OpenSWAN tips and tricks Research

• 2016-04-30

IPSec is a nice technology providing secure access to other subnets or hosts.
Recently I had to work on many different configurations for openswan. I can’t say documentation out there is full enough to cover every single question. Here are my tips and tricks.

In this article left is an alias for local-side (our PC), while generally it is not. I assume that you have read man ipsec.conf

Generic tips

1. Make sure you fulfill virtual_private with allowed subnets correctly.
   For IPv4 it is: %v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16 and then add v4:!192.168.1.0/24-like entries separated by comma.
   For IPv6:
   %v6:FD00::/8
2. Force keepalive packets if you use cellular connection or you’re NATed.
   force_keepalive=yes<br /> keep_alive=10
   Also, modify Dead Peer Detection accordingly.
   dpddelay=10<br /> dpdtimeout=480
   This really helped me to get connections based on 3G modem work flawlessly.
3. *nexthop for ppp connections is peer itself.
4. It is better to include rightnexthop in case if right is IP. For FQDN, OpenSWAN will do the job.
5. AES is faster for most architectures except if it is hardware-accelerated. For NETKEY kernel crypto is working by default, and for KLIPS you would like to insmod cryptodev (or even cryptosoft).
6. For L2TP/IPSec client, be specific with open ports: leftprotoport=17/1701. For L2TP/IPsec server, be less specific: leftprotoport=17/%any.
   Same rule applies to to other side:
   For L2TP/IPSec client, use rightprotoport=17/1701, and rightprotoport=17/%any for server.
7. Make sure you have a good route (and/or routing rule) to peer. Some environments might work well until actual connection is established, and then they change routes, making route to peer tunnelled. It mustn’t be tunnelled.
   (For KLIPS it is a bit harder to manage).
8. XFRM (Netkey) stack is hard to manage in some environments (i.e. gateways). Sometimes I prefer KLIPS for that.
9. For KLIPS, disable rp_filter. There are other good security advices, but without it it won’t work at all.

Certificate tips

1. If you wish to install certificates on Android, you’d want to have critical,CA:FALSE (or TRUE)-like extension in your certificate.
2. Set correct IDs for both sides (leftid and rightid). It is really critical. It totally depends on the server side. I usually prefer %fromcert designation, which instructs openswan to insert full description of certificate of the side
3. Don’t forget to configure date 🙂

Not all tricks are mentioned here, but it is majority of things found during development. Other details can be easily found in the internet.