summaryrefslogtreecommitdiff
path: root/scripts/vpn-config.pl
AgeCommit message (Collapse)Author
2020-01-20T1780 Adding IPSec IKE close-actionDmitriyEshenko
2019-03-14Fixes T1298 use vti tunnel with ipsec and dhcp.Kim
* make dhcp interface work for vti interfaces * clean up code, loger timeout use python api * change vti tunnel ip on new dhcp lease * only change ip on up and do not get non dhcp ip * fix error in function, include up-host and down-host
2018-12-06Fix: T1048: [IPSec] Protocol all does not work in IPSec Tunnelhagbard
2018-08-08T767: cleanup vpn-config.pl - removal of KLIPSChristian Poessinger
Two IPsec kernel stacks are currently available: KLIPS and NETKEY. The Linux kernel NETKEY code is a rewrite from scratch of the KAME IPsec code. The KAME Project was a group effort of six companies in Japan to provide a free IPv6 and IPsec (for both IPv4 and IPv6) protocol stack implementation for variants of the BSD UNIX computer operating system. KLIPS is not a part of the Linux kernel. When using KLIPS, you must apply a patch to the kernel to support NAT-T. When using NETKEY, NAT-T support is already inside the kernel, and there is no need to patch the kernel. [1] KLIPS part has been removed as we always used the NETKEY path in the Perl script. [1]: https://www.linuxjournal.com/article/9916
2018-08-08T767: remove IPSEC deprecated keyword 'interfaces'Christian Poessinger
'interfaces' option no longer available in StrongSWAN as of their Wiki [1]. [1]: https://wiki.strongswan.org/projects/strongswan/wiki/ConfigSetupSection
2017-10-31T126: charon listening on ALL interfaces(correct sorting)Taniadz
2017-10-27T126: charon listening on ALL interfaces(add ipsec restart)Taniadz
2017-10-25T126: charon listening on ALL interfaces( fix the style issues)Taniadz
2017-10-24T126: charon listening on ALL interfacesTaniadz
2016-02-24remove reference to dmvpn.secrets and chang dmvpn.conf to swanctl.confKim Hagen
2016-02-11Merge branch 'lithium-strongswan5' of ↵Daniil Baturin
https://github.com/TriJetScud/vyatta-cfg-vpn into current
2016-02-11Revert "Remove charonstart an interfaces from ipsec.conf file, they are ↵Kim Hagen
depricated." This reverts commit fbddff7f2b6b485c93b5d3cf4d60a75f84c3a2b6.
2016-02-11Revert "Set default pfs and ike dh group. (required by strongswan charon)"Kim Hagen
This reverts commit 8353f0f8fc746c69d6006e5bba9baf45afe16385.
2016-02-11Set default pfs and ike dh group. (required by strongswan charon)Kim Hagen
2016-02-11Remove charonstart an interfaces from ipsec.conf file, they are depricated.Kim Hagen
2016-02-09Use dhcp instead of dhcp3.Kim Hagen
2016-01-29vyatta-cfg-vpn: Properly implement force-encapsulation and fix descriptionsJeff Leung
2015-12-06Merge branch 'lithium' into lithium-strongswan5Jeff Leung
Conflicts: templates/vpn/ipsec/esp-group/node.tag/proposal/node.tag/encryption/node.def templates/vpn/ipsec/ike-group/node.tag/proposal/node.tag/encryption/node.def Get the GCM and ChaCha20+Poly1305 ciphers to play nice with each other
2015-12-05vyatta-cfg-vpn: validate peer address for vti based vpn connectionsAlex Harpin
Validate the peer address used for VTI based VPN connections to ensure only either an IPv4 or IPv6 address is used. Currently VTIs can only accept these for peer addresses, other values will fail with extraneous error messages, trap these earlier in the configuation commit process for now. Bug #359 http://bugzilla.vyos.net/show_bug.cgi?id=359
2015-11-04Whitespace fixesJeff Leung
2015-11-04Allow the user to include a custom ipsec.secrets file.Jeff Leung
This may be useful for scenarios where a user prefers to use an ECDSA key or implement an xauth IPSec RA server without having to code for the VyOS/EdgeOS platform.
2015-11-04Actually implement custom ipsec.conf filesJeff Leung
2015-06-22vyatta-cfg-vpn: validate peer address for vti based vpn connectionsAlex Harpin
Validate the peer address used for VTI based VPN connections to ensure only either an IPv4 or IPv6 address is used. Currently VTIs can only accept these for peer addresses, other values will fail with extraneous error messages, trap these earlier in the configuation commit process for now. Bug #359 http://bugzilla.vyos.net/show_bug.cgi?id=359
2015-06-14Bug #504: add an option for pulling IPsec local id from the cert.Daniil Baturin
2015-03-02Fix ipsec.secrets generation for PEM-formatted RSA key.Ryan Riske
2015-03-01Add support for RSA keys with strongSwan 5.2.xRyan Riske
strongSwan 5.2.x no longer recognizes keys in RFC 3110 format inlined in ipsec.conf and ipsec.secrets. We need to convert the local private key and peer public keys to PEM format, without changing the config templates or user-visible key formats. This patch will require the Debian packages 'libcrypt-openssl-bignum-perl' and 'libcrypt-openssl-rsa-perl' to be added to the system.
2015-02-13Remove the automatic generation of implicit connectionsJeff Leung
Since charon's existence, generating them is redundant and as a matter of fact causes issues with establishing multiple IKEv1 IPSec tunnels to the same peer.
2015-02-10Allow the user to force UDP encapsulation for a named peerJeff Leung
This might help with strongSwan traversing through firewalls that filter proto 51, but not UDP traffic.
2015-02-09Removing generation of leftsourceip= parameter in ipsec.confJeff Leung
As confirmed by Thermi in the strongSwan IRC channel inside freenode, this parameter should not have been generated for a S2S VPN setup. If leftsourceip= is specified on both ends in an IKEv1 S2S VPN tunnel, both ends will have charon hanging on MODE_CONFIG. This is because both ends are trying to ask an IP from the remote end which doesn't exist.
2015-02-08Slightly alter aggressive mode selection logicJeff Leung
If the user defines main mode, the config script will always enable aggressive mode. Fix the logic to correctly disable aggressive mode when main mode is asked for in IKEv1 connections.
2015-02-07Remove the code that generates our ipsec logger at runtimeJeff Leung
Since we're invoking the logger at runtime, there's really no point on keeping this codeblock
2015-02-07Configure the ipsec debug logger at runtimeJeff Leung
Instead of configuring the ipsec logger at config time, configure it at runtime. The codeblock that generated the logger will be removed in a subsequent commit
2015-02-07Properly clean up site-to-site tunnels on removalJeff Leung
strongSwan's charon by design maintains all established connections regardless, even if the connection's profile has been deleted from ipsec.conf. This change will grab a list of old tunnels from the old configuration and clean up old tunnels that are not present in the new configuration.
2015-02-06Use ipsec reload instead of updateJeff Leung
For some odd reason doing an ipsec update does not make charon pick up any newly created tunnels. However doing an ipsec reload updates all newly created tunnels correctly.
2015-02-05Update ipsec logging log-modes to point towards charon's loggersJeff Leung
log-modes now expose charon's keywords instead of pluto's keywords. Refer to the strongSwan's manual to see what each specific logger does.
2015-02-05Allow users to specify a custom file to be included with ipsec.confJeff Leung
2015-02-05Allow users to specify aggressive mode for IKEv1 key exchangesJeff Leung
Although strongly not recommended by the developers of strongSwan, sometimes remote VPN gateways requires this because of interop reasons or a network admin who doesn't have an idea on why aggressive mode is bad.
2015-01-27Removing pfs and pfsgroup parameter generationJeff Leung
In strongSwan 5.0.0 and later series, pfs= and pfsgroup= parameters have now been removed.
2015-01-27Generate PFS group settings alongside with our ESP settingsJeff Leung
Since strongSwan 5.0.0, defining the PFS group settings has moved in the esp= parameter. If PFS is simply enabled, it will use the first IKE proposal's dh-group as the PFS group.
2015-01-27Have the IKE parameter parser to use our new get_dh_cipher_result submoduleJeff Leung
The IKE parameter parser now uses the new get_dh_cipher_result submodule instead of the old if/else/elseif logic that was hardcoded to the parser. This should help ease developers adding new Diffie-Hellman groups if there are any in the future.
2015-01-27Add get_dh_cipher_result submoduleJeff Leung
By adding this submodule we can reduce the amount of code we need to maintain by having a single submodule that takes in a Diffie-Hellman group number and translates it to what strongSwan expects.
2015-01-27Removing charonstart from the config setup sectionJeff Leung
In preperation of moving towards the strongSwan 5.x series, we are removing the legacy charonstart=yes parameter in ipsec.conf. Since strongSwan 5.0.0 pluto has been removed from the codebase and charon is now the main daemon that handles IKEv1 and IKEv2 connections.
2014-12-19Bug #415: use remote-id for peer ID unconditionally if it's set.Daniil Baturin
2014-12-19Bug #414: quote the leftid value to avoid problems with non-alphanumeric ↵Daniil Baturin
characters.
2014-12-01Fixing syntax error in vpn-config.pl, fixing allowed parameters in the ↵Jason Hendry
per-tunnel ikev2-reauth node
2014-12-01Exposing ikev2 reauth option in CLI, defaulting to 'no'Jason Hendry
2014-10-05vyatta-cfg-vpn: prevent duplicate local rsa key includesAlex Harpin
Prevent duplicate include statements, for the local rsa keys, being added to the ipsec.secrets file when more than one VPN connection is configured. Bug #332 http://bugzilla.vyos.net/show_bug.cgi?id=332
2014-10-05vyatta-cfg-vpn: formatting changes for style consistencyAlex Harpin
Update scripts/vpn-config.pl to have consistent identation levels and style throughout.
2014-10-05vyatta-cfg-vpn: rename vti-up-down.sh to vti-up-downAlex Harpin
Rename vti-up-down.sh to vti-up-down to be consistent with others.
2014-08-03Bug #224: rename "enabled|disabled" to "enable|disable" for consistency.Daniil Baturin
generated by cgit v1.2.3 (git 2.39.1) at 2025-09-07 03:52:28 +0000