Create a Linux VPN for a Nokia E61 with Openswan

Create a virtual private network between your Nokia E61 phone and a Linux gateway.

The same private key that was specified in the KEY field of the VPN policy above should be placed into the /etc/ipsec.d/e61.secrets file, shown in Listing 7.

Finally, the USE_XAUTH option in the VPN policy needs Openswan to have a user name and password lookup for this connection. The Openswan README.XAUTH file recommends against using PAM for this. The password file can be created using htpasswd from the Apache package, as shown in Listing 8. A sample of the passwd file is shown in Listing 9.

A Hole in the Wall—iptables

Trying to debug packet logs on the machine that is running as the IPSec server can be a little difficult. Packets that arrive encrypted are decrypted and put onto the network interface to appear as though they have arrived without any encryption. Part of a packet log is shown in Listing 10, showing a packet that appears to have come from the e61's IP address without any encryption. The log is further complicated because the WEP setup gives the e61 the same IP address as the VPN does. For traffic from the Internet, the top two packets will have a random IP address instead of the e61. To get a clearer picture of the packet data, connecting the e61 through a laptop to vserv allows proper packet snooping on the laptop. The imaps packet in Listing 10 will not be seen by the laptop—only a bidirectional stream of ESP packets.

The iptables commands shown in Listing 11 provide a base to allow the e61 to connect to the IPSec server from the Internet.

The packet filtering rules are quite simple. Allow Internet Security Association and Key Management Protocol (ISAKMP) packets to enter and exit the server and allow any Encapsulating Security Payload (ESP) traffic, assuming that the IPSec server will be responsible for sorting out fraudulent packets. VPN traffic itself is sent through the ESP packets; the ISAKMP is used at the VPN session startup, and those packets also are logged, so that the syslog monitor can alert you of strange connection attempts or door knocking.

Because the non-encrypted traffic is placed on the network interface when Openswan is done with it, the rules have to allow e-mail and squid connections from the e61 IP address. I need to have these rules here because normally no connections can be initiated on the network interface connected to the Internet. If you filter outward traffic too, you have to allow packets from these services to the e61 to be sent to the Internet network interface (to be encrypted by Openswan before being sent to the proper Internet address).

The firewall rules are designed to be used with a default policy of drop. The logging commands can be added or removed to help debugging by searching for the relevant log prefix in /var/log/messages to see which packets are moving around before the firewall may drop them. The script shown in Listing 12 undoes what was done by Listing 11 to disable remote access again.

You also might want to consider using a Single Packet Authorization (SPA) client on the e61 and setting up the server to open the firewall ISAKMP port only after a successful SPA. See Michael Rash's “Single Packet Authorization” article in the April 2007 issue of Linux Journal for more information on SPA.



Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Here is an article Going

Rick's picture

Here is an article Going mobile with VoIP and SymVPN:

It seems that there is no problem to use PPTP VPN with VoIP on Nokia phone, but I have doubt that IPSec VPN can provide needed speed.
Have you tried to use IPSec VPN with VoIP software on your Nokia E61? Is it actually possible to have normal VoIP conversation over IPSec VPN?

New HOWTO using modern kernel based IPSEC

Anonymous's picture

I just posted a new HOWTO for connecting nokia VPN to linux using the new kernel based IPSec (requires kernel 2.6.20+).
This is a pure linux solution, not needing any windows software. The HOWTO covers everything including setting up the linux iptables firewall.
Uses RSA authentication, XAUTH is trivial to add:

HOWTO connect Nokia VPN to GNU/Linux

comments welcome

How can I pass the DNS setting to my phone?

gomobi's picture

Thanks for the great instruction. I have successfully connected my N82 to the VPN gateway. The problem is that the DNS setting is not correctly passed to the phone, I also got DNS error. Could you please give some suggestion?

Thanks again.


a bit thick's picture

my missus thinks I'm a genius with computers and phones but i would need to be Einstein to follow this stuff.
Reading it makes me realise how inadequate I really am.
Isnt there a version u can just click a link and hey presto it's downloaded onto your phone ;)

To complicated, I have installed SymVPN instead.

Anonymous's picture

To complicated.
That is why I am using SymVPN.
It is not IPSec, and it is not Openswan, as it is PPTP based VPN. However it is worth it - 5 parameters to enter and it works in 30 sec.
No headache with policy file.
No headache with signing.
Yes, it is probably less secure then Openswan and IPSec, but at least it is working, but Nokia Mobile VPN it is the dead end road for 98% of all Nokia phone users. Sounds promising in the theory, but nothing works in practice.

Too expensive

Anonymous's picture

SymVPN may be great but I don't see the point in paying all that money for something that I can already do for free.

If SymVPN were $10 or something that might be worth it but currently it's ridiculously expensive for the tiny functionality it provides. Plus, if we're talking easy-to-use-and-secure VPN, I would prefer the more secure OpenVPN over PPTP anyway.

SymVPN all the way and it is not expensive at all.

Anonymous's picture

I would say it is way too cheap for me. Look, with help of SymvPN I have saved just in 1 month on long distance phone charges more money than I have paid for this software. That is why I will buy it even if it will cost 5 time more. I need SymVPN to use it with VoIP. Withour VPN I cannot use VoIP on phone in my country. Just count your money and see for yourself.

Unfortunately on FP2 S60v3

morphix's picture

Unfortunately on FP2 S60v3 devices, SymVPN doesn't work properly, pretty much not at all due to the "Destinations" access point settings available in FP2 only devices, that counts my Nokia N96 out :(

SymVPN works just fine with Destinations.

Anonymous's picture

I am using SymVPN v.2.00 on my Nokia 5800 and it works fine with "Destinations". Created VPN Access Point is placed in Uncategorised destination and after that you just have to to move it to any destination where you need it.

Thanks for really good

Anonymous's picture

Thanks for really good article!
Now days everything can be made more simple way with appearance of SymVPN from
SymVPN is PPTP VPN client for Series 60 3rd phones.

Installation instruction in German WIKI / Update

FreshSmith's picture

== '''NOKIA VPN Client mit Open Source strongSWAN''' ==


# StrongSwan mit öffentlicher IP Adresse
# Symbian makesis.exe zum Serstellen von SIS Installationspaketen
# Konfigurationsfiles für SIS VPN Paket


StrongSwan ipsec.conf anpassen und NAT Traversat (NAT-T) aktivieren. Dies ist wichtig, da viele Mobilfunkprovider intern noch einmal natten. Die zugeteilte IP Adresse am Telefon entspricht nicht der IP Adresse, die bei einem Verbingsaufbau beim StrongSWAN ankommt.

config setup
include /etc/ipsec.d/ipsec-conn-e61-mrobichon.fas
include /etc/ipsec.d/ipsec-conn-e61-njaixen.fas

Danach müssen in der ipsec.secerts der PSK Key hinterlegt werden:

'': PSK "xxxxxxxxxxxxxxxxxxxx"''

Falls XATH benutzt werden soll, hier wird bei der Initialisierung der Verbindung Username und Passwort abgefragt, dann sollte hier auch noch der entsprechende Eintrag mit Credentials hionterlagt werden:

'': XAUTH User "password"''

Nun kommen wir zu den Verbindungen. Hier wird es interessant. Im oberen Beispiel werden zwei Verbindungen in der ipsec.conf includiert. Die Konfiguration könnte so aussehen:

conn e61-mrobichon
# Key exchange
# Data exchange
# Authentication method PSK
# Modeconfig setting
# LEFT: serverseite
#Internes Netz, falls alles geroutet werden soll dann
# leftmodecfgserver=yes
#Falls XAUTH verwendet werden soll, dann diesen Eintrag aktivieren
# leftxauthserver=yes
# RIGHT: clientseite
# Right ID ist absolut wichtig, wenn meherere Verbindungen von
# unterschidlichen Clients aufgebaut werden sollen = FQDN (binär)
# rightxauthclient=yes
# rightmodecfgclient=yes
# virtuelle IP Adresse des IPSEC Tunnels pro Client und Connection

Parameter, die editiert werden müssen:

* leftsubnet= -- internes Netz
* rightid=@#4d6f62696c6547726f7570 -- in der Nokia pol (später) representiert die ID die FQDN und wird hier binär ausgedrückt. Am besten man lässt das Feld offen und probiert erst mal aus, welche ID übermittelt wird. Die kann man sehen, wenn man eine Verbindung aufbaut und in die messages reinschaut:
"e61-njaixen"[6] #9: Peer ID is ID_KEY_ID: '0x4d6f62696c6547726f7570'
das 0x wird durch @# ersetzt
* rightsourceip= -- virtuelle IP Adresse, die dem Client zugeordnet wird dasselbe mit dem rightsubnet (virtuelle Client IP + Subnetz localhost = 32)



Die Konfiguration besteht aus drei Dateien: pin, pkg, pol. Die Dateien müssen denselben Dateinamen haben. pin und pkg brauchen nicht editiert zu werden.
Als Beipiel hier die Konfigurationen:
VPN-Policy for Nokia Mobile VPN Client v3.0.
Do not edit
Do not edit


; - None (English only by default)

; - Only one component name is needed to support English only
; - UID is the UID of the VPN Policy Installer application
#{"VPN-Policy"},(0x1000597E), 1, 0, 0, TYPE=SA
;Localised Vendor name

;Unique Vendor name

; Policy file
; Policy-information file
; - NOTE: The policy-information file MUST be the last file in this list!
; - FM (FILEMIME) passes the file to the respective MIME handler
; (in this case, the VPN Policy Installer application).
FM, "application/x-ipsec-policy-info"
; - The VPN Policy Installer application
(0x1000597E), 1, 0, 0, {"VPN Policy Installer"}
; - S60 3rd Edition ID
[0x101F7961], 0, 0, 0, {"S60ProductID"}

sa ipsec_1 = {
encrypt_alg 12
max_encrypt_bits 256
auth_alg 3
identity_remote #internes Netz
hard_lifetime_bytes 0
hard_lifetime_addtime 3600
hard_lifetime_usetime 3600
soft_lifetime_bytes 0
soft_lifetime_addtime 3600
soft_lifetime_usetime 3600
remote = { ipsec_1( } #internes Netz {StrongSWAN IP}
inbound = { }
outbound = { }
FQDN: MobileGrou2 #rightid (binär) in StrongSWAN Konfiguration
USE_XAUTH: FALSE #Falls XAUTH benutzt werden soll
KEY: 20 xxxxxxxxxxxxxxxxxxxx #Secret in ipsec.secrets


Erstellung der SIS Datei mit "makesis VPN-policy-preshared-Cisco.pkg" die SIS Datei wird erstellt. Danach einloggen auf [[]]
Hier auf den Link "Open Signed Online". Auf dieser Seite muss nun die IMEI des Mobiltelefons eingegeben werden, auf dem die Policy geladen werden soll *#06#. Mailadresse, an die der Link zur Apllikation gesendet wird und natürlich upload der SIS Datei, welche signiert werden soll. Man erhält eine Verifizierungsmail und kurz danach den Link zum Download der signierten Applikation.

Die Aplikation installiert man dann via PC Suite oder ähnliches direkt auf dem Mobiltelefon. Sollten IMEI nicht zusammen passen, dann muss das ganze nochmal erstellt werden. Nun geht man nach

System --> Einstellungen --> Verbindung --> VPN --> VPN Zugangspunkt

Verbindungsname frei wählbar
VPN-Richtline die gerade geladene Richtlinie (VPN-policy)
Internetzugangspunkt Providereinwahl

alle anderen Punkte so lassen.


Folgende Webseiten waren sehr hilfreich:


One Click, Universal Protection: Implementing Centralized Security Policies on Linux Systems

As Linux continues to play an ever increasing role in corporate data centers and institutions, ensuring the integrity and protection of these systems must be a priority. With 60% of the world's websites and an increasing share of organization's mission-critical workloads running on Linux, failing to stop malware and other advanced threats on Linux can increasingly impact an organization's reputation and bottom line.

Learn More

Sponsored by Bit9

Linux Backup and Recovery Webinar

Most companies incorporate backup procedures for critical data, which can be restored quickly if a loss occurs. However, fewer companies are prepared for catastrophic system failures, in which they lose all data, the entire operating system, applications, settings, patches and more, reducing their system(s) to “bare metal.” After all, before data can be restored to a system, there must be a system to restore it to.

In this one hour webinar, learn how to enhance your existing backup strategies for better disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible bare-metal recovery solution for UNIX and Linux systems.

Learn More

Sponsored by Storix