Configuring food groups

What are Food Groups?

Food Groups are a new way of configuring Linux FreeS/WAN.

By defining security policy for groups of IPs (or named domains) we can easily conceptualize what we want to do with IPsec. Linux FreeS/WAN then does all the hard work of translating that into connection descriptions, and establishing your connections.

You can also think of Food Groups as a way to manage your opportunistic connections.

Food groups can be used right alongside your existing ipsec.conf. On 2.x revisions to ipsec.conf, see our Upgrading Guide.

How to use them

Linux FreeS/WAN offers these built in security policies (Food Groups):

oe-or-bust (OE-based VPN)
Attempt to negotiate opportunistically. On failure, block.
oe-or-clear
Attempt to opportunistically negotiate a tunnel. On failure, communicate in the clear
clear-or-oe (Opportunistic Responder)
Communicate in the clear. If the other side negotiates opportunistically, go along with that.
clear
Communicate with these in the clear.
block
Block listed IP addresses from communicating with this machine.

You can also define your own groups.

Configuring Food Groups

Configuring food groups is as easy as putting names, IPs or IP ranges in a file with the same name as the group.

    cd /etc/
    echo "193.110.157.0/24  #includes oetest.freeswan.nl" > oe-or-clear

FreeS/WAN will automatically create a connection to cover this case, and will bring it up when need be. To test this,

    ping oetest.freeswan.nl
    ipsec look | grep " -> "

You should see something like:

    40.40.40.40/32   -> 193.110.157.10/32  => tun0x149f@193.110.157.77 esp0xf8754dc8@193.110.157.77
    40.40.40.40/32   -> 193.110.157.14/32  => tun0x14a3@193.110.157.75 esp0xa9520f54@193.110.157.75

indicating tunnels between your node or network [here, 40.40.40.40/32] and the two targets passiveOE.freeswan.nl (193.110.157.10) and activeOE.freeswan.nl (193.110.157.14).

If this doesn't work, check permissions on your file. Or troubleshoot your OE.

Food Group example

Here is an example of how you might define security policy using a number of food group files.

    cd /etc/
    cat oe-or-bust
        40.40.38.0/27    # The finance department
        40.40.38.0/27    # HR
        40.40.40.26/32    # Barb's machine
        40.40.40.33/32    # Our IRC server
  
    cat oe-or-clear
        0.0.0.0/0    # My default policy: try to encrypt.

    cat clear
        66.66.66.45   # My POP3 server
        66.66.66.53   # A Web proxy

    block
        mail.spamworks.com

Custom Food Groups

Behind the scenes, these connections are implemented by "cloning" a plain OE, OE-group, clear or block connection. FreeS/WAN then manages these connections dynamically.

Create a connection

For example blah

   conn custom_group
            blah bleh

Define your behaviour

in file x

Test

    cd /etc/
    echo "193.110.157.0/24  #includes oetest.freeswan.nl" > custom_group