Chapter 4

Avoiding Duplication

As a general rule, you should avoid duplicating information on different computers, if only to make it easier to change information when necessary. The host-to-host connection between West and East and the subnet-to-subnet connection between Sunset and Sunrise are almost identical. The only differences are the subnet= lines. There is a way to avoid this duplication.

The Also Keyword

We can write two similar connections to avoid repeating information with the also= keyword:

conn sunset-sunrise leftsubnet=193.111.228.0/24 rightsubnet=192.0.2.0/24 also=west-east

conn west-east left=193.110.157.131 right=205.150.200.209 leftrsasigkey=0sAQ....

rightrsasigkey=0sAQ....

auto=start

Unfortunately, due to how the parser works, you have to put all the sections referenced by an also= statement below the connections that include such an also= statement, even though it might seem more logical to place them in the reverse order.

KLIPS and the ipsecX Interfaces

If you are using KLIPS, you are likely using it because you prefer to have the virtual interfaces. These ipsecX interfaces are configured in the setup section with the interfaces= line. This line is ignored when using NETKEY. If the interfaces line is missing, it will have the same effect as:

interfaces=%defaultroute

This means that one virtual interface (ipsec0) will be created, and it will be bound to the interface that currently has defaultroute pointing to it. After all, it is most likely that IPsec is to be used to communicate with the outside world. If this is not the case, of if you want to use IPsec on multiple physical interfaces, this should be specified explicitly:

interfaces="ipsec0=eth0 ipsec1=ppp0 ipsec2=eth1 ipsec3=eth0:1"

This line creates four ipsecN interfaces, which are attached to eth0, ppp0, eth1, and eth0:1. This last entry is an IP alias, and is treated as a physical interface.

Often people first try out KLIPS in a test environment that has no internet connectivity, and thus often no default route. In such a case, the interfaces= line should also be set explicitly.

89