NAT на моём роутере делает Packet Filter: nat on $ext_if from <lan_net> to any -> $ext_if
pass out
Конфигурацию не выкладывал, т. к. всё делал по статье один в один. Но для наглядности, вот моя конфигурация (10.1.1.99 - IP-адрес моей FreeBSD-машины):
racoon.conf:
path include "@sysconfdir_x@/racoon";
path pre_shared_key "@sysconfdir_x@/racoon/psk.txt";
log debug;
padding
{
maximum_length 20;
randomize off;
strict_check off;
exclusive_tail off;
}
listen
{
isakmp 10.1.1.99 [7001];
isakmp 10.1.1.99 [500];
isakmp_natt 10.1.1.99 [4500];
}
timer
{
counter 5;
interval 20 sec;
persend 1;
phase1 30 sec;
phase2 15 sec;
}
remote Re.mote.Server.IP
{
exchange_mode main,aggressive;
doi ipsec_doi;
situation identity_only;
my_identifier address 10.1.1.99;
peers_identifier address Re.mote.Server.IP;
proposal_check obey;
passive off;
generate_policy off;
lifetime time 1 min;
proposal {
encryption_algorithm aes;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group modp2048;
}
}
sainfo anonymous
{
pfs_group modp2048;
encryption_algorithm 3des;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
}
psk.txt:
Re.mote.Server.IP myPresharedKey
ipsec.conf:
flush;
spdflush;
spdadd 0.0.0.0/0 0.0.0.0/0[1701] any -P out ipsec esp/transport//require;
spdadd 0.0.0.0/0[1701] 0.0.0.0/0 any -P in ipsec esp/transport//require;
mpd.conf:
startup:
log +ALL +EVENTS -FRAME -ECHO
default:
load L2TP_client
L2TP_client:
create bundle static B1
create link static L1 l2tp
set link action bundle B1
set auth authname "myName"
set auth password "myPassword"
set link max-redial 0
set link mtu 1460
set link keep-alive 20 75
set l2tp peer Re.mote.Server.IP
open
