VPN tunnel with Windows XP IPSEC and FreeS/WAN

By Samuli Kaski < E-mail address

>
Created Thu Jan 6 00:04:18 EET 2005
Last edited

Introduction

Debian Woody and kernel 2.4.27 was used while writing this article. Depending on your Linux distribution the steps needed to setup a VPN tunnel with Windows XP IPSEC and FreeS/WAN might be a bit different.

Restrictions

The following setup was implemented on a Windows XP workstation with a PPoE connection that has to be opened through Windows XP's Network Connections. Windows XP's integrated firewall can be used if desired. Other network setups might be possible however the configuration might differ from the one described in this document.

Windows XP requirements

You have to update your IPSEC client by installing the latest patch provided by Microsoft. You can download the patch here. You will have to reboot your computer after installing the patch.

FreeS/WAN configuration

You will need to restart your computer after installing the correction. Start by configuring FreeS/WAN on your Linux server. Configure /etc/ipsec.conf

version 2.0     # conforms to second version of ipsec.conf specification

config setup
        klipsdebug=none
        plutodebug=none
        overridemtu=1410

conn %default
        keyingtries=1

conn sample
        right=%any
        left=%defaultroute
        authby=secret
        auto=add
        keylife=24.0h
        rekey=no
        keyingtries=0
        pfs=no

conn packetdefault
        auto=ignore

conn private-or-clear
        auto=ignore

The overridemtu setting was required at least in my case. Without that setting connections sometimes froze and I was unable to transfer large files. Set the preshared passkey in /etc/ipsec.secrets

: PSK "mysecret"

Windows XP configuration

Now launch MMC on Windows XP and add the IP Security Policy Management Snap-in. Configure the Snap-in for Local computer.

Edit...

Settings...

Edit...

Now the other direction...

Edit...

There is no need to edit the My Filter Action, it is valid for this direction also.

Adjust the policy change and press Advanced.

Adjust the settings to reflect the FreeS/WAN settings on your Linux server. Press Methods.

Set the preference order.

Assign to activate the IP Security Policy

It is now active. Test:

Troubleshooting

If you use SSH you may need to activate TCP keepalive. I don't know the specifics but if the link doesn't have any activity the IPSEC connection seems to die off. Setting the TCP keepalive in PuTTY (or any other SSH client) to 30 seconds has fixed the problem at least for me.

Back to the Linux advice portal...