty vanilla setup, I'll switch to using certs later.

Right now, looking at the logs, racoon starts up on the linux box fine but for whatever reason, it's not even seen any attempt at negotiating traffic with the iPad so I must be missing something here.

What I would like to know is to figure out what is missing. I suspect there needs to be some setup done on the dd-wrt box in order to send IP Protocol ID 50 & 51 traffic from it to the linux box.

I can't quite figure out the iptables rules required to forward IPSec to the VM.

I have the following but I suspect I need some prerouting and possibly some postrouting rules.

iptables -I FORWARD 23 -p 50 -d 192.168.1.10 -j ACCEPT
iptables -I FORWARD 23 -p 51 -d 192.168.1.10 -j ACCEPT

The following does not seem to work as expected.

iptables -t nat -I PREROUTING 2 -p 50 -d $(nvram get wan_ipaddr) -j DNAT --to 192.168.1.10
iptables -t nat -I PREROUTING 2 -p 51 -d $(nvram get wan_ipaddr) -j DNAT --to 192.168.1.10

Investigative notes:

  • It started off not being able to connect. I suspected that I needed to modify iptables but it is not necessary. Forwarding port 500 and 4500 to the endpoint is sufficient.
  • It looks like the first packet now does get to racoon.
  • tcpdump output "17:45:50.652827 IP wan.isakmp > 192.168.1.10.isakmp: isakmp: phase 1 I ident"
  • it looks like the negotiation then does begin BUT it just stops when trying to negotiate the encryption type. pastebin out of syslog for racoon: http://pastebin.com/RFmbJ7Hz
  • Now it is past the negotiation part and the tunnel is established after asking for auth. But traffic is not flowing.
  • After some more reading, I set the subnet in mode_cfg to a different subnet than the default one on the endpoint. I suspect I need to set a route if I want local machines to be able to talk to it.
  • Right now, my problem is that it looks like NAT-T is not working in that I can't get internet traffic.
3
  • Have you considered using OpenVPN? Does Apple not support it? That's what I use on my DD-WRT setup and it's been sufficient for my needs. It took me a minute to get over the idea of using third party software apposed to using built-in VPN capabilities. But, considering the hurdles (like the ones you're seeing) for getting IPSec setup, I decided to compromise. So, far it's been working great. Sep 24, 2016 at 19:33
  • I agree with David, if your os's support it go with OpenVPN. I was under the impression ipsec was also vunerable...mobile.enterprisenetworkingplanet.com/netsp/article.php/3504501/… Feb 9, 2018 at 17:40
  • I'm currently using pfsense for openvpn. Dd-wrt worked great for me when it was just my devices connecting. I now have +5 concurrent connections at any given period in the day. My poor ol dd-wrt router couldn't keep up with the encryption strength processing needs, and would frequently need to be rebooted. Feb 9, 2018 at 17:43

0

You must log in to answer this question.

Browse other questions tagged .