racoon (2817B)
1 #/etc/config/racoon 2 # 3 # Copyright 2015 Vitaly Protsko <villy@sft.ru> 4 5 # * WARNING: this is "not working" example 6 # * Defaults are commented out 7 # * Resuting config will appear in /var/racoon/ 8 9 config racoon 10 # option debug 0 11 # option ext_zone 'wan' 12 # option int_zone 'lan' 13 # option port 500 14 # option natt_port 4500 15 # following 4 or 6, no default 16 # option ipversion 4 17 18 config p1_proposal 'example_prop1' 19 # option lifetime 28800 20 option enc_alg 'aes' 21 option hash_alg 'sha1' 22 option auth_method 'rsasig' 23 option dh_group 2 24 25 config p1_proposal 'example_anon' 26 # option lifetime 28800 27 option enc_alg 'aes' 28 option hash_alg 'sha1' 29 option auth_method 'xauth_rsa_server' 30 option dh_group 2 31 32 config p1_proposal 'example_xauth' 33 # option lifetime 28800 34 option enc_alg 'aes' 35 option hash_alg 'sha1' 36 option auth_method 'xauth_rsa_client' 37 option dh_group 2 38 39 config p2_proposal 'example_prop2' 40 option pfs_group 2 41 option enc_alg 'aes' 42 option auth_alg 'hmac_sha1' 43 44 config p2_proposal 'example_in2' 45 option pfs_group 2 46 # option lifetime 14400 47 option enc_alg 'aes' 48 option auth_alg 'hmac_sha1' 49 50 config sainfo 'office' 51 option p2_proposal 'example_prop2' 52 option local_net '192.168.8.0/24' 53 option remote_net '192.168.1.0/24' 54 55 config sainfo 'welcome' 56 option p2_proposal 'example_in2' 57 option local_net '192.168.8.0/24' 58 option remote_net '192.168.10.0/24' 59 option dns4 '192.168.8.1' 60 option defdomain 'myhome.local' 61 62 config sainfo 'client' 63 option p2_proposal 'std_p2' 64 65 config tunnel 'Office' 66 option enabled 1 67 # initial_contact 68 # option init 1 69 option remote 'vpn.example.tld' 70 option exchange_mode 'main' 71 option certificate 'example_cert' 72 # option peer_id_type 'asn1dn' 73 # option prop_check 'obey' 74 # option verify_id 1 75 # option weak_p1check 1 76 # option dpd_delay '' 77 list p1_proposal 'example_prop1' 78 list sainfo 'office' 79 80 # WARNING: Only ONE tunnel with remote anonymous 81 # can be configured and it can have only 82 # ONE sainfo. Otherwise resulting racoon 83 # configuration will be unusable 84 config tunnel 'Incoming' 85 option enabled 1 86 option remote 'anonymous' 87 option pre_shared_key 'testitnow' 88 option exchange_mode 'aggressive,main' 89 option my_id_type 'fqdn' 90 option my_id 'myserver.homeip.net' 91 list p1_proposal 'example_anon' 92 list sainfo 'welcome' 93 94 config tunnel 'Client' 95 option enabled 1 96 option remote 'vpn.example.tld' 97 option username 'testuser' 98 option password 'testW0rD' 99 # option mode_cfg 1 100 list p1_proposal 'example_xauth' 101 list sainfo 'client' 102 103 # Insert corresponding data in PEM format as one line 104 config 'certificate' 'example_cert' 105 option 'key' '-----BEGIN PRIVATE KEY----- ~ -----END PRIVATE KEY-----' 106 option 'crt' '-----BEGIN CERTIFICATE----- ~ -----END CERTIFICATE-----' 107 108 config 'certificate' 'example_ca_cert' 109 option 'crt' '-----BEGIN CERTIFICATE----- ~ -----END CERTIFICATE-----'