IPSec tunnel and dinamic IP

ullbergm

Script is working good. Now whole idea nead some reworking. How to implement this for more than one tunnel, maybe some changes to IPSec seting page (check box for dynamic tunnel or different dynamic gateway input field) and some other question. Ideas?

How about something like this:
/root/ipsecUpdate.php


require_once("config.inc");
require_once("functions.inc");

$conf = &$config['ipsec']['tunnel'];

$reload = 0;

for ($i = 0; $i < count($conf); $i++) {
        if( $conf[$i]['remote-gateway-hostname'] <> "" ) {
                $newip = gethostbyname($conf[$i]['remote-gateway-hostname']);

                if( $conf[$i]['remote-gateway'] != $newip ) {
                        $conf[$i]['remote-gateway'] = $newip;
                        $reload = 1;
                }
        }
}

if( $reload == 1 ) {
        write_config();
        vpn_ipsec_configure();
}
?>

Edit /usr/local/www/vpn_ipsec_edit.php

After this line:

$pconfig['remotegw'] = $a_ipsec[$id]['remote-gateway'];

add

$pconfig['remotegwhost'] = $a_ipsec[$id]['remote-gateway-hostname'];

Not 100% sure about this one, i'm making it up as i go :)
After this:

        if (($_POST['remotegw'] && !is_ipaddr($_POST['remotegw']))) {
                if(is_domain($_POST['remotegw']) == false)
                        $input_errors[] = "A valid remote gateway address must be specified.";
        }

add

        if (($_POST['remotegwhost'] && is_domain($_POST['remotegwhost']) == false)) {
                        $input_errors[] = "A valid remote gateway hostname must be specified.";
        }

Another one:

$ipsecent['remote-gateway'] = $_POST['remotegw'];

Add

$ipsecent['remote-gateway-hostname'] = $_POST['remotegwhost'];

This one needs more work but this will at least add a box to enter the information.
Change


                    Enter the public IP address of the remote gateway

to


                    IP: 

                    And/or Hostname:

ullbergm

I'm sure that there are several good reasons that IPSEC doesn't do this already so by doing something like this we are probably bypassing the security that the developers built in, but if you trust the DNS servers this should work for you.

Btw, the code came from pfSense-1.2-RC3 and it is untested so you may have to tweak it a little bit to get it to work. I'm still running my old code (see earlier in the thread), it works, no reason for me to change yet… :)

Also, dont forget to add this:

run "crontab -e" and add:

* * * * * /usr/local/bin/php -q /root/ipsecUpdate.php >> /dev/null

sullrich

If you can turn this into GUI code with a checkbox to enable dynamic ipsec, I will commit.

Send diff's to coreteam@pfsense.com

Thanks for your work so far!

ullbergm

@sullrich:

If you can turn this into GUI code with a checkbox to enable dynamic ipsec, I will commit.

Send diff's to coreteam@pfsense.com

Thanks for your work so far!

I can do that, a couple of questions for you.

So from a pfsense project perspective the preferred look would be to add a checkbox next to the remote host textbox and when that is checked the input should be a hostname instead of a ip address.

Is a diff against 1.2-RC2 ok?

Any preference on where the cron job script should be stored and how to specify how i want it to run (say every 15 minutes)?

sullrich

@ullbergm:

I can do that, a couple of questions for you.

So from a pfsense project perspective the preferred look would be to add a checkbox next to the remote host textbox and when that is checked the input should be a hostname instead of a ip address.

Is a diff against 1.2-RC2 ok?

Any preference on where the cron job script should be stored and how to specify how i want it to run (say every 15 minutes)?

#1 Yeah, a checkbox would be fine.
#2 I would prefer a diff against HEAD and RELENG1. This will not make it into 1.2 as we are frozen.
#3 Use minicron which is included. You can tell minicron to launch a script every X minutes. However, we should only launch this minicron process when we detect someone is using a dynamic hostname to avoid unnecessary process startups every 15 minutes when we do not need to. Also, a shell script to deterimine changes in the hostname would be ideal and only invoke php when absolutely needed but I would settle for either.

Thanks for your help on this! This should be a great addition for folks.

ssbaksa

@sullrich:

#1 Yeah, a checkbox would be fine.
#2 I would prefer a diff against HEAD and RELENG1. This will not make it into 1.2 as we are frozen.
#3 Use minicron which is included. You can tell minicron to launch a script every X minutes. However, we should only launch this minicron process when we detect someone is using a dynamic hostname to avoid unnecessary process startups every 15 minutes when we do not need to. Also, a shell script to deterimine changes in the hostname would be ideal and only invoke php when absolutely needed but I would settle for either.

Thanks for your help on this! This should be a great addition for folks.

Ah! I see movement. I am using script (simple one) for some time now and it is working OK.
This addition with web front end will be much better.

Any new development?

Sasa

sullrich

Dyanmic IPSEC support is already in -HEAD and RELENG_1_3; imported from m0n0wall recently.

ullbergm

@sullrich:

Dyanmic IPSEC support is already in -HEAD and RELENG_1_3; imported from m0n0wall recently.

Cool, no need for the workaround then.

ssbaksa

@sullrich:

Dyanmic IPSEC support is already in -HEAD and RELENG_1_3; imported from m0n0wall recently.

Yupiiiii!!!
This is great news. No nead to write scripts for that any more then.

TNX!

ssbaksa

@sullrich:

Dyanmic IPSEC support is already in -HEAD and RELENG_1_3; imported from m0n0wall recently.

And how can I download image with that modifications? I isn't at location usualy allowed to us mortals.
I know that it is in alpha stage (or near that) but I will like to play with.

sullrich

We currently do not have images for this. Expect to see some betas/alphas right after 1.2 is released.

ssbaksa

@sullrich:

We currently do not have images for this. Expect to see some betas/alphas right after 1.2 is released.

OK!
TNX for info.

valnar

If a script, or better yet, an update to the web interface would allow this hack to get two dynamic DNS Pfsense boxes to build a IPSEC tunnel, I would be happy to pay a bounty for that.

Robert

sullrich

@valnar:

If a script, or better yet, an update to the web interface would allow this hack to get two dynamic DNS Pfsense boxes to build a IPSEC tunnel, I would be happy to pay a bounty for that.

I don't see any reason why these changes would not work in this case. It might take a minute or two for the other end to come back up, but in theory it should work.

wallacebw

I guess there is no plan to backport the m0n0wall update into the 1.2 branch is there?

sullrich

1.2 is frozen.