Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use dd-wrt as my home router setup and that's been working fine. Now I wanted to figure out a way to be able to use my iPad to set up a IPSec tunnel to my home network while I'm on the road.

PPTP is pretty much insecure at this point so I want to use something IPSec based. Based on what I can find, dd-wrt does not support IPSec. So I thought it might be possible to set up a linux box with racoon in my home network as the VPN terminator.

So in graphical form,

iPad (on the road) ------- [Internet] ------ [dd-wrt@home] ---- [linuxbox@home]

On dd-wrt, I've set up the following:

  • Forward both port 500 and 4500 to the linux box (udp/tcp)
  • SPI firewall is enabled
  • IPSec & L2TP passthrough are enabled

On the linux box, IPv4 forwarding is enabled

Here is the racoon setup

log debug;
#log notify;
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";

listen {
        adminsock disabled ;

mode_cfg {
        network4 ;
        pool_size 10 ;
        netmask4 ;
        dns4 ;
        wins4 ;

remote anonymous {
        exchange_mode aggressive ;
        #my_identifier fqdn "" ;
        peers_identifier fqdn "" ;
        lifetime time 24 hour ;
        proposal_check claim ;
        generate_policy on ;
        nat_traversal on ;
        dpd_delay 20 ;
        proposal {
                encryption_algorithm aes ;
                hash_algorithm sha1 ;
                authentication_method xauth_psk_server ;
                dh_group 2 ;

sainfo anonymous {
        pfs_group 2;
        lifetime time 24 hour ;
        encryption_algorithm aes ;
        authentication_algorithm hmac_sha1 ;
        compression_algorithm deflate ;

So a pretty vanilla setup, I'll switch to using certs later.

Right now, looking at the logs, racoon starts up on the linux box fine but for whatever reason, it's not even seen any attempt at negotiating traffic with the iPad so I must be missing something here.

What I would like to know is to figure out what is missing. I suspect there needs to be some setup done on the dd-wrt box in order to send IP Protocol ID 50 & 51 traffic from it to the linux box.

I can't quite figure out the iptables rules required to forward IPSec to the VM.

I have the following but I suspect I need some prerouting and possibly some postrouting rules.

iptables -I FORWARD 23 -p 50 -d -j ACCEPT
iptables -I FORWARD 23 -p 51 -d -j ACCEPT

The following does not seem to work as expected.

iptables -t nat -I PREROUTING 2 -p 50 -d $(nvram get wan_ipaddr) -j DNAT --to
iptables -t nat -I PREROUTING 2 -p 51 -d $(nvram get wan_ipaddr) -j DNAT --to

Investigative notes:

  • It started off not being able to connect. I suspected that I needed to modify iptables but it is not necessary. Forwarding port 500 and 4500 to the endpoint is sufficient.
  • It looks like the first packet now does get to racoon.
  • tcpdump output "17:45:50.652827 IP wan.isakmp > isakmp: phase 1 I ident"
  • it looks like the negotiation then does begin BUT it just stops when trying to negotiate the encryption type. pastebin out of syslog for racoon:
  • Now it is past the negotiation part and the tunnel is established after asking for auth. But traffic is not flowing.
  • After some more reading, I set the subnet in mode_cfg to a different subnet than the default one on the endpoint. I suspect I need to set a route if I want local machines to be able to talk to it.
  • Right now, my problem is that it looks like NAT-T is not working in that I can't get internet traffic.
share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.