Today people are using more frequently public hotspots, many Cafe, Restaurants and Pubs offer wifi connection for free. Who doesn’t check their Facebook or send a tweet while having an espresso macchiato or enjoying a fresh beer? I guess everyone. The downside of using a public hotspot is that you put your personal data and information at serious risk. Connecting to a public hotspot can expose your data and the system to various attacks, like man in the middle, password sniffing and credential stealing. If we really want protect our data wen we are on the road, we need to use a VPN connection, a VPN is a particular service that encapsulates our network traffic keeping it private. Fortunately android has a standout built-in VPN connection tool that allows to use various VPN technologies, such 2TP/IPSec PSK, PPTP VPNS and many other. In this post i’m going to show how to set up a VPN gateway and connect with your android device safely while using a public hotspot.
First of all you need to have a linux server, in this case I’m using Ubuntu Linux 10.04. A public ip address is required.
You need to install the xl2tpd openswan ppp from the apt repository and then download the newest version from the Ubuntu 11.04 repository, otherwise the VPN won’t work.
apt-get install xl2tpd openswan ppp
wget http://se.archive.ubuntu.com/ubuntu/pool/universe/o/openswan/openswan_2.6.28+dfsg-5_i386.deb
wget http://ubuntu.linux-bg.org/ubuntu//pool/universe/x/xl2tpd/xl2tpd_1.2.7+dfsg-1_i386.deb
dpkg -i openswan_2.6.28+dfsg-5_i386.deb
dpkg -i xl2tpd_1.2.7+dfsg-1_i386.deb
In the /etc/ipsec.conf file copy:
config setup
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!10.152.2.0/24
oe=off
protostack=netkey
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=x.x.x.x
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
In the /etc/ipsec.secrets file copy:
x.x.x.x %any: PSK "somegoodpassword"
Start the IPSEC service with /etc/init.d/ipsec start
Please verify the IPSEC service with : ipsec verify
you must get no errors.
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.28/K2.6.32-32-generic-pae (netkey)
Checking for IPsec support in kernel [OK]
NETKEY detected, testing for disabled ICMP send_redirects [OK]
NETKEY detected, testing for disabled ICMP accept_redirects [OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [OK]
Checking for 'ip' command [OK]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]
Create a file called ipsec.vpn in /etc/init.d/
case "$1" in
start)
echo "Starting my Ipsec VPN"
iptables -t nat -A POSTROUTING -o eth0 -s 10.152.2.0/24 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
for each in /proc/sys/net/ipv4/conf/*
do
echo 0 > $each/accept_redirects
echo 0 > $each/send_redirects
done
/etc/init.d/ipsec start
/etc/init.d/xl2tpd start
;;
stop)
echo "Stopping my Ipsec VPN"
iptables --table nat --flush
echo 0 > /proc/sys/net/ipv4/ip_forward
/etc/init.d/ipsec stop
/etc/init.d/xl2tpd stop
;;
restart)
echo "Restarting my Ipsec VPN"
iptables -t nat -A POSTROUTING -o eth0 -s 10.152.2.0/24 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
for each in /proc/sys/net/ipv4/conf/*
do
echo 0 > $each/accept_redirects
echo 0 > $each/send_redirects
done
/etc/init.d/ipsec restart
/etc/init.d/xl2tpd restart
;;
*)
echo "Usage: /etc/init.d/ipsec.vpn {start|stop|restart}"
exit 1
;;
esac
Disalble the ipsec default init script with
#update-rc.d -f ipsec remove
And enbable the custom one.
#update-rc.d ipsec.vpn defaults
In the file /etc/xl2tpd/xl2tpd.conf
[global]
ipsec saref = no
[lns default]
ip range = 10.152.2.2-10.152.2.254
local ip = 10.152.2.1
require chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
In the file /etc/xl2tpd/l2tp-secrets copy:
Choose a good challenge-response authentication string,The secret should, ideally, be 16 characters long, and should probably be longer to ensure sufficient security. There is no minimum length requirement, however.
* * exampleforchallengestring
In the file /etc/ppp/options.xl2tpd copy:
refuse-mschap-v2
refuse-mschap
ms-dns 8.8.8.8
ms-dns 8.8.4.4
asyncmap 0
auth
lock
hide-password
local
#debug
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4
In the file /etc/ppp/chap-secrets copy:
Note: you can add as many user you like.
user1 * chooseagoodpassword *
user2 * chooseagoodpassword *
Starting the VPN.
/etc/init.d/ipsec.vpn restart
Connecting to the VPN
On the Android mobile:
Go to Settings > Wireless & networks > VPN settings > Add VPN > Add L2TP/IPSec PSK VPN >
VPN name > the name you like
Set VPN server > ip address of the VPN server (x.x.x.x)
Set IPSec pre-shared key > somegoodpassword
Enable L2TP secret > enable
Set L2TP secret > was exampleforchallengestring
Press back, then connect using the PPP username/password (user1 chooseagoodpassword)
Wait for the message VPN connected on the mobile.
Debug.
In case of problems this are a few commands that can help out the debugging.
tcpdump -i ppp0
tail -f /var/log/auth.log
tail -f /var/log/daemon.log
Devices:
So far I’ve tested this configuration on only two devices, the ideos u8150 and the HTC Desire HD.
Did you like this? Share it:
Attach the Turnkey Iso appliance.
