Installing FreeS/WAN

This document will teach you how to install Linux FreeS/WAN. If your distribution comes with Linux FreeS/WAN, we offer tips to get you started.

Requirements

To install FreeS/WAN you must:

Choose your install method

There are three basic ways to get FreeS/WAN onto your system:

FreeS/WAN ships with some Linuxes

FreeS/WAN comes with these distributions.

If you're running one of these, include FreeS/WAN in the choices you make during installation, or add it later using the distribution's tools.

FreeS/WAN may be altered...

Your distribution may have integrated extra features, such as Andreas Steffen's X.509 patch, into FreeS/WAN. They may also use their own startup script locations or directory names.

You might need to create an authentication keypair

If your FreeS/WAN came with your distribution, and it is pre-1.98, generate an RSA key pair for authentication. See these instructions.

Start and test FreeS/WAN

You can now start FreeS/WAN and test whether it's been successfully installed..

RPM install

These instructions are for a recent Red Hat with a stock Red Hat kernel. We know that Mandrake and SUSE also produce FreeS/WAN RPMs. If you're running either, install using your distribution's tools.

Download RPMs

Decide which functionality you need:

  • standard FreeS/WAN RPMs from our FTP site
  • or unofficial RPMs from freeswan.ca, which include Andreas Steffen's X.509 patch
  • Check your kernel version with

        uname -a

    Get a kernel module which matches that version. For example:

        freeswan-module-1.98b_2.4.18_3-0.i386.rpm

    Note: These modules will only work on the Red Hat kernel they were built for, since they are very sensitive to small changes in the kernel.

    Get FreeS/WAN utilities to match. For example:

        freeswan-1.98b_2.4.18_3-0.i386.rpm

    For freeswan.org RPMs: check signatures

    While you're at our ftp site, grab the RPM signing key

        rpmsign.pgp

    and add it to your PGP keyring:

        pgp -ka rpmsign.pgp

    Check the signatures on both RPMs using:

        rpm --checksig freeswan-module-1.98b_2.4.18_3-0.i386.rpm
        rpm --checksig freeswan-1.98b_2.4.18_3-0.i386.rpm

    You should see:

        freeswan-module-1.98b_2.4.18_3-0.i386.rpm: pgp md5 OK
        freeswan-1.98b_2.4.18_3-0.i386.rpm: pgp md5 OK

    Install the RPMs

    Become root:

        su

    Install your RPMs with:

        rpm -ivh freeswan*

    Start and Test FreeS/WAN

    Now, start FreeS/WAN and test your install.

    Install from Source

    Decide what functionality you need

    Your choices are:

    Download FreeS/WAN

    Download the source tarball you've chosen, along with any patches.

    For freeswan.org source: check its signature

    While you're at our ftp site, get our RPM signing key

        rpmsign.pgp

    and add it to your PGP keyring:

        pgp -ka rpmsign.pgp

    Check the signature using:

        pgp freeswan-1.98b.tar.gz.sig freeswan-1.98b.tar.gz

    You should see something like:

        Good signature from user "Linux FreeS/WAN Software Team ".
        Signature made 2002/06/26 21:04 GMT using 2047-bit key, key ID 46EAFCE1

    Untar, unzip

    As root, unpack your FreeS/WAN source into /usr/src.

        su
        mv freeswan-1.98b.tar.gz /usr/src
        cd /usr/src
        tar -xzf freeswan-1.98b.tar.gz
    

    Patch if desired

    Now's the time to add any patches. The contributor may have special instructions, or you may simply use the patch command.

    ... and Make

    Either make FreeS/WAN as a module...

    Change to your new FreeS/WAN directory:

        cd /usr/src/freeswan-1.98b

    Make the FreeS/WAN module:

        make oldmod

    Install it:

        make minstall

    You can directly start FreeS/WAN and test your install.

    ...or statically linked

    Make FreeS/WAN using your old kernel settings:

        make oldgo

    Install it:

        make kinstall

    Reboot your system and test your install.

    Start FreeS/WAN and test your install

    Bring FreeS/WAN up with:

        service ipsec start

    This is not necessary if you've rebooted.

    Test your install

    To check that you have a successful install, run:

        ipsec verify

    You should see at least:

        Checking your system to see if IPsec got installed and started correctly
        Version check and ipsec on-path                             [OK]
        Checking for KLIPS support in kernel                        [OK]
        Checking for RSA private key (/etc/ipsec.secrets)           [OK]
        Checking that pluto is running                              [OK]
    

    If any of these first four checks fails, see our troubleshooting guide.

    Making FreeS/WAN play well with others

    There are several things on your system that might interfere with FreeS/WAN, and now's a good time to check these:

    Configure for your needs

    You'll need to configure FreeS/WAN for your local site. Have a look at our opportunism quickstart guide to see if that easy method is right for your needs. Or, see how to