Windows 2000 / Windows XP - Freeswan VPN
http://vpn.ebootis.de/

Visit my new project: Universal Infrared Transceiver for PC systems:http://www.irtrans.de


On this page you get everything needed to use Windows 2000 / XP as VPNClient for Freeswan – even as Road Warrior!

Prerequisites Windows 2000:

• Windows 2000     Client PC
• Windows 2000     Service Pack 2
       To be found at: http://www.microsoft.com/windows2000/downloads/servicepacks/sp2/sp2lang.asp
• Windows 2000     ipesecpol.exe Tool Version 1.22
       This tool is included in the Windows 2000 Resource Kit.
       You also find it here: http://agent.microsoft.com/windows2000/techinfo/reskit/tools/existing/ipsecpol-o.asp
• Freeswan 1.96     on your LINUX / UNIX Server
       Download at: http://www.freeswan.org/download.html
• Installed     X.509 Patch for freeswan 1.96
       You find it here: http://www.strongsec.com/freeswan/
• OpenSSL
  0.9.6b
       Found at: http://www.openssl.org
• Windows 2000     VPN Tool
       Download it here: http://vpn.ebootis.de/package.zip
• Source code     of the VPN Tool (not needed)
       Get it here: http://vpn.ebootis.de/source.zip

Prerequisites Windows XP:

• Windows XP     Client PC (Home edition should work but was not yet checked)
• Ipeseccmd     program
       You have to install the Win XP Support tools. They reside on your Win XP     CD in the directory \SUPPORT\TOOLS.
       Just start setup.exe in this directory. You have to select a Complete     installation to get ipseccmd.
• Freeswan 1.96     on your LINUX / UNIX Server
       Download at: http://www.freeswan.org/download.html
• Installed     X.509 Patch for freeswan 1.99
       You find it here: http://www.strongsec.com/freeswan/
• OpenSSL
  0.9.6b
       Found at: http://www.openssl.org
• Windows 2000     VPN Tool
       Download it here: http://vpn.ebootis.de/package.zip
• Source code     of the VPN Tool (not needed)
       Get it here: http://vpn.ebootis.de/source.zip

I supply the ipsec.exe underGPL (GnuPublicLicense).
If someone develops toolsbased on my source code he might do so, when he is:
·
Offering this code under GPL
·
Sending me copies of his modifications
·
Delivering my source code together with his additions


Installation Instructions

• Install     Windows 2000 Service Pack 2. It is mandatory to install this service pack     or at least a Windows 2000 high encryption package to support the 3DES     encryption which is needed by FreeSwan. There is no service pack needed on     Windows XP.
• Install     FreeSwan 1.96 on your LINUX / UNIX Box.
• Apply the     X.509 Certificate Patch and compile the fswcert tool
• Generate the     Certificates.
  For Instructions     click here.
• Make a     directory C:\Programme\VPN
• Install the     ipsecpol.exe Tool in this directory
• Unpack my VPN     tool in this Directory
• Import your     PC Certificate on the Windows 2000 Client using my supplied ipsec.msc Management Console plug-in.     It is important to use the option “automatically     select the certificate store based on the type of certificate”, so that     the Root CA goes into the right Directory. In German it is called     “Zertifikatsspeicher automatisch auswählen”. You have to enter your     Export-Password for the private key. After the import you will find to     certificates: Your Root CA in the CA Directory and your Client Certificate     in your private Certificate Directory

Important:Always use the management console to import certificates. A simple double-clickon the certificate will not work!!!!!
Afterimporting the certificate get the DSN (Name like /C=… /ST=….) the MMC displaysfor the ROOT CA. You will need this ID for your W2k ipsec.conf.

• Update     “ipsec.conf” to reflect your configuration. You find the syntax here.
• Make an entry     for your client on your FreeSwan Server
• After you     established your internet Connection start the “ipsec.exe” tool in the     ipsec directory. The tool now looks up your IP Configuration and sets up     the IPSec Tunnel based on your Configuration. – That’s it!!
• To delete the     policies you may call “ipsec.exe     –delete”. In the same way “ipesec.exe     –off” disables the policy

There is another good How-To byNate Carlson describing the whole setup procedure (FreeSwan & Win2K usingmy IPSec Tool).
You find it here: http://www.natecarlson.com/include/showpage.php?cat=linux&page=ipsec-x509



Suggestions and corrections: marcus@ebootis.de

Marcus Müller

Last Change:  11.04.2003
18:30:00 MESZ

History:
04.10.2001
Created.
04.10.2001
Added new Version ofipsec.exe which supports English Windows 2000
05.10.2001
added the Source codeand description of the –delete and –off options.
05.10.2001
Fixed another Englishlanguage bug with PPP & LAN Connections active at the same time
01.11.2001
Added Support forWindows XP (see note above)
01.11.2001
Added Support forPreshared Keys (see ipsec.conf syntax here.)
06.11.2001
Extended descriptionof Windows XP support
06.11.2001
Automatic detectionof Window XP (ipseccmd instead of ipsecpol)
24.01.2002
New syntax forright/leftid: Now rightca & leftca are supported. Also new syntax for CNs.
26.02.2002
Some minor bug fixes
04.03.2002
New major Release2.0.0 with a lot of new Features:

1. RAS-APIto get the active IP Address – No more language dependent problems!!!

2. Newoption “rekey” in ipsec.conf to specify rekeying interval

3. Newoption “authmode” to select MD5 or SHA as authorization Mode

4. Supportfor Freeswan syntax style netmasks: a.b.c.d/24 in converted intoa.b.c.d/255.255.255.0

5. Support forDNS-Names as Tunnel Endpoint on the FreeSwan Side
19.03.2002
Version 2.0.1 newdebugging mode: ipsec –debug to discover ipseccmd syntax errors
10.04.2002
Version 2.1.1supports Automatic Dialup of RAS Connection !
15.04.2002
Version 2.1.2 probesthe chosen RAS connection before dialing
30.04.2002
Version 2.1.4Includes Fix for rekeying problems when using PFS
11.04.2003    Version 2.2.0    Adds new ipsec.conf option to specify MAC address of LAN interface to use !!!
                                                    New commandline parameter -nosleep to suppress 10s wait after running configuration.   


Windows / Windows 2000 / Windows XP are trademarks of Microsoft Corp.

                                                                               

Get it FREE, set up takes just a few minutes...

You are now ready to download the IronDoor Agent software.

Enter name and email address - Completed.                                                                                                                                                                                                                Click "Download IronDoor Agent" to begin the download.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Requirements:                                                                                         Windows XP Pro, SP2 or higher                                                                                         Windows 2003, SP1 or higher                                                                                         Windows 2000, SP3 or higher                                                                                         Microsoft .NET Framework version 2.0                                                                                         Note: You will be automatically prompted to install the .NET Framework if it is not                                                                                         currently                                                                                                                                                                                 installed. This could add several minutes to the IronDoor Agent install process.                                                                                                                                                                                                                 When prompted, click "Run" to begin the installation.