FreeS/WAN 2.00 is a hosts-only release, suitable only for machines that function as leaf nodes: machines that do not route IP traffic between networks. It is BROKEN for machines that route IP traffic between networks. For discussion on the subject see this link.
We plan a fix in release 2.01, due April 2003. Although the 2.00 documentation contains instructions for security gateways, we caution you to use these at your own risk.
ipsec.conf now has automatically enabled connections to facilitate Opportunistic Encryption (OE). OE allows you to encrypt to virtual strangers, and, if widely adopted, would reduce eavesdropping on the 'net.
You need to set up a few DNS records to use this feature. See our OE quickstart guide for details.
If you install and start FreeS/WAN before you have set up these DNS records, you will lose connectivity. In the interim, you can disable the feature with these instructions.
We want to make it easy for you to declare security policy as it applies to IPsec connections.
Policy Groups make it simple to say:
FreeS/WAN then implements these policies, creating connections opportunistically if and when needed. You can use Policy Groups along with connections you explicitly define in ipsec.conf.
For more information, see our Policy Group HOWTO.
FreeS/WAN often doesn't work with reverse path filtering. At start time, FreeS/WAN now turns rp_filter off, and logs a warning.
FreeS/WAN does not turn it back on again. You can do this yourself with a command like:
echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter
For eth0, substitute the interface which FreeS/WAN was affecting.
The FreeS/WAN team promised config-file compatibility throughout the 1.x series. That means a 1.5 config file can be directly imported into a fresh 1.99 install with no problems.
With FreeS/WAN 2.x, we've given ourselves permission to make the config file easier to use. The cost: some FreeS/WAN 1.x configurations will not work properly. Many of the new features are, however, backward compatible.
... so long as you paste this line, with no preceding whitespace, at the top of your config file:
version 2
If the new defaults bite you, use this ipsec.conf fragment to simulate the old default values.
We've obsoleted various directives which almost no one was using:
dump plutobackgroundload no_eroute_pass lifetime rekeystart rekeytries
For most of these, there is some other way to elicit the desired behaviour. See this post.
We've made some settings, which almost everyone was using, defaults. For example:
interfaces=%defaultroute plutoload=%search plutostart=%search uniqueids=yes
We've also changed some default values to help with OE and Policy Groups:
authby=rsasig ## not secret!!! leftrsasigkey=%dnsondemand ## looks up missing keys in DNS when needed. rightrsasigkey=%dnsondemand
Of course, you can still override any defaults by explictly declaring something else in your connection.
A post with a list of many ipsec.conf changes.
Current ipsec.conf manual.
Note: When upgrading from 1-series to 2-series RPMs, rpm -U will not work.
You must instead erase the 1.x RPMs, then install the 2.x set:
rpm -e freeswan
rpm -e freeswan-module
On erasing, your old ipsec.conf should be moved to ipsec.conf.rpmsave. Keep this. You will probably want to copy your existing connections to the end of your new 2.x file.
Install the RPMs suitable for your kernel version, such as:
rpm -ivh freeswan-module-2.00_2.4.18_3-0.i386.rpm
rpm -ivh freeswan-userland-2.00_2.4.18_3-0.i386.rpm
Or, to splice the files:
cat /etc/ipsec.conf /etc/ipsec.conf.rpmsave > /etc/ipsec.conf.tmp mv /etc/ipsec.conf.tmp /etc/ipsec.conf
Then, remove the redundant conn %default and config setup sections. Unless you have done any special configuring here, you'll likely want to remove the 1.x versions. Remove conn OEself, if present.