Create a Linux VPN for a Nokia E61 with Openswan

 in
Create a virtual private network between your Nokia E61 phone and a Linux gateway.
Installing the VPN sisx and Final e61 Setup

Any method can be used to transfer the sisx file to the e61. I've used Bluetooth push, in which case it can be installed on the e61 directly from the incoming messages list. As this sisx file contains a password, it is better to transfer it to the phone using a wired method.

Using a mini-SD card in the e61 and plugging in the USB connection cable to the phone and a Linux machine likely will bring up a file browser for the mounted SD card on the e61. Copy the file to a convenient location, such as Documents/vpn on the e61, and eject or unmount the SD card to force a disk sync before removing the cable (Figure 4).

Figure 4. Copy the VPN file to a subdirectory of Documents on the memory card.

Once the sisx file is copied to the e61 memory card, the Menu/Office/File Manager on the e61 lets you navigate to the VPN directory on your memory card. When you click the joystick on the VPN sisx file, the phone asks if you want to install it. Right after clicking on the sisx file, you should see something like that shown in Figure 5. After inspecting some metadata, you'll see the ominous-looking screen shown in Figure 6. As you have just created the package from a bunch of text files and you've looked over them for nasties, this security warning shouldn't really be much of a problem to ignore.

Figure 5. Starting the VPN Policy sisx Install

Figure 6. As we made the package, we trust that this is not really a security issue.

The VPN sisx file can be prepared for use by going to Menu→Tools→Settings→Connection→VPN. Select VPN access points and Options→New access point. Set the connection name to something memorable, and set the policy name and access point. A convenient access point is EasyWLAN. You also might want to set the proxy server address and port. It's nice to be able to surf the Internet and get to Intranet servers over the VPN. Directing all Web traffic to the VPN has the added bonus that the Wi-Fi hotspot you are using isn't able to record the Web sites you visit. The final stage is shown in Figure 7.

If you are already using WEP to connect locally and want to continue to do so and be able to test the VPN locally, define another VPN access point, setting its Internet access point to your WEP access point. Having the second VPN config means you won't be prompted for the WEP key when connecting locally. There is little gain in doing VPN over WEP except for not having to loosen the security on your wireless access point.

Figure 7. The final setup—give a name and Wi-Fi access point to the policy, and maybe set a proxy server too.

Setting Up the Linux Openswan End

Packages are shown at rpmseek.com for Fedora, Mandriva and SUSE Linux. Debian.org also lists an Openswan package. On a Fedora Linux machine, Openswan can be installed simply by using yum install openswan. As mentioned previously, I used a Fedora Linux machine for this article; other distributions may have subtle differences.

The two main areas for configuring Openswan are the /etc/ipsec.conf file and a handful of files in /etc/ipsec.d. The main config file can be left as it stands. A few settings that might be of interest are forwardcontrol=yes to turn packet forwarding on and off when Openswan is started and stopped. The other interesting option is the interfaces setting, allowing you to control which IPSec interface is bound to which network interface—for example, interfaces="%defaultroute ipsec2=eth1 ipsec3=ppp1". If no interfaces parameter is specified, Openswan works on the network interface that has the default route. For Internet VPN connections, this is fine.

Another parameter that might come in handy in the ipsec.conf file is setting plutodebug=all, and reading your syslog files if you can't connect.

To describe a connection to Openswan for the e61, create a config file /etc/ipsec.d/e61.conf, as shown in Listing 6. The pfs setting is for perfect forward security. Unfortunately, I've had no luck using this option and connecting from the e61. As shown in the VPN config for the e61, I've listed the left value as %defaultroute, so Openswan will substitute the IP address of the network interface to which the default route points. As the default route is to the Internet, this works well. I've also used the DNS name of the vserv as leftid; this should be optional. You need to substitute your DNS name for monkeyiq.example.org in the config file. The rightsourceip is the virtual IP address that the e61 will use when talking over the VPN. For the firewall rules (shown later), I have assigned the hostname for the e61 to 192.168.6.252 in /etc/hosts.

______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Here is an article Going

Rick's picture

Here is an article Going mobile with VoIP and SymVPN:
http://gonedigital.net/2010/06/05/going-mobile-with-voip-and-symvpn/

It seems that there is no problem to use PPTP VPN with VoIP on Nokia phone, but I have doubt that IPSec VPN can provide needed speed.
Have you tried to use IPSec VPN with VoIP software on your Nokia E61? Is it actually possible to have normal VoIP conversation over IPSec VPN?

New HOWTO using modern kernel based IPSEC

Anonymous's picture

I just posted a new HOWTO for connecting nokia VPN to linux using the new kernel based IPSec (requires kernel 2.6.20+).
This is a pure linux solution, not needing any windows software. The HOWTO covers everything including setting up the linux iptables firewall.
Uses RSA authentication, XAUTH is trivial to add:

HOWTO connect Nokia VPN to GNU/Linux

comments welcome
Shai

How can I pass the DNS setting to my phone?

gomobi's picture

Thanks for the great instruction. I have successfully connected my N82 to the VPN gateway. The problem is that the DNS setting is not correctly passed to the phone, I also got DNS error. Could you please give some suggestion?

Thanks again.

complicated

a bit thick's picture

my missus thinks I'm a genius with computers and phones but i would need to be Einstein to follow this stuff.
Reading it makes me realise how inadequate I really am.
Isnt there a version u can just click a link and hey presto it's downloaded onto your phone ;)

To complicated, I have installed SymVPN instead.

Anonymous's picture

To complicated.
That is why I am using SymVPN.
It is not IPSec, and it is not Openswan, as it is PPTP based VPN. However it is worth it - 5 parameters to enter and it works in 30 sec.
No headache with policy file.
No headache with signing.
Yes, it is probably less secure then Openswan and IPSec, but at least it is working, but Nokia Mobile VPN it is the dead end road for 98% of all Nokia phone users. Sounds promising in the theory, but nothing works in practice.

Too expensive

Anonymous's picture

SymVPN may be great but I don't see the point in paying all that money for something that I can already do for free.

If SymVPN were $10 or something that might be worth it but currently it's ridiculously expensive for the tiny functionality it provides. Plus, if we're talking easy-to-use-and-secure VPN, I would prefer the more secure OpenVPN over PPTP anyway.

SymVPN all the way and it is not expensive at all.

Anonymous's picture

I would say it is way too cheap for me. Look, with help of SymvPN I have saved just in 1 month on long distance phone charges more money than I have paid for this software. That is why I will buy it even if it will cost 5 time more. I need SymVPN to use it with VoIP. Withour VPN I cannot use VoIP on phone in my country. Just count your money and see for yourself.

Unfortunately on FP2 S60v3

morphix's picture

Unfortunately on FP2 S60v3 devices, SymVPN doesn't work properly, pretty much not at all due to the "Destinations" access point settings available in FP2 only devices, that counts my Nokia N96 out :(

SymVPN works just fine with Destinations.

Anonymous's picture

I am using SymVPN v.2.00 on my Nokia 5800 and it works fine with "Destinations". Created VPN Access Point is placed in Uncategorised destination and after that you just have to to move it to any destination where you need it.

Thanks for really good

Anonymous's picture

Thanks for really good article!
Now days everything can be made more simple way with appearance of SymVPN from www.telexy.com
SymVPN is PPTP VPN client for Series 60 3rd phones.

Installation instruction in German WIKI / Update

FreshSmith's picture

== '''NOKIA VPN Client mit Open Source strongSWAN''' ==

'''Voraussetzungen:'''

# StrongSwan mit öffentlicher IP Adresse
# Symbian makesis.exe zum Serstellen von SIS Installationspaketen
# Konfigurationsfiles für SIS VPN Paket

'''Konfiguration:'''

'''''StrongSWAN'''''
StrongSwan ipsec.conf anpassen und NAT Traversat (NAT-T) aktivieren. Dies ist wichtig, da viele Mobilfunkprovider intern noch einmal natten. Die zugeteilte IP Adresse am Telefon entspricht nicht der IP Adresse, die bei einem Verbingsaufbau beim StrongSWAN ankommt.

''
config setup
interfaces="ipsec0=eth0"
klipsdebug=all
plutodebug=none
nat_traversal=yes
include /etc/ipsec.d/ipsec-conn-e61-mrobichon.fas
include /etc/ipsec.d/ipsec-conn-e61-njaixen.fas
''

Danach müssen in der ipsec.secerts der PSK Key hinterlegt werden:

'': PSK "xxxxxxxxxxxxxxxxxxxx"''

Falls XATH benutzt werden soll, hier wird bei der Initialisierung der Verbindung Username und Passwort abgefragt, dann sollte hier auch noch der entsprechende Eintrag mit Credentials hionterlagt werden:

'': XAUTH User "password"''

Nun kommen wir zu den Verbindungen. Hier wird es interessant. Im oberen Beispiel werden zwei Verbindungen in der ipsec.conf includiert. Die Konfiguration könnte so aussehen:

''
conn e61-mrobichon
# Key exchange
ike=aes256-sha1-modp1536
# Data exchange
esp=aes256-sha1
# Authentication method PSK
authby=secret
#authby=xauthpsk
auto=start
keyingtries=3
# Modeconfig setting
modeconfig=pull
pfs=no
rekey=no
# LEFT: serverseite
#leftid=0.0.0.0/0
left=%defaultroute
#Internes Netz, falls alles geroutet werden soll dann 0.0.0.0
leftsubnet=172.16.25.0/24
#leftsubnet=0.0.0.0/0
leftrsasigkey=none
# leftmodecfgserver=yes
#Falls XAUTH verwendet werden soll, dann diesen Eintrag aktivieren
# leftxauthserver=yes
xauth=server
# RIGHT: clientseite
rightrsasigkey=none
right=%any
# Right ID ist absolut wichtig, wenn meherere Verbindungen von
# unterschidlichen Clients aufgebaut werden sollen = FQDN (binär)
rightid=@#4d6f62696c6547726f7570
# rightxauthclient=yes
# rightmodecfgclient=yes
# virtuelle IP Adresse des IPSEC Tunnels pro Client und Connection
rightsourceip=192.168.44.1
rightsubnet=192.168.44.1/32
''

Parameter, die editiert werden müssen:

* leftsubnet=172.16.25.0/24 -- internes Netz
* rightid=@#4d6f62696c6547726f7570 -- in der Nokia pol (später) representiert die ID die FQDN und wird hier binär ausgedrückt. Am besten man lässt das Feld offen und probiert erst mal aus, welche ID übermittelt wird. Die kann man sehen, wenn man eine Verbindung aufbaut und in die messages reinschaut:
"e61-njaixen"[6] 92.116.229.249 #9: Peer ID is ID_KEY_ID: '0x4d6f62696c6547726f7570'
das 0x wird durch @# ersetzt
* rightsourceip=192.168.44.1 -- virtuelle IP Adresse, die dem Client zugeordnet wird dasselbe mit dem rightsubnet (virtuelle Client IP + Subnetz localhost = 32)

'''''NOKIA'''''

'''Konfigurationsdateien:'''

Die Konfiguration besteht aus drei Dateien: pin, pkg, pol. Die Dateien müssen denselben Dateinamen haben. pin und pkg brauchen nicht editiert zu werden.
Als Beipiel hier die Konfigurationen:

VPN-policy-preshared-Cisco.pin
''
[POLICYNAME]
VPN-Policy
[POLICYDESCRIPTION]
VPN-Policy for Nokia Mobile VPN Client v3.0.
[POLICYVERSION]
1.1
[ISSUERNAME]
Do not edit
[CONTACTINFO]
Do not edit
''

VPN-policy-preshared-Cisco.pkg
''
;
; A VPN POLICY PACKAGE
;

; LANGUAGES
; - None (English only by default)

; INSTALLATION HEADER
; - Only one component name is needed to support English only
; - UID is the UID of the VPN Policy Installer application
#{"VPN-Policy"},(0x1000597E), 1, 0, 0, TYPE=SA
;Localised Vendor name
%{"pip-EN"}

;Unique Vendor name
:"pip"

; LIST OF FILES
; Policy file
"VPN-policy-preshared-Cisco.pol"-"C:\System\Data\Security\Install\VPN-polic­y-preshared-Cisco.pol"
; Policy-information file
; - NOTE: The policy-information file MUST be the last file in this list!
; - FM (FILEMIME) passes the file to the respective MIME handler
; (in this case, the VPN Policy Installer application).
"VPN-policy-preshared-Cisco.pin"-"C:\System\Data\Security\Install\VPN-polic­y- preshared-Cisco.pin",
FM, "application/x-ipsec-policy-info"
; REQUIRED FILES
; - The VPN Policy Installer application
(0x1000597E), 1, 0, 0, {"VPN Policy Installer"}
; - S60 3rd Edition ID
[0x101F7961], 0, 0, 0, {"S60ProductID"}
''

VPN-policy-preshared-Cisco.pol
''
SECURITY_FILE_VERSION: 3
[INFO]
VPN
[POLICY]
sa ipsec_1 = {
esp
encrypt_alg 12
max_encrypt_bits 256
auth_alg 3
identity_remote 172.16.25.0/24 #internes Netz
src_specific
hard_lifetime_bytes 0
hard_lifetime_addtime 3600
hard_lifetime_usetime 3600
soft_lifetime_bytes 0
soft_lifetime_addtime 3600
soft_lifetime_usetime 3600
}
remote 172.16.25.0 255.255.255.0 = { ipsec_1(xxx.xxx.xxx.xxx) } #internes Netz {StrongSWAN IP}
inbound = { }
outbound = { }
[IKE]
ADDR: xxx.xxx.xxx.xxx 255.255.255.255 #StrongSWAN IP
MODE: MAIN
SEND_NOTIFICATION: TRUE
ID_TYPE: 11
FQDN: MobileGrou2 #rightid (binär) in StrongSWAN Konfiguration
GROUP_DESCRIPTION_II: MODP_1536
USE_COMMIT: FALSE
IPSEC_EXPIRE: FALSE
SEND_CERT: FALSE
INITIAL_CONTACT: FALSE
RESPONDER_LIFETIME: TRUE
REPLAY_STATUS: TRUE
USE_INTERNAL_ADDR: FALSE
USE_NAT_PROBE: FALSE
ESP_UDP_PORT: 0
NAT_KEEPALIVE: 60
USE_XAUTH: FALSE #Falls XAUTH benutzt werden soll
USE_MODE_CFG: TRUE
REKEYING_THRESHOLD: 90
PROPOSALS: 1
ENC_ALG: AES256-CBC
AUTH_METHOD: PRE-SHARED
HASH_ALG: SHA1
GROUP_DESCRIPTION: MODP_1536
GROUP_TYPE: DEFAULT
LIFETIME_KBYTES: 0
LIFETIME_SECONDS: 28800
PRF: NONE
PRESHARED_KEYS:
FORMAT: STRING_FORMAT
KEY: 20 xxxxxxxxxxxxxxxxxxxx #Secret in ipsec.secrets
''

'''Installtion'''

Erstellung der SIS Datei mit "makesis VPN-policy-preshared-Cisco.pkg" die SIS Datei wird erstellt. Danach einloggen auf [[https://www.symbiansigned.com/app/page]]
Hier auf den Link "Open Signed Online". Auf dieser Seite muss nun die IMEI des Mobiltelefons eingegeben werden, auf dem die Policy geladen werden soll *#06#. Mailadresse, an die der Link zur Apllikation gesendet wird und natürlich upload der SIS Datei, welche signiert werden soll. Man erhält eine Verifizierungsmail und kurz danach den Link zum Download der signierten Applikation.

Die Aplikation installiert man dann via PC Suite oder ähnliches direkt auf dem Mobiltelefon. Sollten IMEI nicht zusammen passen, dann muss das ganze nochmal erstellt werden. Nun geht man nach

System --> Einstellungen --> Verbindung --> VPN --> VPN Zugangspunkt

Verbindungsname frei wählbar
VPN-Richtline die gerade geladene Richtlinie (VPN-policy)
Internetzugangspunkt Providereinwahl

alle anderen Punkte so lassen.

Fertig.

Folgende Webseiten waren sehr hilfreich:

#[[http://www.thorsten-knabe.de/linux/e61.jsp]]
#[[http://pipip.de/other.php?sub=nokia_vpn]]
#[[http://cratoo.de/2007/10/09/howto-wie-verbindung-mit-dem-nokia-e61i-per-vpn-aufbauen]]
#[[http://www.linuxjournal.com/article/9646]]

White Paper
Linux Management with Red Hat Satellite: Measuring Business Impact and ROI

Linux has become a key foundation for supporting today's rapidly growing IT environments. Linux is being used to deploy business applications and databases, trading on its reputation as a low-cost operating environment. For many IT organizations, Linux is a mainstay for deploying Web servers and has evolved from handling basic file, print, and utility workloads to running mission-critical applications and databases, physically, virtually, and in the cloud. As Linux grows in importance in terms of value to the business, managing Linux environments to high standards of service quality — availability, security, and performance — becomes an essential requirement for business success.

Learn More

Sponsored by Red Hat

White Paper
Private PaaS for the Agile Enterprise

If you already use virtualized infrastructure, you are well on your way to leveraging the power of the cloud. Virtualization offers the promise of limitless resources, but how do you manage that scalability when your DevOps team doesn’t scale? In today’s hypercompetitive markets, fast results can make a difference between leading the pack vs. obsolescence. Organizations need more benefits from cloud computing than just raw resources. They need agility, flexibility, convenience, ROI, and control.

Stackato private Platform-as-a-Service technology from ActiveState extends your private cloud infrastructure by creating a private PaaS to provide on-demand availability, flexibility, control, and ultimately, faster time-to-market for your enterprise.

Learn More

Sponsored by ActiveState