[Frage] Fritzbox mit Linux VPN verbinden (Strongswan, Openswan, Racoon, ...) Anleitung/HowTo

log [COLOR="#FF0000"][S]error[/S] debug2[/COLOR]; (kann man später immer noch runterdrehen)
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";

remote [COLOR="#FF0000"][S]70.50.210.210[/S] anonymous[/COLOR] {
        exchange_mode aggressive;
        [COLOR="#FF0000"]my_identifier address 109.230.236.49;[/COLOR] (ist zwar Standard, angeben schadet aber nicht, so sieht man wenigstens gleich, was Sache ist)
        verify_identifier off;
        [COLOR="#FF0000"]passive on; [/COLOR](solange nicht der Server von sich aus die Verbindung herstellen soll, alle Fragen zu dieser Thematik hast Du bisher unbeantwortet gelassen)
        [COLOR="#FF0000"]dpd_delay 20;[/COLOR] (damit tote Verbindungen abgeräumt werden bzw. die SAs dazu)
        [COLOR="#FF0000"]ike_frag on;[/COLOR] (auch reine Vorsichtsmaßnahme)
        [COLOR="#FF0000"]nat_traversal on;[/COLOR] (schadet auch nicht, wird ja "ausgemessen" und wenn man es mal braucht, ist es schon drin)
        proposal {
                encryption_algorithm [COLOR="#FF0000"][S]3des[/S] aes[/COLOR];
                hash_algorithm [COLOR="#FF0000"][S]md5[/S] sha1[/COLOR];
                authentication_method pre_shared_key;
                lifetime time 1 hour;
                dh_group 2;
        }
        generate_policy [COLOR="#FF0000"][S]off[/S] on[/COLOR];
}

sainfo [COLOR="#FF0000"][S]address 192.168.1.0/24 any address 192.168.2.0/24 any[/S] anonymous[/COLOR] {
        pfs_group 2;
        lifetime time 3600 seconds;
        encryption_algorithm aes;
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate;
}

[COLOR="#FF0000"]listen
{
        isakmp 109.230.236.49 [500]; [COLOR="#000000"](ist zwar Standard ... aber)[/COLOR]
        isakmp_natt 109.230.236.49 [4500]; [COLOR="#000000"](die hier nicht)[/COLOR]
        strict_address;
}
[/COLOR]

[COLOR="#FF0000"][S]spdadd 192.168.2.0/24 192.168.1.0/24 any -P out ipsec
        esp/tunnel/70.50.210.210-109.230.236.49/require;

spdadd 192.168.1.0/24 192.168.2.0/24 any -P in ipsec
        esp/tunnel/109.230.236.49-70.50.210.210/require;[/S]

flush;
spdflush;[/COLOR]

conn %default
    ikelifetime=60m
    keylife=20m
    rekeymargin=3m
    keyingtries=1
    keyexchange=ikev1
    rekey=yes
    dpdaction=clear
    dpddelay=300s
    ike = aes192-sha1-modp1024!
    esp = aes192-sha1!

conn rw
    left=<public ip server>
    leftid=@<dns name server>
    leftsubnet=10.0.10.0/24
    leftauth=psk
    leftfirewall=yes
    right=%any
    rightsourceip=%dynamic,10.0.11.0/24
    rightauth=psk
    rightauth2=xauth
    auto=add
    ikelifetime=4200s
    margintime=600s
    keylife=15m

charon {
        load_modular = yes
        #load = sha1 sha2 md5 aes des hmac gmp random nonce xauth-generic kernel-netlink socket-default updown stroke

        plugins {
                include strongswan.d/charon/*.conf
        }
        syslog {
#               identifier = charonsl
                auth {
                        default = 1
                        ike_name = yes
                        cfg = 2
                        ike = 2
                        enc = 1
                        chd = 2
                }
                daemon {
                        default = 1
                        ike_name = yes
                        cfg = 2
                        ike = 2
                        enc = 1
                        chd = 2
                }
        }
}

<dns name server, identisch zur ipsec.conf> %any : PSK <psk-ganzlanger-blödsinniger-text>
<id aus fritzbox xauth config> : XAUTH "xauth passwort"

vpncfg {
        connections {
                enabled = yes;
                editable = no;
                conn_type = conntype_out;
                name = "SIP VPN";
                boxuser_id = 0;
                always_renew = yes;
                reject_not_encrypted = no;
                dont_filter_netbios = no;
                localip = 0.0.0.0;
                local_virtualip = 0.0.0.0;
                remoteip = <public ip server>;
                remote_virtualip = 0.0.0.0;
                keepalive_ip = 10.0.10.1;
                localid {
                        fqdn = "fritz-mobil";
                }
                mode = phase1_mode_idp;
                phase1ss = "all/all/all";
                keytype = connkeytype_pre_shared;
                key = "pre shared key, wie in ipsec.secrets";
                cert_do_server_auth = no;
                use_nat_t = yes;
                use_xauth = yes;
                xauth {
                        valid = yes;
                        username = "[email protected]";
                        passwd = "xauth password";
                }
                use_cfgmode = yes;
                phase2remoteid {
                        ipnet {
                                ipaddr = 10.0.10.0;
                                mask = 255.255.255.0;
                        }
                }
                phase2ss = "esp-all-all/ah-none/comp-all/no-pfs";
                accesslist = "permit ip any 10.0.10.0 255.255.255.0";
        }
        ike_forward_rules = "udp 0.0.0.0:500 0.0.0.0:500",
                            "udp 0.0.0.0:4500 0.0.0.0:4500";
}