I use Raccoon via pfSense. > On Jun 11, 2019, at 1:26 PM, Chris Frederick <cdf123 at cdf123.net> wrote: > > On 6/11/19 11:48 AM, Brian Wood wrote: >> Shalom >> I've been trying to make some progress with IPsec. I tried >> previously a few years ago, but didn't get very far with it. >> Some of the books I've looked at are from a Cisco >> perspective. I'm not sure that's what I want. I want >> something that will help me use IPsec on FreeBSD and >> Linux. > > I should be able to help. I've mostly used racoon/ipsec-tools myself, and those are ports from *bsd. > >> I've read about transport and tunnel modes. Is transport >> mode siimpler/easier to implement than tunnel mode? > > No, they are different modes for different jobs, neither one is better or easier than the other. It's like comparing a knife with a fork, you could use only one or the other, but I would question why you would. > >> Ideally, I may want to use tunnel mode, but if transport >> mode is simpler, I'd rather start with that. > > Think of transport mode as end-to-end, or point-to-point. You're creating an ipsec policy to encrypt/sign traffic from A to B. This is assuming A can already get to B. So it's basically a direct connection. > > For tunnel modes, you're creating a route for A to get to B. This doesn't require that A can already get to B, and usually assumes one or two other machines are going to be in the middle. Here's a simple tunnel example. Given you want A to talk to B, you would set up a ipsec tunnel on X to ipsec encrypt/sign packets and route them through to Y which would decrypt them and forward them on to B. In this case A and B have no idea that they are using ipsec. > > A -{raw packet}-> X -{ipsec}-> Y -{raw packet}-> B > > Where it gets confusing is A and X can be one machine, or two. And so can Y and B. Usually X and Y are gateway routers, and A/B are in private subnets behind them. > >> Do you have any tips or sites for getting started with it? >> Thank you in advance. > > Can't help much here. Most sites I've used weren't helpful until after I had stumbled through everything and got a better understanding of how it all works. A lot of sites seem to provide a "HOWTO" approach that blends things together so it was harder to understand any individual piece. Best advice is to take it slow, focus on one technology first (ipsec-tools), then move on to more advanced stuff (racoon) once you understand it better and have a couple working examples. I would start with something that can run VirtualBox or Vmware, and spin up a couple of vms and try to get it working between them. > > I'm happy to help if you have any questions. > >> Brian >> Ebenezer Enterprises - "Those who trust in their riches will fall, >> but the righteous will thrive like a green leaf." Proverbs 11:28 >> https://github.com/Ebenezer-group/onwards >> _______________________________________________ >> TCLUG Mailing List - Minneapolis/St. Paul, Minnesota >> tclug-list at mn-linux.org >> http://mailman.mn-linux.org/mailman/listinfo/tclug-list > _______________________________________________ > TCLUG Mailing List - Minneapolis/St. Paul, Minnesota > tclug-list at mn-linux.org > http://mailman.mn-linux.org/mailman/listinfo/tclug-list