Integration of Check Point VPN-1®/Firewall-1® and FreeBSD IPsec
Prev |  | Next

# 4 FreeBSD VPN Policy Configuration

At this point, the VPN policy on FreeBSD GW must be defined. The setkey(8) tool performs this function.

Below is an example shell script which will flush setkey(8) and add your VPN policy rules.

    #
    # /etc/vpn1-ipsec.sh
    #
    # IP addresses
    #
    #     External Interface                    External Interface
    #       208.229.100.6                       216.218.197.2
    #                   |                       |
    #        +--> Firewall-1 <--> Internet <--> FreeBSD GW <--+
    #        |                                                |
    # FW-1 Protected Nets                              Internal Nets
    #    199.208.192.0/24                                  192.168.10.0/24
    #
    # Flush the policy
    #
    setkey -FP
    setkey -F
    #
    # Configure the Policy
    #
    setkey -c << END
    spdadd 216.218.197.2/32 199.208.192.0/24 any -P out ipsec
    esp/tunnel/216.218.197.2-208.229.100.6/require;
    spdadd 199.208.192.0/24 216.218.197.2/32 any -P in ipsec
    esp/tunnel/208.229.100.6-216.218.197.2/require;
    END
    #

Execute the setkey(8) commands:

    # sh /etc/vpn1-ipsec.sh

Prev | Home | Next
Firewall-1 VPN Rule Configuration |  | FreeBSD Racoon Configuration