Next Previous Contents

---

Linux VPN Masquerade HOWTO

John D. Hardin <jhardin@wolfenet.com>

$Revision: 2.19 $ $Date: 2000-10-22 12:07:43-07 $

---

How to configure a Linux firewall to masquerade IPsec- and PPTP-based Virtual Private Network traffic, allowing you to establish a VPN connection without losing the security and flexibility of your Linux firewall's internet connection and allowing you to make available a VPN server that does not have a registered internet IP address. Brief information on configuring the VPN client and server is also given.

---

1. Introduction

• 1.1 Introduction
• 1.2 Feedback, Credits & Resources
• 1.3 Copyright & Disclaimer

2. Background Knowledge

• 2.1 What is a VPN?
• 2.2 What is IPsec?
• 2.3 What is PPTP?
• 2.4 What is FWZ?
• 2.5 Why masquerade a VPN client?
• 2.6 Can several clients on my local network use IPsec simultaneously?
• 2.7 Can several clients on my local network use PPTP simultaneously?
• 2.8 Can I access the remote network from my entire local network?
• 2.9 Why masquerade the VPN server?
• 2.10 Why patch the Linux kernel?
• 2.11 Current Status

3. Configuring the Linux firewall

• 3.1 Example network
• 3.2 Determining what needs to be done on the firewall
• 3.3 Patching and configuring the 2.0.x kernel for VPN Masquerade support
• 3.4 Patching and configuring the 2.2.x kernel for VPN Masquerade support
• 3.5 ipfwadm setup for a Private-IP VPN Client or Server
• 3.6 ipchains setup for a Private-IP VPN Client or Server
• 3.7 A note about dynamic IP addressing
• 3.8 Additional setup for a Private-IP VPN Server
• 3.9 ipfwadm setup for a Registered-IP VPN Server
• 3.10 ipfwadm setup for a Registered-IP VPN Client
• 3.11 ipchains setup for a Registered-IP VPN Server
• 3.12 ipchains setup for a Registered-IP VPN Client
• 3.13 VPN Masq and LRP
• 3.14 VPN Masq on a system running FreeS/WAN or PoPToP

4. Configuring the VPN client

• 4.1 Configuring a MS W'95 client
• 4.2 Configuring a MS W'98 client
• 4.3 Configuring a MS W'ME client
• 4.4 Configuring a MS NT client
• 4.5 Configuring for network-to-network routing
• 4.6 Masquerading Checkpoint SecuRemote-based VPNs

5. Troubleshooting

• 5.1 Testing
• 5.2 Possible problems
• 5.3 Troubleshooting
• 5.4 MS PPTP Clients and domain-name issues
• 5.5 MS PPTP Clients and Novell IPX
• 5.6 MS network password issues
• 5.7 If your IPsec session always dies after a certain amount of time
• 5.8 If VPN masquerade fails to work after you reboot
• 5.9 If your second PPTP session kills your first session

6. IPsec masquerade technical notes and special security considerations

• 6.1 Limitations and weaknesses of IPsec masquerade
• 6.2 Proper routing of inbound encrypted traffic

---

Next Previous Contents
Linux HOWTO full list