This document describes various options for FreeS/WAN configuration which are less used or more complex (often both) than the standard cases described in our quickstart document.
Nearly all of the overhead in IPsec processing is in the encryption and authentication of packets. Our performance document discusses these overheads.
Beside those overheads, the cost of managing additional tunnels is trivial. Whether your gateway supports one tunnel or ten just does not matter. A hundred might be a problem; there is a section on this in the performance document.
So, in nearly all cases, if using multiple tunnels gives you a reasonable way to describe what you need to do, you should describe it that way in your configuration files.
For example, one user recently asked on a mailing list about this network configuration:
netA---gwA---gwB---netB
|----netC
netA and B are secured netC not.
netA and gwA can not access netC
The user had constructed only one tunnel, netA to netB, and wanted to know how to use ip-route to get netC packets into it. This is entirely unnecessary. One of the replies was:
The simplest way and indeed the right way to
solve this problem is to set up two connections:
leftsubnet=NetA
left=gwA
right=gwB
rightsubnet=NetB
and
leftsubnet=NetA
left=gwA
right=gwB
rightsubnet=NetC
This would still be correct even if we added nets
Of course another possibility would be to just use one tunnel, with a subnet mask that includes both netB and netC (or B, C, D, ...). See next section.
In general, you can construct as many tunnels as you need. Networks like netC in this example that do not connect directly to the gateway are fine, as long as the gateway can route to them.
The number of tunnels can become an issue if it reaches 50 or so. This is discussed in the performance document. Look there for information on supporting hundreds of Road Warriors from one gateway.
If you find yourself with too many tunnels for some reason like having
eight subnets at one location and nine at another so you end up with
The subnets used in leftsubnet and rightsubnet can be of any size that fits your needs, and they need not correspond to physical networks.
You adjust the size by changing the subnet mask, the number after the slash in the subnet description. For example
As an example of using these in connection descriptions, suppose your company's head office has four physical networks using the address ranges:
You can use exactly those subnets in your connection descriptions, or use larger subnets to grant broad access if required:
or use smaller subnets to restrict access:
To be exact, 192.68.103.64/28 means all addresses whose top 28 bits match 192.168.103.64. There are 16 of these because there are 16 possibilities for the remainingg 4 bits. Their addresses are 192.168.103.64 to 192.168.103.79.
Each connection description can use a different subnet if required.
It is possible to use all the examples above on the same FreeS/WAN gateway, each in a different connection description, perhaps for different classes of user or for different remote offices.
It is also possible to have multiple tunnels using different leftsubnet descriptions with the same right. For example, when the marketing manager is on the road he or she might have access to:
This takes three tunnels, but tunnels are cheap. If the laptop is set up to build all three tunnels automatically, then he or she can access all these machines concurrently, perhaps from different windows.
In our VPN example, we used a simple network picture:
Sunset==========West------------------East=========Sunrise
local net untrusted net local net
And for the Road Warrior, another:
telecommuter's PC or
traveller's laptop
Sunset==========West------------------East
corporate LAN untrusted net
Other configurations are also possible.
A telecommuter might have:
Sunset==========West------------------East ================= firewall --- the Internet
home network untrusted net corporate network
This can be described as a special case of the general subnet-to-subnet connection. The subnet on the right is 0.0.0.0/0, the whole Internet.
West (the home gateway) can have its firewall rules set up so that only IPsec packets to East are allowed out. It will then behave as if its only connection to the world was a wire to East.
When machines on the home network need to reach the Internet, they do so via the tunnel, East and the corporate firewall. From the viewpoint of the Internet (perhaps of some EvilDoer trying to break in!), those home office machines are behind the firewall and protected by it.
Another possible configuration comes up when you do not trust the local network, either because you have very high security standards or because your are using easily-intercepted wireless signals.
Some wireless =5Hoم.e5p!D. +l|j#Rvvߗ_N01Tvp&97npR.^M|h5%,c:x˷Iey`+ŅI7٢?`Rm9Z|U99x1s8Ng-8& dđz*ߐ s@$PamH%< H_ "Rguwv
"d$^"+lk!`bFH>ٴMxk"VNɚ8ڃ (( pS9͟~U>
RoRE}hfr4F(cMS3bǏT@ Zh$ DvkyyNI%p)PdW7">V6sj8|^&G?Dݛ"R׳z AX$4W A/fXjJYWTq.OL\ ɨ}e`-M-+yqq P`-wτ:S= Cʧ(X4 R[/`g3f !hӀD y7y{ mh{tŎc
Ohb;# {K 84 -$
.u1`K4AXS| M4Vԋ]? ]rsQ A-Oo9b>}҇'_>G'gN/NCsC]H~>yr\ This document describes various options for FreeS/WAN configuration which
are less used or more complex (often both) than the standard cases described
in our quickstart document. Nearly all of the overhead in IPsec processing is in the encryption and
authentication of packets. Our performance
document discusses these overheads. Beside those overheads, the cost of managing additional tunnels is
trivial. Whether your gateway supports one tunnel or ten just does not
matter. A hundred might be a problem; there is a section on this in the performance
document. So, in nearly all cases, if using multiple tunnels gives you a reasonable
way to describe what you need to do, you should describe it that way in your
configuration files. For example, one user recently asked on a mailing list about this network
configuration: The user had constructed only one tunnel, netA to netB, and wanted to know
how to use ip-route to get netC packets into it. This is entirely
unnecessary. One of the replies was: This would still be correct even if we added nets Of course another possibility would be to just use one tunnel, with a
subnet mask that includes both netB and netC (or B, C, D, ...). See next
section. In general, you can construct as many tunnels as you need. Networks like
netC in this example that do not connect directly to the gateway are fine, as
long as the gateway can route to them. The number of tunnels can become an issue if it reaches 50 or so. This is
discussed in the performance document.
Look there for information on supporting hundreds of Road Warriors from one
gateway. If you find yourself with too many tunnels for some reason like having
eight subnets at one location and nine at another so you end up with
The subnets used in leftsubnet and rightsubnet can
be of any size that fits your needs, and they need not correspond to physical
networks. You adjust the size by changing the subnet
mask, the number after the slash in the subnet description. For
example As an example of using these in connection descriptions, suppose your
company's head office has four physical networks using the address ranges: You can use exactly those subnets in your connection descriptions, or use
larger subnets to grant broad access if required: or use smaller subnets to restrict access: To be exact, 192.68.103.64/28 means all addresses whose top 28 bits match
192.168.103.64. There are 16 of these because there are 16 possibilities for
the remainingg 4 bits. Their addresses are 192.168.103.64 to
192.168.103.79. Each connection description can use a different subnet if required. It is possible to use all the examples above on the same FreeS/WAN
gateway, each in a different connection description, perhaps for different
classes of user or for different remote offices. It is also possible to have multiple tunnels using different
leftsubnet descriptions with the same right. For
example, when the marketing manager is on the road he or she might have
access to: This takes three tunnels, but tunnels are cheap. If the laptop is set up
to build all three tunnels automatically, then he or she can access all these
machines concurrently, perhaps from different windows. In our VPN example, we used a simple network picture: And for the Road Warrior, another: Other configurations are also possible. A telecommuter might have: This can be described as a special case of the general subnet-to-subnet
connection. The subnet on the right is 0.0.0.0/0, the whole Internet. West (the home gateway) can have its firewall rules set up so that only
IPsec packets to East are allowed out. It will then behave as if its only
connection to the world was a wire to East. When machines on the home network need to reach the Internet, they do so
via the tunnel, East and the corporate firewall. From the viewpoint of the
Internet (perhaps of some EvilDoer trying to break in!), those home office
machines are behind the firewall and protected by it. Another possible configuration comes up when you do not trust the local
network, either because you have very high security standards or because your
are using easily-intercepted wireless signals. Some wireless =5Hoم.e5p!D. +l|j#Rvvߗ_N01Tvp&97npR.^M|h5%,c:x˷Iey`+ŅI7٢?`Rm9Z|U99x1s8Ng-8& dđz*ߐ s@$PamH%< H_ "Rguwv
"d$^"+lk!`bFH>ٴMxk"VNɚ8ڃ (( pS9͟~U>
RoRE}hfr4F(cMS3bǏT@ Zh$ DvkyyNI%p)PdW7">V6sj8|^&G?Dݛ"R׳z AX$4W A/fXjJYWTq.OL\ ɨ}e`-M-+yqq P`-wτ:S= Cʧ(X4 R[/`g3f !hӀD y7y{ mh{tŎc
Ohb;# {K 84 -$
.u1`K4AXS| M4Vԋ]? ]rsQ A-Oo9b>}҇'_>G'gN/NCsC]H~>yr\ This document describes various options for FreeS/WAN configuration which
are less used or more complex (often both) than the standard cases described
in our quickstart document. Nearly all of the overhead in IPsec processing is in the encryption and
authentication of packets. Our performance
document discusses these overheads. Beside those overheads, the cost of managing additional tunnels is
trivial. Whether your gateway supports one tunnel or ten just does not
matter. A hundred might be a problem; there is a section on this in the performance
document. So, in nearly all cases, if using multiple tunnels gives you a reasonable
way to describe what you need to do, you should describe it that way in your
configuration files. For example, one user recently asked on a mailing list about this network
configuration: The user had constructed only one tunnel, netA to netB, and wanted to know
how to use ip-route to get netC packets into it. This is entirely
unnecessary. One of the replies was: This would still be correct even if we added nets Of course another possibility would be to just use one tunnel, with a
subnet mask that includes both netB and netC (or B, C, D, ...). See next
section. In general, you can construct as many tunnels as you need. Networks like
netC in this example that do not connect directly to the gateway are fine, as
long as the gateway can route to them. The number of tunnels can become an issue if it reaches 50 or so. This is
discussed in the performance document.
Look there for information on supporting hundreds of Road Warriors from one
gateway. If you find yourself with too many tunnels for some reason like having
eight subnets at one location and nine at another so you end up with
The subnets used in leftsubnet and rightsubnet can
be of any size that fits your needs, and they need not correspond to physical
networks. You adjust the size by changing the subnet
mask, the number after the slash in the subnet description. For
example As an example of using these in connection descriptions, suppose your
company's head office has four physical networks using the address ranges: You can use exactly those subnets in your connection descriptions, or use
larger subnets to grant broad access if required: or use smaller subnets to restrict access: To be exact, 192.68.103.64/28 means all addresses whose top 28 bits match
192.168.103.64. There are 16 of these because there are 16 possibilities for
the remainingg 4 bits. Their addresses are 192.168.103.64 to
192.168.103.79. Each connection description can use a different subnet if required. It is possible to use all the examples above on the same FreeS/WAN
gateway, each in a different connection description, perhaps for different
classes of user or for different remote offices. It is also possible to have multiple tunnels using different
leftsubnet descriptions with the same right. For
example, when the marketing manager is on the road he or she might have
access to: This takes three tunnels, but tunnels are cheap. If the laptop is set up
to build all three tunnels automatically, then he or she can access all these
machines concurrently, perhaps from different windows. In our VPN example, we used a simple network picture: And for the Road Warrior, another: Other configurations are also possible. A telecommuter might have: This can be described as a special case of the general subnet-to-subnet
connection. The subnet on the right is 0.0.0.0/0, the whole Internet. West (the home gateway) can have its firewall rules set up so that only
IPsec packets to East are allowed out. It will then behave as if its only
connection to the world was a wire to East. When machines on the home network need to reach the Internet, they do so
via the tunnel, East and the corporate firewall. From the viewpoint of the
Internet (perhaps of some EvilDoer trying to break in!), those home office
machines are behind the firewall and protected by it. Another possible configuration comes up when you do not trust the local
network, either because you have very high security standards or because your
are using easily-intercepted wireless signals. Some wireless =5Hoم.e5p!D. +l|j#Rvvߗ_N01Tvp&97npR.^M|h5%,c:x˷Iey`+ŅI7٢?`Rm9Z|U99x1s8Ng-8& dđz*ߐ s@$PamH%< H_ "Rguwv
"d$^"+lk!`bFH>ٴMxk"VNɚ8ڃ (( pS9͟~U>
RoRE}hfr4F(cMS3bǏT@ Zh$ DvkyyNI%p)PdW7">V6sj8|^&G?Dݛ"R׳z AX$4W A/fXjJYWTq.OL\ ɨ}e`-M-+yqq P`-wτ:S= Cʧ(X4 R[/`g3f !hӀD y7y{ mh{tŎc
Ohb;# {K 84 -$
.u1`K4AXS| M4Vԋ]? ]rsQ A-Oo9b>}҇'_>G'gN/NCsC]H~>yr\ This document describes various options for FreeS/WAN configuration which
are less used or more complex (often both) than the standard cases described
in our quickstart document. Nearly all of the overhead in IPsec processing is in the encryption and
authentication of packets. Our performance
document discusses these overheads. Beside those overheads, the cost of managing additional tunnels is
trivial. Whether your gateway supports one tunnel or ten just does not
matter. A hundred might be a problem; there is a section on this in the performance
document. So, in nearly all cases, if using multiple tunnels gives you a reasonable
way to describe what you need to do, you should describe it that way in your
configuration files. For example, one user recently asked on a mailing list about this network
configuration: The user had constructed only one tunnel, netA to netB, and wanted to know
how to use ip-route to get netC packets into it. This is entirely
unnecessary. One of the replies was: This would still be correct even if we added nets Of course another possibility would be to just use one tunnel, with a
subnet mask that includes both netB and netC (or B, C, D, ...). See next
section. In general, you can construct as many tunnels as you need. Networks like
netC in this example that do not connect directly to the gateway are fine, as
long as the gateway can route to them. The number of tunnels can become an issue if it reaches 50 or so. This is
discussed in the performance document.
Look there for information on supporting hundreds of Road Warriors from one
gateway. If you find yourself with too many tunnels for some reason like having
eight subnets at one location and nine at another so you end up with
The subnets used in leftsubnet and rightsubnet can
be of any size that fits your needs, and they need not correspond to physical
networks. You adjust the size by changing the subnet
mask, the number after the slash in the subnet description. For
example As an example of using these in connection descriptions, suppose your
company's head office has four physical networks using the address ranges: You can use exactly those subnets in your connection descriptions, or use
larger subnets to grant broad access if required: or use smaller subnets to restrict access: To be exact, 192.68.103.64/28 means all addresses whose top 28 bits match
192.168.103.64. There are 16 of these because there are 16 possibilities for
the remainingg 4 bits. Their addresses are 192.168.103.64 to
192.168.103.79. Each connection description can use a different subnet if required. It is possible to use all the examples above on the same FreeS/WAN
gateway, each in a different connection description, perhaps for different
classes of user or for different remote offices. It is also possible to have multiple tunnels using different
leftsubnet descriptions with the same right. For
example, when the marketing manager is on the road he or she might have
access to: This takes three tunnels, but tunnels are cheap. If the laptop is set up
to build all three tunnels automatically, then he or she can access all these
machines concurrently, perhaps from diOther configuration possibilities
Some rules of thumb about configuration
Tunnels are cheap
netA---gwA---gwB---netB
|----netC
netA and B are secured netC not.
netA and gwA can not access netC
The simplest way and indeed the right way to
solve this problem is to set up two connections:
leftsubnet=NetA
left=gwA
right=gwB
rightsubnet=NetB
and
leftsubnet=NetA
left=gwA
right=gwB
rightsubnet=NetC
Subnet sizes
Other network layouts
Sunset==========West------------------East=========Sunrise
local net untrusted net local net
telecommuter's PC or
traveller's laptop
Sunset==========West------------------East
corporate LAN untrusted net
The Internet as a big subnet
Sunset==========West------------------East ================= firewall --- the Internet
home network untrusted net corporate network
Wireless
Other configuration possibilities
Some rules of thumb about configuration
Tunnels are cheap
netA---gwA---gwB---netB
|----netC
netA and B are secured netC not.
netA and gwA can not access netC
The simplest way and indeed the right way to
solve this problem is to set up two connections:
leftsubnet=NetA
left=gwA
right=gwB
rightsubnet=NetB
and
leftsubnet=NetA
left=gwA
right=gwB
rightsubnet=NetC
Subnet sizes
Other network layouts
Sunset==========West------------------East=========Sunrise
local net untrusted net local net
telecommuter's PC or
traveller's laptop
Sunset==========West------------------East
corporate LAN untrusted net
The Internet as a big subnet
Sunset==========West------------------East ================= firewall --- the Internet
home network untrusted net corporate network
Wireless
Other configuration possibilities
Some rules of thumb about configuration
Tunnels are cheap
netA---gwA---gwB---netB
|----netC
netA and B are secured netC not.
netA and gwA can not access netC
The simplest way and indeed the right way to
solve this problem is to set up two connections:
leftsubnet=NetA
left=gwA
right=gwB
rightsubnet=NetB
and
leftsubnet=NetA
left=gwA
right=gwB
rightsubnet=NetC
Subnet sizes