This HowTo will cover the basic and advanced steps setting up a VPN using IPsec based on the Linux Kernels 2.6. Since there is a vast amount of documentation available for the Linux Kernel 2.4, this HowTo will concentrate on the new IPsec Features in the 2.6 kernel.

Table of Contents
Openswan running on Linux 2.6
Linux Kernel 2.6 using KAME-tools
Linux Kernel 2.6 using OpenBSD's isakmpd
Generating X.509 Certificates
Advanced Configuration


The latest version of this document can always be found at The Linux Documentation Project and at the official homepage http://www.ipsec-howto.org.

Reasons to write this HowTo

I have used numeruos HowTos in the past. Most were very valuable to me. When the new IPsec features in the Linux Kernel were implemented I started to play around using them. Soon I found out that only very little documentation exists. That started me writing this HowTo.

Format of this document

This document is broken down into 7 chapters.

Section 1: Introduction

This section

Section 2: Theory

IPsec theory. Essentially the IPsec protocols.

Section 3: Openswan

This section will describe how to setup Openswan on the Kernel 2.6.

Section 4: Racoon running on Linux Kernel 2.6

This section describes how to setup an IPsec VPN using the KAME tools setkey and racoon. This now includes NAT-Traversal.

Section 5: Isakmpd running on Linux Kernel 2.6

This section describes how to setup an IPsec VPN using OpenBSD isakmpd IKE daemon.

Section 6: Generating X.509 Certificates

This section describes how to generate X.509 Certificates using the openssl-Command.

Section 7: Advanced Configuration

This section gives some hints on XAUTH and on useful iptables-rules.

Contributors to this document

  • Matija Nalis

  • Fridtjof Busse

  • Uwe Beck

  • Juanjo Ciarlante

  • Ervin Hegedus

  • Barabara Kane

  • Alois Schmid

Legal Information


Copyright (c) 2003 Ralf Spenneberg

Please freely copy and distribute (sell or give away) this document in any format. It's requested that corrections and/or comments be fowarded to the document maintainer. You may create a derivative work and distribute it provided that you:

  • Send your derivative work (in the most suitable format such as sgml) to the LDP (Linux Documentation Project) or the like for posting on the Internet. If not the LDP, then let the LDP know where it is available.

  • License the derivative work with this same license or use GPL. Include a copyright notice and at least a pointer to the license used.

  • Give due credit to previous authors and major contributors.

If you're considering making a derived work other than a translation, it's requested that you discuss your plans with the current maintainer.


The author assumes no responsibility for anything done with this document, nor does he make any warranty, implied or explicit. If your dog dies, the author may not be made responsible!