Thread
IPSec server to secure Airport link
WEP's insecure so I want to use IPSec to prevent airside access to either my home machine or my Lombard portable. Jaguar apparently (haven't received my copies yet) has an IPSec client: does anybody know of a compatible server I can run on the iMac home machine?
Alternatively, has anybody used some other technique to secure the link?
Alternatively, has anybody used some other technique to secure the link?
You're asking the wrong question.
IPSec provides a secure, encrypted tunnel between two hosts. It does not mean that the hosts in question are secure in any way other than the traffic that passes between them.
At the very least, to stop people listening in on your traffic you would have to setup IPSec between you and your router, but that does not prevent other people using your AirPort base station to either attempt to compromise your machine or piggy-back on your ISP connection.
What is it you're trying to achieve?
If it's securing your that you're after, install (and properly configure) a firewall to block unwanted traffic. If it's preventing other people from snooping your traffic, use ssh tunnels to encrypt all traffic.
If you insist on using AirPort and you're paranoid, change your WEP key frequently.
IPSec provides a secure, encrypted tunnel between two hosts. It does not mean that the hosts in question are secure in any way other than the traffic that passes between them.
At the very least, to stop people listening in on your traffic you would have to setup IPSec between you and your router, but that does not prevent other people using your AirPort base station to either attempt to compromise your machine or piggy-back on your ISP connection.
What is it you're trying to achieve?
If it's securing your that you're after, install (and properly configure) a firewall to block unwanted traffic. If it's preventing other people from snooping your traffic, use ssh tunnels to encrypt all traffic.
If you insist on using AirPort and you're paranoid, change your WEP key frequently.
Thanks for the comments: my original post was unclear. My intent was/is to use brickhouse/ipfw to prevent all connections other than those secured by IPSec, so I get both a secure connection between the machines, and prevent unauthorised access to them as well. I don't have a router, or at least, not one that can terminate an IPSec link, so was looking to use the desktop iMac to both do this and act as an Airport base station to share my cable internet connection with the Powerbook via an ad hoc 802.11 link.
Another complication is that I'm not sure I can get WEP working on the air link (Cisco have an OSX driver for their expensive card, Asante do too but aren't available in Australia, and the open source drivers vary in their support for WEP for other cards (and may not permit ad hoc networking but that's another issue).
I'll look into the ssh tunnels- but thought IPSec was 'built into' Jaguar (ie with a GUI) and might be easier/faster to set up. If anyone has done this, I'd appreciate hearing about how it was done.
Another complication is that I'm not sure I can get WEP working on the air link (Cisco have an OSX driver for their expensive card, Asante do too but aren't available in Australia, and the open source drivers vary in their support for WEP for other cards (and may not permit ad hoc networking but that's another issue).
I'll look into the ssh tunnels- but thought IPSec was 'built into' Jaguar (ie with a GUI) and might be easier/faster to set up. If anyone has done this, I'd appreciate hearing about how it was done.
First, Mac OS X 10.2 supports PPTP tunnels, not IPSec. I don't know if that makes much difference in what you're trying to do or not - just be aware of it.
Second, I've never thought of using an IPSec (or PPTP) tunnel to encrypt ALL traffic. I've only ever used it to encrypt specific subnets - but I guess it's possible.
What you'll need is a PPTP server running on a wired Mac on your network. PopTop is an open-source PPTP server that may well work (it lists Linux, Solarix, FreeBSD and OpenBSD, so you might be in luck)
Second, I've never thought of using an IPSec (or PPTP) tunnel to encrypt ALL traffic. I've only ever used it to encrypt specific subnets - but I guess it's possible.
What you'll need is a PPTP server running on a wired Mac on your network. PopTop is an open-source PPTP server that may well work (it lists Linux, Solarix, FreeBSD and OpenBSD, so you might be in luck)
10.2 _does_ support IPsec. You have to use setkey(8) to configure it though, no GUI available yet. The MacOS X implementation is based on KAME, for which you'll find plenty of tutorials, HOWTO's, and other docs on the web.