File	Date	Author	Commit
contrib	2010-10-04	Robin Hammond	[8fb33b] contrib: init script for Ubuntu
doc	2007-11-12	Timo Teras	[1288cb] Add some related RFCs
etc	2011-08-11	Timo Teräs	[8f1310] peer: add peer-down reason
man	2015-05-05	Timo Teräs	[3e2576] cisco calls it no-unique, so rename to that
nhrp	2020-11-17	Timo Teräs	[613277] fix incomplete conversion to system libev
patches	2008-03-06	Timo Teras	[995f6b] Remove patch against ipsec-tools cvs, as they a...
.gitignore	2009-04-21	Timo Teras	[17be4f] build: make 'make dist' usable again
AUTHORS	2012-11-19	Timo Teräs	[6bcf42] update todo
MIT-LICENSE.txt	2012-11-28	Timo Teräs	[9aa852] Change license to MIT License, and update the c...
Make.rules	2009-08-25	Timo Teras	[b300da] build: remove -Werror
Makefile	2013-01-30	Timo Teräs	[6d4330] opennhrp-0.14.1
NEWS	2013-01-30	Timo Teräs	[6d4330] opennhrp-0.14.1
README	2014-04-25	Timo Teräs	[836fad] add readme about kernel versions and bugs
README.kernel	2015-02-12	Timo Teräs	[cf267b] update kernel notes
TODO	2012-12-03	Timo Teräs	[5d6dce] pfpacket: dynamically allocate filter code

Read Me

OpenNHRP Release Notes
======================

OpenNHRP is an NHRP implementation for Linux. It has most of the RFC2332
and Cisco IOS extensions.

Project homepage: http://sourceforge.net/projects/opennhrp

Git repository: git://opennhrp.git.sourceforge.net/gitroot/opennhrp

	LICENSE

OpenNHRP is licensed under the MIT License. See MIT-LICENSE.txt for
additional details.

OpenNHRP links to:
  libev, which is dual licensed with 2-clause BSD and GPLv2+ licenses
  c-ares, which is licensed under the MIT License


	SYSTEM REQUIREMENTS

To compile OpenNHRP you need:
- GNU make (3.81 or later works)
- GCC
- pkg-config
- libev library (Ubuntu package: libev-dev)
- c-ares library (Ubuntu package: libc-ares-dev)

See also README.kernel for notes on specific kernel versions, and
required configuration options.

	COMPILING

Just type 'make' and 'make install'.

	CONFIGURATION

OpenNHRP currently supports only IPv4 over IPv4 using NBMA GRE tunnels.
To create NBMA GRE tunnel you might use following:

	ip tunnel add gre1 mode gre key 1234 ttl 64
	ip addr add 10.255.255.2/24 dev gre1
	ip link set gre1 up
	
This should work with the configuration example in opennhrp.conf(5).

	IPSEC ENCRYPTION OF GRE PACKETS

ipsec-tools 0.8.0 or later is recommended. Earlier versions need patching
for dmvpn to work properly.

The ipsec-tools configuration I prefer to use is: encrypt all GRE
traffic in transport mode. IPsec policy for that should be defined in
/etc/ipsec.conf:
	spdflush;
	spdadd 0.0.0.0/0 0.0.0.0/0 gre -P out ipsec esp/transport//require;
	spdadd 0.0.0.0/0 0.0.0.0/0 gre -P in  ipsec esp/transport//require;

And ipsec-tools configuration with pre-shared key could look something
like this:

/etc/racoon/racoon.conf:
	path pre_shared_key "/etc/racoon/psk.txt";
	remote anonymous {
		exchange_mode aggressive;
		lifetime time 24 hour;
		my_identifier user_fqdn "my-user-name@my-domain.example";
		nat_traversal on;
		# For ipsec-tools snapshot 2010-10-10 or later
		script "/etc/opennhrp/racoon-ph1dead.sh" phase1_dead;
		# For earlier ipsec-tools
		# script "/etc/opennhrp/racoon-ph1down.sh" phase1_down;
		proposal {
			encryption_algorithm 3des;
			hash_algorithm sha1;
			authentication_method pre_shared_key;
			dh_group 2;
		}        
	}
	sainfo anonymous {
		pfs_group 2;
		lifetime time 12 hour;
		encryption_algorithm 3des, blowfish 448, rijndael;
		authentication_algorithm hmac_sha1, hmac_md5;
		compression_algorithm deflate;
	}

And /etc/racoon/psk.txt:
	my-user-name@my-domain.example	"my-secret-pre-shared-key"

It is of course more secure to use certificates for authentication.
And using aggressive main mode is not recommended either, but it is
required to make FQDN pre-shared authentication work. This setup is
fast to do and can get you started with testing OpenNHRP.

	DOCUMENTATION

Most of the OpenNHRP documentation is in the manpages. Read them.

Also some general NHRP documents can be found from Cisco website
(www.cisco.com).

	BUGS

Use the SourceForge bug tracker or mailing list.