DSM-G600, DNS-3xx and NSA-220 Hack Forum

Thank you !

In my case, I may try later to replace my DNS-313 Kernel, in order to enable crypt features.

My aim would be to make openswan (IPSEC) + xl2tpd + ppp working, so it would be possible to use the NAS as a "L2TP over IPSEC" VPN server:

- L2tp over Ipsec is (as PPTP) native in Windows XP / Windows Vista / Windows Mobile,
but it is safer.

- As it can run over UDP (Ipsec NAT-T), instead of GRE protocole (PPTP), it can work on networks where PPTP can't (3G providers with NAT not supporting PPTP ...)

- L2tp over Ipsec is as simple to setup as PPTP in Windows XP / Vista / Mobile, when using Pre-Shared Key (instead of Certificates).


Keep us updated !

Last edited by Electrocut (2009-05-17 22:51:16)

metal450 wrote:

Yep...in any case, thanx so much for the tip (u saved me so much time trying to get that iptables stuff working - i wonder why that site, and several others, said they were necessary??)

I think they setup iptables for two reasons:
- to filter incoming traffic: just PPTP is allowed:
iptables -A INPUT -p tcp –dport 1723 -j ACCEPT
iptables -A INPUT -p 47 -j ACCEPT
iptables -A OUTPUT -p tcp –sport 1723 -j ACCEPT
iptables -A OUTPUT -p 47 -j ACCEPT

- to do some NAT, to the traffic going out of the VPN server, so the next hops (default gateway ...), thinks that the traffic is coming from the VPN server itself. This is needed because in the example, remote clients are not in the same network as the LAN (clients 192.168.5.x ... LAN 192.168.0.x ?)
iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE

The article is not clear, I think.

By the way, how have you chosen your VPN client IP addresses ? :
Two cases :
- the VPN clients are taken inside the 192.168.1.0 / 255.255.255.0 local network: you should have enable ARP PROXY, and VPN clients are "bridged" to the LAN Network, everything should be just fine.

- the VPN clients are not taken inside the 192.168.1.0 / 255.255.255.0 local network, you should need Ip masquerade (NAT) too ... (in that case, PING www.google.com shouldn't have work ... but just to be sure ...)

Last edited by Electrocut (2009-05-17 23:29:41)

Sorry, I edited my post just before your reply :p

Electrocut wrote:

In your case, I would have tried:

remoteip 192.168.1.234-240
localip 192.168.1.4

Tried it, same issue - I can access network shares, ping google, but not visit google.  It must have something to do with the cellular connection...will test & let u know!

Keep me posted on your OpenSwan pursuits...I'd be interested to hear how that turns out as well

Those who are looking for both Server and Client, please visit the other thread:
http://dns323.kood.org/forum/viewtopic. … 132#p39132

I will soon post more info on this.