Anyone still using this? I am 
I just tried to get Racoon running again after support for UCI configuration was added to trunk (https://github.com/openwrt/packages/com … 6dbb5982b5)
I managed to get it working, but I needed to hack the startup file a lot. This is what I did:
Add the following configuration to /etc/config/racoon:
#/etc/config/racoon
#
# Copyright 2015 Vitaly Protsko <villy@sft.ru>
# * WARNING: this is "not working" example
# * Defaults are commented out
# * Resuting config will appear in /var/racoon/
config racoon
option debug 0
option ext_zone 'wan'
option int_zone 'lan'
option port 500
option natt_port 4500
option ipversion 4
# WARNING: Only ONE tunnel with remote anonymous
# can be configured and it can have only
# ONE sainfo. Otherwise resulting racoon
# configuration will be unusable
config tunnel 'Incoming'
option enabled '1'
option remote 'anonymous'
option pre_shared_key 'my_own_psk'
#psk is put in /var/racoon/psk.txt automatically
option exchange_mode 'main'
option prop_check 'obey'
list p1_proposal 'anon_p1prop'
list sainfo 'anon_sainf'
config p1_proposal 'anon_p1prop'
option enc_alg '3des'
option hash_alg 'sha1'
option auth_method 'pre_shared_key'
option dh_group '2'
config p2_proposal 'anon_p2prop'
option enc_alg 'aes'
option auth_alg 'hmac_sha1'
# option comp_alg 'deflate' #is default
config sainfo 'anon_sainf'
option p2_proposal 'anon_p2prop'
Next, I changed the following to /etc/init.d/racoon:
setup_sa():
Line 132, I believe this is a logic error:
- if [ -z "$client" ]; then
+ if [ ! -z "$client" ]; then
Then, comment out lines 168 to 190 (I don't want any of these in racoon.conf, and they give errors on startup
# if [ "$remote" = "anonymous" ]; then
# echo -e "mode_cfg {\n auth_source system;\n conf_source local;" >> $conf
#
# config_get data "$1" dns4
# test -n "$data" && echo " dns4 $data;" >> $conf
# config_get data "$1" defdomain
# test -n "$data" && echo " default_domain \"$data\";" >> $conf
#
# data=${remnet%/*}
# let "data=${data##*.}+1"
# echo " network4 ${remnet%.*}.$data;" >> $conf
#
# let "data=255<<(24-${remnet#*/}+8)&255"
# echo " netmask4 255.255.255.$data;" >> $conf
#
# echo -e " split_network include $locnet;\n}" >> $conf
#
# elif [ -z "$client" ]; then
# manage_sa add $locnet $remnet $remote
# test $? -gt 0 -o $errno -gt 0 && return $errno
#
# manage_fw add $confIntZone $confExtZone $remnet
# fi
setup_tunnel() is next:
I don't want peers_identifier in racoon.conf, so comment out line 246, and change line 250 to no_op:
# echo -n " peers_identifier " >> $conf
fi
if [ "$remote" = "anonymous" ]; then
echo
else
Finally, add the old behavior of 'setkey.conf' back to start_service(). I added it after line 425:
config_foreach wait4wanzone racoon
if [ $? -gt 0 ] || [ $errno -gt 0 ]; then
$log "No active interfaces in $confExtZone zone found, exiting"
exit $errno
fi
# added to get setkey.conf working
. /lib/functions/network.sh
network_get_ipaddr wan_ip wan
[ -x /etc/setkey.conf ] && /etc/setkey.conf $wan_ip
Of course, add /etc/setkey.conf as described in the first post in this topic.
After that, racoon starts up with a config that looks somewhat like the first post in this topic
I haven't checked the firewall rules though (they are added by the racoon startup script as well now), and there are some errors when shutting down racoon.
So, that's a lot of hacking, and I believe there are lots of bugs and improvements needed in the new racoon startup script. Still deciding on what to put in the bug report. But my VPN is working again!
