Hello after trying some configurations I found the following config working with PFS 2.3.1 and Fritzbox 7490 (06.55-33668 BETA):
Assuming the following Values:
PFS IP: 10.0.10.1
PFS Network: 10.0.10.0/24
PFS EXTERN IP: 217.0.0.217
FB IP: 192.168.10.1
FB Network: 192.168.10.0/24
FB DDNS Name: abcd.myfritz.net
PSK: same_most_secret_password_as_in_PFS
Fritzbox VPN Import File:
/*
Path_to_Fritzbox_VPN_config_file.cfg
Timestamp
*/
vpncfg {
connections {
enabled = yes;
conn_type = conntype_lan;
name = "VPN_fancy_name"; <<< VPN Name
always_renew = yes;
reject_not_encrypted = no;
dont_filter_netbios = yes;
localip = 0.0.0.0;
local_virtualip = 0.0.0.0;
remoteip = 217.0.0.217; <<< External IP of PFS
remote_virtualip = 0.0.0.0;
keepalive_ip = 10.0.10.1; <<< Private IP of PFS (usually default gateway IP of local PFS network)
localid {
fqdn = "abcd.myfritz.net"; <<< external FQDN e.g. MyFritz ID
}
remoteid {
ipaddr = 217.0.0.217; <<< External IP of PFS
}
mode = phase1_mode_aggressive;
phase1ss = "def/3des/sha";
keytype = connkeytype_pre_shared;
key = "same_most_secret_password_as_in_PFS"; <<< Pre-Shared-Password
cert_do_server_auth = no;
use_nat_t = no;
use_xauth = no;
use_cfgmode = no;
phase2localid {
ipnet {
ipaddr = 192.168.10.0; <<< Private Network of Fritzbox
mask = 255.255.255.0;
}
}
phase2remoteid {
ipnet {
ipaddr = 10.0.10.0; <<< Private Network of PFS
mask = 255.255.255.0;
}
}
phase2ss = "esp-3des-sha/ah-no/comp-no/pfs";
accesslist = "permit ip any 10.0.10.0 255.255.255.0";
}
ike_forward_rules = "udp 0.0.0.0:500 0.0.0.0:500",
"udp 0.0.0.0:4500 0.0.0.0:4500";
}
// EOF
Config within PFS 2.3.1:
===============
Phase 1 - General Information
Disabled: off
Key Exchange version : V1
Internet Protocol: IPv4
Interface: WAN
Remote Gateway: abcd.myfritz.net <<< external FQDN e.g. MyFritz ID
Description: VPN Name
Phase 1 Proposal (Authentication)
Authentication Method: Mutual PSK
Negotiation mode: Aggresive
My identifier: My IP address
Peer identifier: Distinguished name / abcd.myfritz.net <<< external FQDN e.g. MyFritz ID
Pre-Shared Key: same_most_secret_password_as_in_PFS <<< Shared Password
Phase 1 Proposal (Algorithms)
Encryption Algorithm: 3DES
Hash Algorithm: SHA256 or SHA1 (try both, one should work!)
DH Group: 1 (768 bit)
Lifetime (Seconds): 3600
Phase 1 - Advanced Options
Disable rekey: off
Responder Only: off
NAT Traversal: auto
Dead Peer Detection: on
Delay: 10
Max failures: 5
–-
Phase 2 - General Information
Disabled: off
Mode: Tunnel IPv4
Local Network: LAN subnet
NAT/BINAT translation: none
Remote Network: Network / 192.168.10.0 / 24
Description: VPN Name
Phase 2 Proposal (SA/Key Exchange)
Protocol: ESP
Encryption Algorithms: AES / 256 bits and 3DES
Hash Algorithms: SHA1
PFS key group: 1 (768 bit)
Lifetime: 3600
Phase 2 - Advanced Configuration
Automatically ping host: 192.168.10.1 <<< Private IP of Fritzbox
I did not try to find the most secure VPN settings possible, but this config works with my needs.
I use on both side more then one VPN.
Using this setup works on the Fritzbox in combination of Single User VPNs and additional Fritzbox-Fritzbox Connections.
If one has any Ideas to change settings to increase the security level, please let me know.
