1

I am working on a project which needs to call a web service that can only be accessed whilst being connected via a VPN. The legacy platform that we're migrating from ran on OpenBSD and used the built-in IPSec tools to create the connection.

The following config is how the connection is established. Can anyone help me as to how I'd go about creating this VPN connection on a Windows 7 machine. I've been researching on-line but don't understand enough of the existing script to attempt creating the connection on Windows. I understand there used to be a tool called ipseccmd.exe which seems to have parameters that match some of these but I don't think this included in the later versions of Windows?

Here is the OpenBSD config extract: (I have the required IP addresses for the $variables etc.)

ike esp from $dev_server to $destination_lan peer $destination_peer \
        main auth hmac-md5 enc aes-256 group modp1024 \
        quick auth hmac-md5 enc aes-256 group modp1024 \
        psk "pre_shared_key_goes_here"

"

harman_kardon
  • 11
  • 4

2 Answers2

2

Use Windows Firewall's Connection Security Rules to configure IPsec on Windows 7.

Open the Start Menu, search for "Windows Firewall with Advanced Security". Open it. In the left-hand panel, right-click on "Windows Firewall with Advanced Security". Select "Properties". Open the tab labelled "IPsec Settings". Click on "Customize".

In the section labelled "Key exchange (Main Mode)", click "Customize".
Click "Add" and select "MD5" as the integrity algorithm, "AES-CBC 256" for the encryption algorithm, and "Diffie-Hellman Group 2" for the key exchange algorithm. Click "OK". Click "OK".

In the section labelled "Data protection (Quick Mode)", click "Customize".
Check "Require encryption for all connection security rules that use these settings".
Click "Add" and select "ESP", select "MD5" as the integrity algorithm, and select "AES-CBC 256" for the encryption algorithm.
Click "OK". Click "OK". Click "OK". Click "OK".

In the left-hand panel, right-click on "Connection Security Rules". Select "New Rule" Select "Tunnel". Click "Next>". Click "Next>". Click "Next>". Click "Add" and enter $dev_server. Click "OK". Click the upper "Edit" and enter $dev_server. Click on the lower "Edit" and enter $destination_peer. Click "Next>". Select "Advanced" and click "Customize". In the section labelled "First authentication", click "Add". Select "Preshared key". Enter the preshared key. Click "OK". Click "OK". Click "Next>". Click "Next>". Enter a name for the rule. Click "Finish"

EDIT: added steps to configure IPsec.

ztk
  • 249
  • 2
  • 11
  • 1
    Adding detail on how to accomplish the task would improve the answer. – Dave M May 29 '15 at 18:52
  • Open Windows Firewall, right click on connection security rules, select new rule. Follow the wizard. (I don't mean to be so brief, but the question implies knowledge of IPsec and is trying to find it in Windows) – ztk May 29 '15 at 20:56
  • Thanks for the answer but actually I have very little knowledge in this area. Do you know the steps needed to actually get this particular config set up as a rule in the Windows Firewall? Thanks – harman_kardon May 29 '15 at 22:21
  • Thanks for the extra detail - will try this out at work tomorrow! – harman_kardon Jun 01 '15 at 20:40
  • Where should the $destination_lan variable be used (e.g. 1.1.1.1./32) ? – harman_kardon Jun 08 '15 at 08:38
  • On the screen where you click "Add" and enter the $dev_server, click the lower "Edit" button and enter the $destination_server in the box that pops up. – ztk Jun 08 '15 at 13:49
1

alternately, use netsh advfirewall consec add rule from the command line. You get some useful help text when you type just that.

Note that you need the "advanced firewall" that comes with windows 7 professional (I think) and enterprise (I'm sure). I don't think it is part of the "home" edition.

It's a complicated topic, and the answer is going to depend on how the other end of your tunnel is configured. I'm not familiar with OpenBSD's ipsec implementation, but my guess is that you need to do "lan-to-lan" mode on windows, even though one of your endpoints is not a LAN, it's just a single machine. (technically, i guess it's a /32 LAN with one member :)

Dan Pritts
  • 3,221
  • 26
  • 28