<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-15">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi,<br>
<br>
First thing:<br>
<br>
I setup a strongswan server. So far authentication is working
(cert-based and radius-auth as well).<br>
<br>
Now I'd like to have a setup where I can use the VPN-connection to
establish connections into internet.<br>
<br>
Background: our students can access "protected" areas of libraries,
where they can download ebooks for example.<br>
Accesscontrol on side of the libraries is the senders IP-adress. So
I'd like to have the students connected to <br>
our vpn and then have routet internet-traffic through
vpn->internal network->outer ip(registered with
libraries->internet....<br>
<br>
Clients are Win7/8/XP...<br>
<br>
In my serverconfiguration I have configured leftsubnets to let the
users enter parts of our subnets. This is working very well.<br>
Only... I can't access Internet.<br>
<br>
Some details of my configuration:<br>
<br>
config setup<br>
<br>
conn %default<br>
ikelifetime=60m<br>
keylife=20m<br>
rekeymargin=3m<br>
keyingtries=1<br>
keyexchange=ike<br>
<br>
conn stud<br>
left=192.168.0.5<br>
leftcert=vpn.myhighschool.de.crt<br>
leftsubnet=192.168.0.0/24,192.168.2.0/24<br>
leftid=vpn.myhighschool.de<br>
right=%any<br>
rightid="DC=de, DC=myhighschool, O=The official name of our
highschool, OU=Some add Info, CN=*"<br>
rightsourceip=10.0.10.0/24<br>
auto=add<br>
<br>
My rightsourceips are masqueraded on the vpn-server, so that the
firewall does only need configuration for our vpn-server.<br>
<br>
Maybe you can give me some hints how to manage the access to other
IPs than defined in leftsubnet. Fyi I also tried leftsubnet
0.0.0.0...<br>
<br>
<br>
Second thing:<br>
<br>
I'd like to setup a firewalling based on the rightsourceips. So I
can define multiple conns with different rightsourceips. Depending
on these<br>
IPs I'd like to setup firewallrules on my vpn-server.<br>
<br>
I found a script which is being called on every connection with the
vpn-server,
<meta http-equiv="CONTENT-TYPE" content="text/html;
charset=ISO-8859-15">
/usr/libexec/ipsec/_updown.<br>
<br>
<font size="3">Before I start to study this script my question is: </font>what
is the "wanted" way to get this script managed. Should I directly
edit this script, or are<br>
there externel resource that can be configured or....? <br>
<br>
Thanks for your help in advance<br>
kind regards<br>
Uli<br>
<title></title>
<meta name="GENERATOR" content="LibreOffice 3.5 (Linux)">
<style type="text/css">
<!--
@page { margin: 2cm }
P { margin-bottom: 0.21cm; direction: ltr; color: #000000; widows: 0; orphans: 0 }
P.western { font-family: "Liberation Serif", "Times New Roman", serif; font-size: 12pt; so-language: de-DE }
P.cjk { font-family: "Droid Sans"; font-size: 12pt; so-language: zh-CN }
P.ctl { font-family: "DejaVu Sans"; font-size: 12pt; so-language: hi-IN }
A:link { so-language: zxx }
-->
</style>
</body>
</html>