From: Alex Borisov <abmagic@rambler.ru>
To: ALT Linux sysadmin discuss <sysadmins@lists.altlinux.org>
Subject: Re: [Sysadmins] Построить VPN.
Date: Sun, 18 Feb 2007 00:39:19 +0300
Message-ID: <507235206.1171748359.174269240.85305@mcgi23.rambler.ru> (raw)
In-Reply-To: <138560639.1171746410.157091780.81236@mcgi17.rambler.ru>
* Alex Borisov <abmagic@rambler.ru> [Sun, 18 Feb 2007 00:06:50 +0300]:
> > Есть необходимость построить VPN...
> > С одной стороны (филиал) имеем:
> > D-Link DSL-524T, 3 рабочие станции (не Linux).
> > D-Link обеспечивает выход в Инет в режиме маршрутизатора,
> > получает динамический адрес.
>
> я бы поставил в филиале linux-маршрутизатор с openswan
> инициатор соединения филиал (так как адрес динамический),
> авторизация по RSA
в общем можно попробовать что-то вроде этого:
в филиале:
nat_traversal=yes
conn head
type=tunnel
rekey=no
# Left security gateway, subnet behind it, next hop toward
right.
# головной офис
left=<IP_adress_HEAD_linux_box>
leftnexthop=<IP_adress_gateway_HEAD_office>
leftsubnet=192.168.1.0/24
leftid=@head.firma.ru
leftrsasigkey="0 ................."
# Right security gateway, subnet behind it, next hop toward
left.
# филиал
right=<IP_adress_linux_box>
rightnexthop=<IP_adress_LAN_DLINK>
rightsubnet=192.168.2.0/24
rightid=@filial.firma.ru
rightrsasigkey="0"
authby=rsasig
auto=start
# =======================
в головном офисе:
nat_traversal=yes
conn filial
type=tunnel
rekey=no
# Left security gateway, subnet behind it, next hop toward
right.
left=%any
leftsubnet=192.168.2.0/24
leftid=@filial.firma.ru
leftrsasigkey="0.........."
# Right security gateway, subnet behind it, next hop toward
left.
right=<IP_adress_HEAD_linux_box>
rightnexthop=<IP_adress_gateway_HEAD_office>
rightsubnet=192.168.1.0/24
rightid=@head.firma.ru
rightrsasigkey="0..................
authby=rsasig
auto=add
----------------------
next prev parent reply other threads:[~2007-02-17 21:39 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-02-17 16:16 Dmitriy L. Kruglikov
2007-02-17 21:06 ` Alex Borisov
2007-02-17 21:39 ` Alex Borisov [this message]
2007-02-19 6:46 ` Dmitriy L. Kruglikov
2007-02-19 9:43 ` Глодин С.В.
2007-02-19 9:54 ` Dmitriy L. Kruglikov
2007-02-17 23:38 ` Nikolay A. Fetisov
2007-02-18 3:30 ` Вадим Илларионов
2007-02-19 2:45 ` Вадим Илларионов
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=507235206.1171748359.174269240.85305@mcgi23.rambler.ru \
--to=abmagic@rambler.ru \
--cc=sysadmins@lists.altlinux.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
ALT Linux sysadmins discussion
This inbox may be cloned and mirrored by anyone:
git clone --mirror http://lore.altlinux.org/sysadmins/0 sysadmins/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 sysadmins sysadmins/ http://lore.altlinux.org/sysadmins \
sysadmins@lists.altlinux.org sysadmins@lists.altlinux.ru sysadmins@lists.altlinux.com
public-inbox-index sysadmins
Example config snippet for mirrors.
Newsgroup available over NNTP:
nntp://lore.altlinux.org/org.altlinux.lists.sysadmins
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git