Hi folks. I've just set up two FC9 boxes and yum installed openswan. I've followed the instructions from the wiki for setting up the roadwarrior setup, including creating newhostkeys, creating /etc/ipsec.d/road.conf by cut/paste'ing the code from the wiki page and changing IP addresses and keys as appropriate. When I then restarted the ipsec services and ran ipsec auto --up road all looked fine. However, I have two questions. 1) with previous (non-openswan) VPN's I've ended up with virtual net devices (e.g.ppp0) representing both ends of the link which I can then use for IP routing. This time I don't have any new net devices. Is this right? and if so, how do I now do routing? 2) I saw the command ipsec verify and got the following output. What do the failures mean, and how do I fix them? [root@groucho ~]# ipsec verify Checking your system to see if IPsec got installed and started correctly: Version check and ipsec on-path [OK] Linux Openswan U2.6.19/K2.6.27.9-73.fc9.i686 (netkey) Checking for IPsec support in kernel [OK] NETKEY detected, testing for disabled ICMP send_redirects [FAILED] Please disable /proc/sys/net/ipv4/conf/*/send_redirects or NETKEY will cause the sending of bogus ICMP redirects! NETKEY detected, testing for disabled ICMP accept_redirects [FAILED] Please disable /proc/sys/net/ipv4/conf/*/accept_redirects or NETKEY will accept bogus ICMP redirects! Checking for RSA private key (/etc/ipsec.secrets) [OK] Checking that pluto is running [OK] Two or more interfaces found, checking IP forwarding [FAILED] Checking for 'ip' command [OK] Checking for 'iptables' command [OK] Opportunistic Encryption DNS checks: Looking for TXT in forward dns zone: groucho.ringways.co.uk [MISSING] Does the machine have at least one non-private address? [FAILED] [root@groucho ~]# -- Gary Stainburn This email does not contain private or confidential material as it may be snooped on by interested government parties for unknown and undisclosed purposes - Regulation of Investigatory Powers Act, 2000 -- fedora-list mailing list fedora-list@xxxxxxxxxx To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
