Vpnc/es

Este documento detalla como conectar una estación de trabajo a un concentrador VPN Cisco utilizando vpnc para gestionar la conexión

Introducción
Este documento está orientado a usuarios que quieren conectarse a la red de su oficina desde casa o durante un viaje. Muchas compañías utilizan concentradores VPN Cisco 3000 para las necesidades de VPN, y estoy dispuesto a apostar que los novatos de Linux piensan que están forzados a usar Windows para conectarse a ellas. Bueno, este documento explica que la conexión a las VPN de Cisco es definitivamente posible y seguramente podrá configurar un túnel productivo usando una estación de trabajo o portátil con Gentoo.

Que es este documento

 * Una guía para el trabajo básico de vpnc
 * Un debate sobre los problemas de VPN relativos a DNS y enrutamiento
 * Ejemplos de como gestionar sesiones VPN
 * Consejos y trucos útiles (esperemos)

Que no es este documento

 * Una guía profunda para tecnologías de VPN/encriptación
 * Una explicación característica a característica de vpnc

Supuestos
Las hipótesis formuladas en este punto son:


 * Gentoo está instalado
 * Se dispone de acceso a Internet y está correctamente configurado
 * Se realiza la conexión hacia un concentrador VPN Cisco 3000
 * El lector es capaz de configurar, construir e instalar un nuevo núcleo

Núcleo
Para que Linux sea capaz de abrir una conexión VPN se debe habilitar en el núcleo la opción "Universal TUN/TAP device driver". ¿Que es y por que se necesita?. A continuación se muestra una explicación relativamente sencilla desde la opción de configuración del núcleo.

When a program opens /dev/net/tun, driver creates and registers corresponding net device tunX or tapX. After a program closed above devices, driver will automatically delete tunXX or tapXX device and all routes corresponding to it. }}

Para verificar que el núcleo dispone de soporte TUN/TAP, hacer grep en el fichero de configuración del núcleo:

Como se puede ver arriba,  está compilado como módulo. Si estuviera deshabilitado en la configuración, habilitar la opción en el núcleo, reconstruir, instalar, reiniciar y volver a este documento antes de continuar con los siguientes pasos.

Si se construye el soporte TUN/TAP directamente en el núcleo, la salida de la orden debería ser similar a la siguiente:

Si el soporte de TUN/TAP se construye como módulo, entonces se debe cargar en primer lugar el módulo :

Ahora que el módulo :

Configuración
In order to make the following sections more clear, we need an example setup to work from. For the purpose of this exercise, we will assume that the home network consists out of several computers. All computers are on the 192.168.0.0 / 255.255.255.0 network. The LAN in question is run by a Gentoo box using an iptables firewall, DHCP, caching DNS, etc ... and it masquerades the LAN behind the public IP address it receives from an ISP. A workstation is also on the LAN from which the VPN into the office will be configured.

Our example workstation configuration looks like the following:

vpnc
Now that vpnc is installed and we have an example to work from, let's discuss the basics of setting up vpnc. The configuration file for vpnc connection settings can be located in a couple places, depending on how many profiles need to be configured. By default, vpnc looks for for its connection settings. This setup will only address a single profile example and will use the configuration file location.

The configuration file example above should be modified to reflect the appropriate values for the local setup. The gateway option  can be a fully qualified domain name or an IP address. The ID and secret options should be given by a network administrator. If this information cannot be obtained but a working setup on a Windows box is available which utilizes the official Cisco VPN client, then it suffices to export the profile. The user name and password options are for the normal network sign-on, such as a Windows NT domain account.

When the profile is exported from a Windows machine, then the result is most likely a file ending in. This file will have all the necessary information. Below is an example:

In the above example, we can see entries for,  , and. The  and   may or may not be exported depending on the setup. To generate a working vpnc configuration out of it, use, included with vpnc.

Testing the setup
Now that a configuration is in place it is time to test the setup. To start do the following:

The above command output shows that, once (as root) is executed, a prompt comes up asking for a password. After entering the password (which will not be echoed to the terminal), the process will automatically become a background process.

As can be seen from the above command output(s), has done the following:


 * Created the tun0 network interface, a virtual interface to handle the traffic across the VPN tunnel
 * Obtained the IP address for the tun0 device from the VPN provider
 * Set the default route to the VPN gateway

At this point, the workstation is capable of communicating with hosts via the VPN. Because sets the default route to the VPN gateway, all network traffic will travel across the VPN, even if it destined for the Internet or elsewhere not specifically specified by additional routes. For some, this basic type of connection may be satisfactory, but for most, additional steps need to be taken.

Additional things that might be interesting to have:


 * DNS for the VPN
 * A routing setup that will only send traffic destined for the VPN down the virtual tunnel. This way, browsing the Internet will originate directly from the local network even when connected to the VPN, without the personal web/p2p etc. traffic going across the tunnel.
 * A script to manage all this, because just doesn't do enough by default.

To end the VPN session, execute. An example is shown below.

Set up DNS
Unfortunately, doesn't handle the setup and management of DNS for the newly established tunnel. The user is left to decide how DNS should be handled. Although can be written during the connection, that would utilize the VPN DNS for all DNS queries regardless of whether or not the traffic is destined for the VPN tunnel. This is a very functional solution and if all that is needed is to connect to the tunnel, work, and then disconnect, read no further. But, to be able to leave the tunnel connected for lengthy periods of time without the work DNS servers handling requests for the personal traffic, read on.

The ideal setup would allow users to separate the DNS queries into two categories: VPN-related and other. Under this setup, all VPN-related DNS queries would be answered by DNS servers located at the other end of the VPN tunnel and all other queries would continue to be answered by local or ISP supplied DNS servers. This is the setup that will be demonstrated here.

So how to make sure that requests made to hosts on the example.org domain get sent to VPN supplied DNS servers? Well, first install a local DNS server, but don't worry, it's much easier than it sounds. There are several software packages that can handle the type of setup we desire, but for the purposes of this demonstration, will be utilized. Let's emerge it now:

Next add an option to 's startup options. Edit the following option and substitute .example.org with the appropriate domain and the IP address with a valid DNS server that belongs to the VPN tunnel.

Next, make sure that the first entry in is the local host , followed by the location of the backup DNS servers that should handle the DNS traffic in case  fails to start, or if it needs to forward a DNS query it doesn't currently have in its cache. An example is shown below.

Now that a rule is setup for the VPN tunnel DNS, start.

The routing table
The ideal scenario would be if only the traffic destined for the VPN tunnel would travel across the link. At this point, a VPN tunnel setup exists and all traffic will travel across the tunnel, unless additional routes are specified. In order to fix this situation, know what networks are available on the VPN. The easiest way to find out the needed information is to ask a network administrator, but sometimes they are reluctant to answer such questions. If the local network admin doesn't provide the needed information, some trial and error experiments will be required.

When the VPN tunnel was started, vpnc set the default route to the tunnel. So set the default route back to normal, so that things work as expected.

Earlier, when DNS services were being configured for the VPN, a DNS server was specified to handle the example.org domain. Add a route for the 192.168.125.0 subnet so that DNS queries will work:

At this point, any additional routes for known networks (such as for the subnet 192.168.160.0, which includes the IP address received by the TUN/TAP virtual device) should be added. If a friendly network administrator gave the required info, great. Otherwise, start pinging hosts that will be connected to frequently, to give an idea about what the routing table should look like.

As seen from the above example, the ping probes to  were unsuccessful. So we need to add a route for that subnet.

A few ping and route commands later, and the system should be well on its way to a well working routing table.

Calling vpnc when needed
Next is an example script to manage the VPN connection. Execute it (as root) from an xterm to start a connection to the VPN. Then all that is left to do is to press return to disconnect the VPN. Obviously this needs to be modified on the current setup, remembering to add all the additional routes that may be necessary.

Start vpnc on boot
Version 0.4.0-r1 of vpnc contains an init script which can handle multiple configurations. The default script looks for, but as many configurations as can be imagined are possible. Before and after shutdown and start-up custom-made scripts can be executed that are connected by their name to the corresponding init script (since version 0.5.1-r1). Their names end in, , and , stored in the  directory. The general naming scheme is sketched in the following table.

Añadir vpnc al nivel de ejecución por defecto con las siguientes órdenes (en este caso para la configuración estándar). No se debe olvidar añadir el módulo tun (si se ha construido de esta forma) al mecanismo de autocarga del núcleo en el inicio.

To not have to save the password in the configuration file, tell the init script to show all output and prompts on standard output by editing. Set the VPNCOUTPUT variable to  or , where its default is to not display screen output.

Graphical remote access
When looking for a Linux application that supports RDP (Remote Desktop Protocol) then give a try. It is a GUI app written in GTK+ that fits in well with a Gnome desktop, but doesn't require it. As an alternative to the GUI configuration dialog that grdesktop provides, just install. Ultimately, grdesktop is just a frontend for rdesktop.

KDE users might want to try out. It appears to be a very mature VPN management GUI.

To connect to a Windows machine which doesn't have a DNS entry, but for which the address of an available WINS server is known, use a tool called to query the WINS server for the host name of the machine to connect to. Unfortunately, needs to be installed to get it, but when working with boxes running Windows installing samba is usually a given, because it includes several other useful tools.

When samba and its tools are installed, test by asking the WINS server at IP address 192.168.125.11 about a host named wintelbox1.

Custom scripts on boot
The custom-made scripts for the file can be used to setup a user-defined routing for the vpnc connection. The examples below show how to setup the routing table so that only connections to 123.234.x.x are routed over the VPN and all other connections use the default gateway. The example uses to save the current default gateway before starting vpnc (which resets the default gateway using the VPN connection). Once vpnc has been started, deletes this new default gateway, restores the old default gateway and sets the route for all connections to 123.234.x.x to use the vpnc connection.

The example scripts assume that the vpnc connection uses tun1 as tun device. Set the device name in the connection's configuration file.

Recursos externos

 * Página de vpnc
 * Página de homepage
 * Página de grdesktop