OpenSWAN
Lately I’ve been playing with OpenSWAN and IPSec in general.
For the last few years I’ve been using OpenVPN as my home VPN server, but recently I bought a few Intel PRO/100 S Server Ethernet adaptors. From looking on the Intel site the only big difference I could see between these and regular Intel PRO/100 cards was that it has IPSec offloading, which I also remembered seeing IPSec support on my iPhone. So that got me looking into replacing OpenVPN with OpenSWAN on my home router.
In the past, I have come across IPSec quite often, but I never really looked into it. After a bit of reading, I decided to buy “Building And Integrating Virtual Private Networks With OpenSWAN“. I haven’t finished reading the book, but I can say that it is a very well written book for people looking to get started with IPSec. It has quite a nice introduction on the internet and why encryption is so important on the internet. It also explains how encryption was originally only used by the military and how governments around the world tried to stop encryption being used widely across the internet.
On Linux, there are two IPSec stacks, NETKEY and KLIPS. KLIPS is currently the more stable one, and from what I understand, the one which is easier to use. NETKEY on the other hand, is quite a new stack, but due to various reasons, KLIPS was not allowed to be included in the Linux kernel by default, where as NETKEY is.
Since my router machine is running RedHat Enterprise Linux 5, which only includes support for NETKEY, I have been using the NETKEY IPSec stack. So far, the only problem with the NETKEY stack is that creating firewall rules for encrypted packets is much more difficult than it would be using KLIPS, although I was not too disapointed by this since the KLIPS does not have IPv6 support, which, since I like IPv6 so much, is a must for me! 
Although I had a bit of a problem with the OVH kernel, after a bit of tweaking and compiling and a lot of rebooting, I was able to create an encryted tunnel between my OVH RPS and my home router. If it had not been for all the trouble I had with the OVH kernel (it took quite a while to get the RPS to boot from the iSCSI disk using my custom kernel, rather than use netboot to fetch an OVH kernel), the tunnel would have been set up within a few minutes, which I found amazing as it takes a bit more time and effort to do with OpenVPN.
So far, I haven’t managed to figure out how to use the IPSec offloading feature of my ethernet cards, but I don’t think thats is really a problem considering my router machine is powerful enough to handle the few IPSec connections that IÂ have setup (Its a 2.4GHz Pentium 4 machine with 1GB ECC Reg RAM).
After a bit more reading, I decided it would be fun to try and get my iPhone connected to my IPSec Server, so over the next few days, hopefully thats what I will be doing!
