Chapter 4

Checking External Commands

Next, ipsec verify checks whether the necessary external commands it relies on are available. Currently, it checks for ip, ipchains, and iptables, and when using NETKEY, it also checks if the setkey command is available.

If you see a warning in this section you must fix it by installing the appropriate package. The ip command comes from the iproute package, which is sometimes called iproute2. The iptables command comes from the iptables package, and the setkey command is part of the ipsec-tools package. Openswan versions 2.3.0 or later no longer depend on the setkey command for NETKEY, but use the ip xfrm command instead. The XFRM framework for the ip command should be available on all modern versions of the iproute package.

The iproute package is sometimes called iproute2.

Opportunistic Encryption

The last check that ipsec verify performs is whether it can successfully retrieve Opportunistic Encryption records for itself from DNS. Failures in this section can normally be ignored, unless of course you are attempting to run Opportunistic Encryption. Using Opportunistic Encryption is further explained in chapter 5.

The ipsec livetest Command

The second pre-flight check we can perform is ipsec livetest. This command, available in Openswan 2.5 and later, will perform various tests to a specific test server, livetest.xelerance.net, to determine whether your ISP is filtering any packets, or is incorrectly mangling packets, for instance because of broken path-MTU discovery.

If you are uncomfortable with having your IPsec machine send packets to a public test server, you should not use the ipsec livetest command.

# ipsec livetest
Checking that Openswan has not been started	[OK]
Checking for livetest.xelerance.net connectivity using ping	[OK]
Checking for free path on UDP port 500 (IKE)	[OK]
Checking for free path on UDP port 4500 (IKE NAT-T)	[OK]
Starting barebone Openswan	[OK]
Fetching connection information from livetest.xelerance.com	[OK]
Loading IPsec conn livetest	[OK]
Starting IPsec conn livetest	[OK]
Sending packets over IPsec conn livetest	[OK]
Sending large packets over IPsec conn livetest	[OK]
Tearing down IPsec conn livetest	[OK]
NAT Traversal detected in (/etc/ipsec.conf), testing NAT-T
Loading IPsec conn livetest-natt	[OK]

79