Re: linux-ipsec: Notes from _trying_ to install & configure Linux FreeS/WAN...

-----BEGIN PGP SIGNED MESSAGE-----
> On Wed, 25 Nov 1998, Richard Guy Briggs wrote:

Well, we could simply say you need to compile your kernel. Aside from that, check for patch.

> > Right, make the kernel first and make sure it works, steps 1, 3, 4, 5 say

Good.

> > I'm thinking the nexthop parameter should disappear and the automatic I/F

There is usually a route that will route for a particular address, no matter how general. I hesitated before including the word 'default' in the previous statement since 'default' has special meaning. If I want to route to 192.168.5.0/24, a route to 192.168.0.0/16 will catch it and the latter's gateway will work for a more specific route to 192.168.5.0/24.

> > Alright...mcr and I have been talking about updating tcpdump-ascii, I will

The ascii extensions were added to easily see if things are recognisable where it is not so obvious from a hex dump.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek

> > Hmmm, this nexthop stuff has to be automated...

The only case I can think of is if a particular subnet is not visible at all before running any route command. For example, I have 3 ethernets on my firewall (some have more). I make sure I can see everything I need to prior to adding a cryptotunnel. If I have to route to a reserved address, then I set up an IPIP tunnel to get them there. Here is my routing table:

# route -n
Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.2.0     0.0.0.0         255.255.255.0   U     0      0       42 eth0
192.168.4.0     192.168.2.110   255.255.255.0   UG    1      0        0 eth0
192.168.3.0     0.0.0.0         255.255.255.0   U     0      0        3 eth1
207.236.55.0    0.0.0.0         255.255.255.0   U     0      0       62 eth2
192.168.1.0     192.168.2.103   255.255.255.0   UG    0      0      248 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0       10 lo
0.0.0.0         207.236.55.1    0.0.0.0         UG    1      0     2727 eth2

If I want to route to 192.168.1.0/24 or 192.168.4.0, I have to replace an existing route, using its gateway. If I want to route to 192.168.3.0/24, I replace the existing route, using the bsd notation of gateway, which is the address of the physical address to which it is attached. If I want to route to 209.xxx.xxx.xxx/24, I don't replace a route, but rather use the default route and its gateway.

> > It looks like KLIPS was static linked and one of the startup scripts tried

Test for any file called /proc/net/ipsec_*.

> Henry Spencer

        slainte mhath, RGB
- --

Richard Guy Briggs -- PGP key available                Auto-Free Ottawa! Canada
rgb at conscoop dot ottawa dot on dot ca                <
http://flora.org/afo/>

Do you need more help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQCVAwUBNl3T5N+sBuIhFagtAQFHDgP/altShWDdlJSxluKr58uehTqiozMdFUfE 6zFt8H+cthJbj1twwmNaM3t4HUlG+OGhyMd5JPA2PZLETBsPOXboP8LfdYoW+6FG gtIPrr5ewxJ20rn2UOXSzHfBg90mYYrhtTnfv5Hw+bu7YWx3khQQ3FU16Fw2TSUc fVelhVEoeKs=
=nUDg
-----END PGP SIGNATURE----- Received on Thu Nov 26 17:56:20 1998