Net to net connection between IPFIRE and FritzBox (IPSEC)

I spent hours of surfing the web and looking for a working solution to connect my IPFIRE with a FritzBox in another country.

The following solution is working so far, but I still did not get a reliable VoIP connection, so this should be seen at least as a good starting point.

In this example I use two hostnames which have to be different of course (dyndns, no-ip, ...):

IPFIRE: HOSTNAME-A

FritzBox: HOSTNAME-B

Behind the IPFIRE the subnet is 192.168.0.0/255.255.255.0, behind the FritzBox it's 192.168.10.0/255.255.255.0. For a secure connection, a long enough key has to be used. Here it is represented by the string PRESHAREDKEY.

 

Upload this VPN configuration to your FritzBox after modifying it for your own scenario:

/*
* BLABLABLA COMMENTARY
* Fri Mar 29 23:18:49 2013
*/

vpncfg {
connections {
enabled = yes;
conn_type = conntype_lan;
name = "HOSTNAME-A";
always_renew = no;
reject_not_encrypted = no;
dont_filter_netbios = yes;
localip = 0.0.0.0;
local_virtualip = 0.0.0.0;
remoteip = 0.0.0.0;
remote_virtualip = 0.0.0.0;
remotehostname = "HOSTNAME-A";
localid {
fqdn = "HOSTNAME-B";
}
remoteid {
fqdn = "HOSTNAME-A";
}
mode = phase1_mode_idp;
phase1ss = "all/all/all";
keytype = connkeytype_pre_shared;
key = "PRESHAREDKEY";
cert_do_server_auth = no;
use_nat_t = yes;
use_xauth = no;
use_cfgmode = no;
phase2localid {
ipnet {
ipaddr = 192.168.10.0;
mask = 255.255.255.0;
}
}
phase2remoteid {
ipnet {
ipaddr = 192.168.0.0;
mask = 255.255.255.0;
}
}
phase2ss = "esp-all-all/ah-none/comp-all/pfs";
accesslist = "permit ip any 192.168.0.0 255.255.255.0";
}
ike_forward_rules = "udp 0.0.0.0:500 0.0.0.0:500",
"udp 0.0.0.0:4500 0.0.0.0:4500";
}


// EOF


This file has to be uploaded to your IPFIRE in /var/ipfire/vpn/ and must be named ipsec.conf (you have to replace an existing one or modify it if you'd like to use more than one IPSEC connection):

version 2

config setup
charondebug="dmn 0, mgr 0, ike 0, chd 0, job 0, cfg 0, knl 0, net 0, asn 0, enc 0, lib 0, esp 0, tls 0, tnc 0, imc 0, imv 0, pts 0"

conn %default
keyingtries=%forever

include /etc/ipsec.user.conf

conn SAMMELBUDE
aggressive=yes
left=HOSTNAME-A
leftsubnet=192.168.0.0/24
leftfirewall=yes
lefthostaccess=yes
right=HOSTNAME-B
rightsubnet=192.168.10.0/24
rightallowany=yes
leftid="@HOSTNAME-A"
rightid="@HOSTNAME-B"
ike=aes256-sha1-modp1024
esp=aes256-sha1-modp1024
keyexchange=ikev1
ikelifetime=1h
keylife=8h
compress=yes
dpddelay=30
dpdtimeout=120
dpdaction=none
authby=secret
auto=start

Do NOT use the GUI in the IPFIRE web interface for modifying this VPN connection or it will overwrite your config file.

After that, modify the ipsec.secrets file in the same path:

include /etc/ipsec.user.secrets
@HOSTNAME-A @HOSTNAME-B : PSK 'PRESHAREDKEY'

Finally this command should initiate the vpn connection between your IPFIRE's and FritzBox's subnets:

/etc/init.d/ipsec restart

 

This configuration example is garantueed to be working with IPFIRE core 67, a FritzBox 7390 FRITZ!OS 05.50 and StrongSwan 5.0.3RC1 (has to be updated manually, the already included version does not work) or higher on the IPFIRE.

Other FritzBoxes should run aswell. If you don't get any connection at all, you should check your IPFIRE's firewall (port 500 and 4500).

© 2021 Syntaxrabbit.com - All Rights Reserved.

We use cookies on our website. Some of them are essential for the operation of the site, while others help us to improve this site and the user experience (tracking cookies). You can decide for yourself whether you want to allow cookies or not. Please note that if you reject them, you may not be able to use all the functionalities of the site.