Create a Linux VPN for a Nokia E61 with Openswan
Listing 5. Rolling the Signed Package File
wine makesis.exe VPN.pkg VPN.sis wine signsis VPN.sis VPN.sisx monkeyiq.cer \ monkeyiq-private-key.key my-certificate-password
Any method can be used to transfer the sisx file to the e61. I've used Bluetooth push, in which case it can be installed on the e61 directly from the incoming messages list. As this sisx file contains a password, it is better to transfer it to the phone using a wired method.
Using a mini-SD card in the e61 and plugging in the USB connection cable to the phone and a Linux machine likely will bring up a file browser for the mounted SD card on the e61. Copy the file to a convenient location, such as Documents/vpn on the e61, and eject or unmount the SD card to force a disk sync before removing the cable (Figure 4).
Once the sisx file is copied to the e61 memory card, the Menu/Office/File Manager on the e61 lets you navigate to the VPN directory on your memory card. When you click the joystick on the VPN sisx file, the phone asks if you want to install it. Right after clicking on the sisx file, you should see something like that shown in Figure 5. After inspecting some metadata, you'll see the ominous-looking screen shown in Figure 6. As you have just created the package from a bunch of text files and you've looked over them for nasties, this security warning shouldn't really be much of a problem to ignore.
The VPN sisx file can be prepared for use by going to Menu→Tools→Settings→Connection→VPN. Select VPN access points and Options→New access point. Set the connection name to something memorable, and set the policy name and access point. A convenient access point is EasyWLAN. You also might want to set the proxy server address and port. It's nice to be able to surf the Internet and get to Intranet servers over the VPN. Directing all Web traffic to the VPN has the added bonus that the Wi-Fi hotspot you are using isn't able to record the Web sites you visit. The final stage is shown in Figure 7.
If you are already using WEP to connect locally and want to continue to do so and be able to test the VPN locally, define another VPN access point, setting its Internet access point to your WEP access point. Having the second VPN config means you won't be prompted for the WEP key when connecting locally. There is little gain in doing VPN over WEP except for not having to loosen the security on your wireless access point.
Packages are shown at rpmseek.com for Fedora, Mandriva and SUSE Linux. Debian.org also lists an Openswan package. On a Fedora Linux machine, Openswan can be installed simply by using yum install openswan. As mentioned previously, I used a Fedora Linux machine for this article; other distributions may have subtle differences.
The two main areas for configuring Openswan are the /etc/ipsec.conf file and a handful of files in /etc/ipsec.d. The main config file can be left as it stands. A few settings that might be of interest are forwardcontrol=yes to turn packet forwarding on and off when Openswan is started and stopped. The other interesting option is the interfaces setting, allowing you to control which IPSec interface is bound to which network interface—for example, interfaces="%defaultroute ipsec2=eth1 ipsec3=ppp1". If no interfaces parameter is specified, Openswan works on the network interface that has the default route. For Internet VPN connections, this is fine.
Another parameter that might come in handy in the ipsec.conf file is setting plutodebug=all, and reading your syslog files if you can't connect.
To describe a connection to Openswan for the e61, create a config file /etc/ipsec.d/e61.conf, as shown in Listing 6. The pfs setting is for perfect forward security. Unfortunately, I've had no luck using this option and connecting from the e61. As shown in the VPN config for the e61, I've listed the left value as %defaultroute, so Openswan will substitute the IP address of the network interface to which the default route points. As the default route is to the Internet, this works well. I've also used the DNS name of the vserv as leftid; this should be optional. You need to substitute your DNS name for monkeyiq.example.org in the config file. The rightsourceip is the virtual IP address that the e61 will use when talking over the VPN. For the firewall rules (shown later), I have assigned the hostname for the e61 to 192.168.6.252 in /etc/hosts.