Re: VPN between OpenBSD loopback interfaces - possible ?

2010-06-08 Thread Claer
On Mon, Jun 07 2010 at 10:18, rh...@hushmail.com wrote: Actually, thinking about this again, I see from netstat -an that isakmpd listens on all ports by default. Therefore needing to specify in isakmpd.conf should be unnecessary, no ? My bad, normally the local directive in ipsec.conf

Re: VPN between OpenBSD loopback interfaces - possible ?

2010-06-08 Thread rhsv6
Here is the configuration I used between 2 peers ike esp tunnel \ Interesting. Thanks for that, and for your help. I now seem to be able to get a flow going but not traffic (e.g. with the below I cannot ping). I'm sure I'm missing something obvious, but I think I need that second pair

VPN between OpenBSD loopback interfaces - possible ?

2010-06-07 Thread rhsv6
Hello List, Have a working OSPF / BGP test setup going between two machines, with BGP using the loopback of the other machine as the endpoint. I now would like to go one step further and implement PF with pfsync over IPSec as I don't have any spare ethernet ports. The problem is that I've

Re: VPN between OpenBSD loopback interfaces - possible ?

2010-06-07 Thread Claer
On Mon, Jun 07 2010 at 15:10, rh...@hushmail.com wrote: Hello List, Have a working OSPF / BGP test setup going between two machines, with BGP using the loopback of the other machine as the endpoint. I now would like to go one step further and implement PF with pfsync over IPSec as I

Re: VPN between OpenBSD loopback interfaces - possible ?

2010-06-07 Thread rhsv6
Aren't you looking for this ? : r...@fw ~ # cat /etc/isakmpd/isakmpd.conf \ Claer I was so focused on trying to make ipsec.conf work that I did not realise other options such as iaskmpd.conf might be worth investigating. Combined with the fact that I'm

Re: VPN between OpenBSD loopback interfaces - possible ?

2010-06-07 Thread rhsv6
Actually, thinking about this again, I see from netstat -an that isakmpd listens on all ports by default. Therefore needing to specify in isakmpd.conf should be unnecessary, no ? The precise errors I am seeing at present are : Default rsa_sig_decode_hash: no public key found Default dropped