Windows 2000 / Windows XP - Freeswan VPN

 

 

Visit my new project: Universal Infrared Transceiver for PC systems: http://www.irtrans.de

 

 

On this page you get everything needed to use Windows 2000 / XP as VPN Client for Freeswan – even as Road Warrior!

 

Prerequisites Windows 2000:

 

 

 

Prerequisites Windows XP:

 

 

 

 

I supply the ipsec.exe under GPL (GnuPublicLicense).

If someone develops tools based on my source code he might do so, when he is:

·        Offering this code under GPL

·        Sending me copies of his modifications

·        Delivering my source code together with his additions

 

 

Installation Instructions

 

  1. Install Windows 2000 Service Pack 2. It is mandatory to install this service pack or at least a Windows 2000 high encryption package to support the 3DES encryption which is needed by FreeSwan. There is no service pack needed on Windows XP.
  2. Install FreeSwan 1.96 on your LINUX / UNIX Box.
  3. Apply the X.509 Certificate Patch and compile the fswcert tool
  4. Generate the Certificates.  For Instructions click here.
  5. Make a directory C:\Programme\VPN
  6. Install the ipsecpol.exe Tool in this directory
  7. Unpack my VPN tool in this Directory
  8. Import your PC Certificate on the Windows 2000 Client using my supplied ipsec.msc Management Console plug-in. It is important to use the option “automatically select the certificate store based on the type of certificate”, so that the Root CA goes into the right Directory. In German it is called “Zertifikatsspeicher automatisch auswählen”. You have to enter your Export-Password for the private key. After the import you will find to certificates: Your Root CA in the CA Directory and your Client Certificate in your private Certificate Directory

Important: Always use the management console to import certificates. A simple double-click on the certificate will not work!!!!!

After importing the certificate get the DSN (Name like /C=… /ST=….) the MMC displays for the ROOT CA. You will need this ID for your W2k ipsec.conf.

  1. Update “ipsec.conf” to reflect your configuration. You find the syntax here.
  2. Make an entry for your client on your FreeSwan Server
  3. After you established your internet Connection start the “ipsec.exe” tool in the ipsec directory. The tool now looks up your IP Configuration and sets up the IPSec Tunnel based on your Configuration. – That’s it!!
  4. To delete the policies you may call “ipsec.exe –delete”. In the same way “ipesec.exe –off” disables the policy

 

 

There is another good How-To by Nate Carlson describing the whole setup procedure (FreeSwan & Win2K using my IPSec Tool).

You find it here: http://www.natecarlson.com/include/showpage.php?cat=linux&page=ipsec-x509

 

 

 

Suggestions and corrections: marcus@ebootis.de

 

Marcus Müller

 

Last Change: 11.04.2003   18:30:00 MESZ

 

History:

04.10.2001       Created.

04.10.2001    Added new Version of ipsec.exe which supports English Windows 2000

05.10.2001    added the Source code and description of the –delete and –off options.

05.10.2001    Fixed another English language bug with PPP & LAN Connections active at the same time

01.11.2001    Added Support for Windows XP (see note above)

01.11.2001    Added Support for Preshared Keys (see ipsec.conf syntax here.)

06.11.2001    Extended description of Windows XP support

06.11.2001    Automatic detection of Window XP (ipseccmd instead of ipsecpol)

24.01.2002    New syntax for right/leftid: Now rightca & leftca are supported. Also new syntax for CNs.

26.02.2002    Some minor bug fixes

04.03.2002    New major Release 2.0.0 with a lot of new Features:

                        1. RAS-API to get the active IP Address – No more language dependent problems!!!

                        2. New option “rekey” in ipsec.conf to specify rekeying interval

                        3. New option “authmode” to select MD5 or SHA as authorization Mode

                        4. Support for Freeswan syntax style netmasks: a.b.c.d/24 in converted into a.b.c.d/255.255.255.0

                        5. Support for DNS-Names as Tunnel Endpoint on the FreeSwan Side

19.03.2002    Version 2.0.1 new debugging mode: ipsec –debug to discover ipseccmd syntax errors

10.04.2002    Version 2.1.1 supports Automatic Dialup of RAS Connection !

15.04.2002    Version 2.1.2 probes the chosen RAS connection before dialing

30.04.2002    Version 2.1.4 Includes Fix for rekeying problems when using PFS

11.04.2003    Version 2.2.0    Adds new ipsec.conf option to specify MAC address of LAN interface to use !!!

                                                    New commandline parameter -nosleep to suppress 10s wait after running configuration.  

 

 

Windows / Windows 2000 / Windows XP are trademarks of Microsoft Corp.

 

You are the 267367. visitor since March 1st, 2002