Chapter 7

In the above example, 192.112.90.50 is the remote IPsec peer, and 193.111.228.1 is the next hop (usually default gateway) for the local IPsec peer.

In some situations, you might not want to adjust the MTU, as this is a global change and affects all traffic. For instance, if the MTU for one peer is only 500 bytes, and all the rest are 1500, all the remotes would be fragmenting each Ethernet packet into as many as three packets, which slows down network traffic. For such a case, you can try the following iptables rule as a workaround:

iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to- pmtu

This command enables TCP MSS clamping, which means that the device will adjust the parameters of the initial TCP connections on behalf of the peer, so that the packet size is kept within the MTU limits of this connection and will not be fragmented. The maximum segment size (MSS) is a parameter in the SYN packet sent during the initial connection setup. It specifies the maximum size of a single TCP packet that the sending peer will permit. Note that this only works for TCP connections, and not UDP.

If this does not solve the problem, then you can at least narrow down the packet size by sending ICMP packets of different sizes between the two IPsec peers:

ping -s 1400 ip.of.remote.host

Gradually increase the size until the ping fails. Once you know the largest successful size, you can enforce it with:

iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1419

Here, 1419 is the largest packet that produced a successful ping in the above tests.

Summary

Armed with the knowledge from this chapter, you should now be able to securely configure firewalling on and/or around your IPsec peers. Remember to review your firewall rulesets often, and keep good documentation about when and why specific rules were added or modified.

153

8

Interoperating with Microsoft Windows and Apple Mac OS X

VPNs are still most often used for laptops. These computers represent the largest group of roadwarriors that need to connect to the central network. Though we have discussed how

to use Openswan as client to an Openswan VPN server, Openswan only runs on Linux at this point, and Linux is a rare operating system for laptops, which normally run Microsoft Windows or Apple Mac OS X.

This chapter will explain how to set up these systems, and what changes are necessary on the Openswan side to ensure interoperability. This chapter also introduces Layer 2 Tunneling Protocol (L2TP), an extension to PPP/MPPE by Microsoft, and often used in combination with IPsec in transport mode.

Microsoft Windows

Even though it has been over ten years since Windows 95 was released, some people still use it, or one of its related successors, Windows 98 and ME. There is no native IPsec client for those platforms, but Microsoft does offer a locked-down version of what used to be the SSH Sentinel IPsec client as a free download for these platforms. This client is often called the MSL2TP client. It is no longer developed and lacks certain modern features, such as NAT-Traversal. We will not give an extensive tutorial on how to use these outdated systems, but if your configuration settings are similar to the modern Windows examples in this chapter, these clients will work to the best extent possible. Of course the standard answer to any Windows 9x problem is to upgrade the OS. There's a similar problem for old NT 3.5 and NT 4 systems, but even less people attempt to run IPsec on such systems. Again, upgrading those systems will save you a lot of time. In the remainder of this chapter, when we refer to Windows, we mean Microsoft Windows 2000, XP, and 2003. If something applies only to one specific version, we will mention this explicitly.

Mac OS X

Mac OS version 9 suffers from the same issues as Windows 9x: both simply predate large-scale deployment of IPsec. We will not discuss Mac OS 9 in this book. Mac OS X has seen three major releases so far, code named Jaguar, Panther, and Tiger, or version numbers 10.2, 10.3, and 10.4.