{"id":27,"date":"2015-08-16T21:55:08","date_gmt":"2015-08-16T13:55:08","guid":{"rendered":"http:\/\/tbex.idv.tw\/wordpress_G2\/?p=27"},"modified":"2015-08-16T21:55:08","modified_gmt":"2015-08-16T13:55:08","slug":"note-site-to-site-vpn","status":"publish","type":"post","link":"https:\/\/tbex.idv.tw\/wordpress_G2\/blog\/2015\/08\/16\/note-site-to-site-vpn\/","title":{"rendered":"[note] site to site VPN"},"content":{"rendered":"
\n

How to create a site-to-site IPsec VPN tunnel using Openswan in Linux<\/a><\/h1>\n<\/header>\n
Last updated on Sarmed Rahman<\/a><\/span><\/span><\/span> 4 Comments<\/a><\/span><\/div>\n
\n

A virtual private network (VPN) tunnel is used to securely interconnect two physically separate networks through a tunnel over the Internet. Tunneling is needed when the separate networks are private LAN subnets with globally non-routable private IP addresses, which are not reachable to each other via traditional routing over the Internet. For example, VPN tunnels are often deployed to connect different NATed branch office networks belonging to the same institution.<\/p>\n

Sometimes VPN tunneling may be used simply for its security benefit as well. Service providers or private companies may design their networks in such a way that vital servers (e.g., database, VoIP, banking servers) are placed in a subnet that is accessible to trusted personnel through a VPN tunnel only. When a secure VPN tunnel is required, IPsec<\/a> is often a preferred choice because an IPsec VPN tunnel is secured with multiple layers of security.<\/p>\n

This tutorial will show how we can easily create a site-to-site VPN tunnel using Openswan<\/a> in Linux.<\/p>\n

Topology<\/h2>\n

This tutorial will focus on the following topologies for creating an IPsec tunnel.<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

Installing Packages and Preparing VPN Servers<\/h2>\n

Usually, you will be managing site-A only, but based on the requirements, you could be managing both site-A and site-B. We start the process by installing Openswan.<\/p>\n

On Red Hat based Systems (CentOS, Fedora or RHEL):<\/p>\n

# yum install openswan lsof<\/div>\n

On Debian based Systems (Debian, Ubuntu or Linux Mint):<\/p>\n

# apt-get install openswan<\/div>\n

Now we disable VPN redirects, if any, in the server using these commands:<\/p>\n

# for vpn in \/proc\/sys\/net\/ipv4\/conf\/*;
\n# do echo 0 > $vpn\/accept_redirects;
\n# echo 0 > $vpn\/send_redirects;
\n# done<\/div>\n

Next, we modify the kernel parameters to allow IP forwarding and disable redirects permanently.<\/p>\n

# vim \/etc\/sysctl.conf<\/div>\n
\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n<\/td>\n
\n
\n
net.ipv4.ip_forward = 1<\/code><\/div>\n
net.ipv4.conf.all.accept_redirects = 0<\/code><\/div>\n
net.ipv4.conf.all.send_redirects = 0<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

Reload \/etc\/sysctl.conf:<\/p>\n

<\/div>\n
# sysctl -p<\/div>\n

We allow necessary ports in the firewall. Please make sure that the rules are not conflicting with existing firewall rules.<\/p>\n

# iptables -A INPUT -p udp –dport 500 -j ACCEPT
\n# iptables -A INPUT -p tcp –dport 4500 -j ACCEPT
\n# iptables -A INPUT -p udp –dport 4500 -j ACCEPT<\/div>\n

Finally, we create firewall rules for NAT.<\/p>\n

# iptables -t nat -A POSTROUTING -s site-A-private-subnet -d site-B-private-subnet -j SNAT –to site-A-Public-IP<\/div>\n

Please make sure that the firewall rules are persistent.<\/p>\n

Note:<\/b><\/p>\n

    \n
  • You could use MASQUERADE instead of SNAT. Logically it should work, but it caused me to have issues with virtual private servers (VPS) in the past. So I would use SNAT if I were you.<\/li>\n
  • If you are managing site-B as well, create similar rules in site-B server.<\/li>\n
  • Direct routing does not need SNAT.<\/li>\n<\/ul>\n

    Preparing Configuration Files<\/h2>\n

    The first configuration file that we will work with is ipsec.conf<\/tt>. Regardless of which server you are configuring, always consider your site as ‘left<\/strong>‘ and remote site as ‘right<\/strong>‘. The following configuration is done in siteA’s VPN server.<\/p>\n

    # vim \/etc\/ipsec.conf<\/div>\n
    \n
    \n\n\n\n
    \n
    1<\/div>\n
    2<\/div>\n
    3<\/div>\n
    4<\/div>\n
    5<\/div>\n
    6<\/div>\n
    7<\/div>\n
    8<\/div>\n
    9<\/div>\n
    10<\/div>\n
    11<\/div>\n
    12<\/div>\n
    13<\/div>\n
    14<\/div>\n
    15<\/div>\n
    16<\/div>\n
    17<\/div>\n
    18<\/div>\n
    19<\/div>\n
    20<\/div>\n
    21<\/div>\n
    22<\/div>\n
    23<\/div>\n
    24<\/div>\n
    25<\/div>\n
    26<\/div>\n
    27<\/div>\n
    28<\/div>\n
    29<\/div>\n
    30<\/div>\n
    31<\/div>\n
    32<\/div>\n
    33<\/div>\n
    34<\/div>\n
    35<\/div>\n
    36<\/div>\n
    37<\/div>\n
    38<\/div>\n
    39<\/div>\n
    40<\/div>\n
    41<\/div>\n
    42<\/div>\n
    43<\/div>\n
    44<\/div>\n
    45<\/div>\n
    46<\/div>\n
    47<\/div>\n
    48<\/div>\n
    49<\/div>\n
    50<\/div>\n
    51<\/div>\n
    52<\/div>\n
    53<\/div>\n
    54<\/div>\n
    55<\/div>\n<\/td>\n
    		\n
    \n
    ## general configuration parameters ##<\/code><\/div>\n
    <\/div>\n
    config setup<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>plutodebug=all<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>plutostderrlog=<\/code>\/var\/log\/pluto<\/code>.log<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>protostack=netkey<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>nat_traversal=<\/code>yes<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>virtual_private=%v4:10.0.0.0<\/code>\/8<\/code>,%v4:192.168.0.0<\/code>\/16<\/code>,%v4:172.16.0.0<\/code>\/16<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>## disable opportunistic encryption in Red Hat ##<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>oe=off<\/code><\/div>\n
    <\/div>\n
    ## disable opportunistic encryption in Debian ##<\/code><\/div>\n
    ## Note: this is a separate declaration statement ##<\/code><\/div>\n
    include <\/code>\/etc\/ipsec<\/code>.d<\/code>\/examples\/no_oe<\/code>.conf <\/code><\/div>\n
    <\/div>\n
    ## connection definition in Red Hat ##<\/code><\/div>\n
    conn demo-connection-redhat<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>authby=secret<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>auto=start<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>ike=3des-md5<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>## phase 1 ##<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>keyexchange=ike<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>## phase 2 ##<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>phase2=esp<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>phase2alg=3des-md5<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>compress=no<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>pfs=<\/code>yes<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>type<\/code>=tunnel<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>left=<siteA-public-IP><\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>leftsourceip=<siteA-public-IP><\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>leftsubnet=<siteA-private-subnet><\/code>\/netmask<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>## for direct routing ##<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>leftsubnet=<siteA-public-IP><\/code>\/32<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>leftnexthop=%defaultroute<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>right=<siteB-public-IP><\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>rightsubnet=<siteB-private-subnet><\/code>\/netmask<\/code><\/div>\n
    <\/div>\n
    ## connection definition in Debian ##<\/code><\/div>\n
    conn demo-connection-debian<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>authby=secret<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>auto=start<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>## phase 1 ##<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>keyexchange=ike<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>## phase 2 ##<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>esp=3des-md5<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>pfs=<\/code>yes<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>type<\/code>=tunnel<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>left=<siteA-public-IP><\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>leftsourceip=<siteA-public-IP><\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>leftsubnet=<siteA-private-subnet><\/code>\/netmask<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>## for direct routing ##<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>leftsubnet=<siteA-public-IP><\/code>\/32<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>leftnexthop=%defaultroute<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>right=<siteB-public-IP><\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>rightsubnet=<siteB-private-subnet><\/code>\/netmask<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

    Authentication can be done in several different ways. This tutorial will cover the use of pre-shared key, which is added to the file \/etc\/ipsec.secrets<\/tt>.<\/p>\n

    # vim \/etc\/ipsec.secrets<\/div>\n
    \n
    \n\n\n\n
    \n
    1<\/div>\n
    2<\/div>\n
    3<\/div>\n<\/td>\n
    		\n
    \n
    siteA-public-IP\u00a0 siteB-public-IP:\u00a0 PSK\u00a0 <\/code>\"pre-shared-key\"<\/code><\/div>\n
    ## in case of multiple sites ##<\/code><\/div>\n
    siteA-public-IP\u00a0 siteC-public-IP:\u00a0 PSK\u00a0 <\/code>\"corresponding-pre-shared-key\"<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

    Starting the Service and Troubleshooting<\/h2>\n

    The server should now be ready to create a site-to-site VPN tunnel. If you are managing siteB as well, please make sure that you have configured the siteB server with necessary parameters. For Red Hat based systems, please make sure that you add the service into startup using chkconfig<\/tt> command.<\/p>\n

    # \/etc\/init.d\/ipsec restart<\/div>\n

    If there are no errors in both end servers, the tunnel should be up now. Taking the following into consideration, you can test the tunnel with ping<\/tt> command.<\/p>\n

      \n
    1. The siteB-private subnet should not be reachable from site A, i.e., ping<\/tt> should not work if the tunnel is not up.<\/li>\n
    2. After the tunnel is up, try ping<\/tt> to siteB-private-subnet from siteA. This should work.<\/li>\n<\/ol>\n

      Also, the routes to the destination’s private subnet should appear in the server’s routing table.<\/p>\n

      # ip route<\/div>\n
      [siteB-private-subnet] via [siteA-gateway] dev eth0 src [siteA-public-IP]\r\ndefault via [siteA-gateway] dev eth0\r\n<\/pre>\n
      Additionally, we can check the status of the tunnel using the following useful commands.<\/p>\n
      # service ipsec status<\/div>\n
      IPsec running  - pluto pid: 20754\r\npluto pid 20754\r\n1 tunnels up<\/b>\r\nsome eroutes exist\r\n<\/pre>\n
      # ipsec auto –status<\/div>\n
      ## output truncated ##\r\n000 \"demo-connection-debian\":     myip=<siteA-public-IP>; hisip=unset;\r\n000 \"demo-connection-debian\":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; nat_keepalive: yes\r\n000 \"demo-connection-debian\":   policy: PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 32,28; interface: eth0;\r\n\r\n## output truncated ##\r\n000 #184: \"demo-connection-debian\":500 STATE_QUICK_R2 (IPsec SA established);<\/b> EVENT_SA_REPLACE in 1653s; newest IPSEC; eroute owner; isakmp#183; idle; import:not set\r\n\r\n## output truncated ##\r\n000 #183: \"demo-connection-debian\":500 STATE_MAIN_I4 (ISAKMP SA established);<\/b> EVENT_SA_REPLACE in 1093s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:not set\r\n<\/pre>\n
      The log file \/var\/log\/pluto.log<\/tt> should also contain useful information regarding authentication, key exchanges and information on different phases of the tunnel. If your tunnel doesn’t come up, you could check there as well.<\/p>\n
      If you are sure that all the configuration is correct, and if your tunnel is still not coming up, you should check the following things.<\/p>\n
        \n
      1. Many ISPs filter IPsec ports. Make sure that UDP 500, TCP\/UDP 4500 ports are allowed by your ISP. You could try connecting to your server IPsec ports from a remote location by telnet<\/tt>.<\/li>\n
      2. Make sure that necessary ports are allowed in the firewall of the server\/s.<\/li>\n
      3. Make sure that the pre-shared keys are identical in both end servers.<\/li>\n
      4. The left and right parameters should be properly configured on both end servers.<\/li>\n
      5. If you are facing problems with NAT, try using SNAT instead of MASQUERADING.<\/li>\n<\/ol>\n
        To sum up, this tutorial focused on the procedure of creating a site-to-site IPSec VPN tunnel in Linux using Openswan. VPN tunnels are very useful in enhancing security as they allow admins to make critical resources available only through the tunnels. Also VPN tunnels ensure that the data in transit is secured from eavesdropping or interception.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
        How to create a site-to-site IPsec VPN tunnel using Ope … <\/p>\n
        \u95b1\u8b80\u5168\u6587\u3008[note] site to site VPN\u3009<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[13],"tags":[],"class_list":["post-27","post","type-post","status-publish","format-standard","hentry","category-geek"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p6xFwC-r","_links":{"self":[{"href":"https:\/\/tbex.idv.tw\/wordpress_G2\/wp-json\/wp\/v2\/posts\/27","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tbex.idv.tw\/wordpress_G2\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tbex.idv.tw\/wordpress_G2\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tbex.idv.tw\/wordpress_G2\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tbex.idv.tw\/wordpress_G2\/wp-json\/wp\/v2\/comments?post=27"}],"version-history":[{"count":1,"href":"https:\/\/tbex.idv.tw\/wordpress_G2\/wp-json\/wp\/v2\/posts\/27\/revisions"}],"predecessor-version":[{"id":28,"href":"https:\/\/tbex.idv.tw\/wordpress_G2\/wp-json\/wp\/v2\/posts\/27\/revisions\/28"}],"wp:attachment":[{"href":"https:\/\/tbex.idv.tw\/wordpress_G2\/wp-json\/wp\/v2\/media?parent=27"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tbex.idv.tw\/wordpress_G2\/wp-json\/wp\/v2\/categories?post=27"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tbex.idv.tw\/wordpress_G2\/wp-json\/wp\/v2\/tags?post=27"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}