You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

109 lines
2.7 KiB

#/etc/config/racoon
#
# Copyright 2015 Vitaly Protsko <villy@sft.ru>
# * WARNING: this is "not working" example
# * Defaults are commented out
# * Resuting config will appear in /var/racoon/
config racoon
# option debug 0
# option ext_zone 'wan'
# option int_zone 'lan'
# option port 500
# option natt_port 4500
# following 4 or 6, no default
# option ipversion 4
config p1_proposal 'example_prop1'
# option lifetime 28800
option enc_alg 'aes'
option hash_alg 'sha1'
option auth_method 'rsasig'
option dh_group 2
config p1_proposal 'example_anon'
# option lifetime 28800
option enc_alg 'aes'
option hash_alg 'sha1'
option auth_method 'xauth_rsa_server'
option dh_group 2
config p1_proposal 'example_xauth'
# option lifetime 28800
option enc_alg 'aes'
option hash_alg 'sha1'
option auth_method 'xauth_rsa_client'
option dh_group 2
config p2_proposal 'example_prop2'
option pfs_group 2
option enc_alg 'aes'
option auth_alg 'hmac_sha1'
config p2_proposal 'example_in2'
option pfs_group 2
# option lifetime 14400
option enc_alg 'aes'
option auth_alg 'hmac_sha1'
config sainfo 'office'
option p2_proposal 'example_prop2'
option local_net '192.168.8.0/24'
option remote_net '192.168.1.0/24'
config sainfo 'welcome'
option p2_proposal 'example_in2'
option local_net '192.168.8.0/24'
option remote_net '192.168.10.0/24'
option dns4 '192.168.8.1'
option defdomain 'myhome.local'
config sainfo 'client'
p2_proposal 'std_p2'
config tunnel 'Office'
option enabled 1
# initial_contact
# option init 1
option remote 'vpn.example.tld'
option exchange_mode 'main'
option certificate 'example_cert'
# option peer_id_type 'asn1dn'
# option prop_check 'obey'
# option verify_id 1
# option weak_p1check 1
# option dpd_delay ''
list p1_proposal 'example_prop1'
list sainfo 'office'
# WARNING: Only ONE tunnel with remote anonymous
# can be configured and it can have only
# ONE sainfo. Otherwise resulting racoon
# configuration will be unusable
config tunnel 'Incoming'
option enabled 1
option remote 'anonymous'
option pre_shared_key 'testitnow'
option exchange_mode 'aggressive,main'
option my_id_type 'fqdn'
option my_id 'myserver.homeip.net'
list p1_proposal 'example_anon'
list sainfo 'welcome'
config tunnel 'Client'
option enabled 1
option remote 'vpn.example.tld'
option username 'testuser'
option password 'testW0rD'
# option mode_cfg 1
list p1_proposal 'example_xauth'
list sainfo 'client'
# Insert corresponding data in PEM format as one line
config 'certificate' 'example_cert'
option 'key' '-----BEGIN PRIVATE KEY----- ~ -----END PRIVATE KEY-----'
option 'crt' '-----BEGIN CERTIFICATE----- ~ -----END CERTIFICATE-----'
config 'certificate' 'example_ca_cert'
option 'crt' '-----BEGIN CERTIFICATE----- ~ -----END CERTIFICATE-----'