IPSEC NETWORK TO NETWORK VPN ON SME 7.0rc1
Author(s): Lloyd Keen, David Biczo
Summary: The purpose of this howto is to guide you through the procedure to
connect two private subnets, both behind servers running SME Server7.0rc1 in
server/gateway mode via an encrypted tunnel using IPsec (sometimes referred to as
NETKEY or Kernel IPsec). Both servers have static IP’s on the external interface
using PPPoE or bridged Ethernet. NETKEY under linux 2.6 works a bit different to
Ipsec under linux 2.4, the most obvious difference being that there is no visible ipsecx
device as such. This document serves as a guide only, it worked for us but YMMV.
As usual “all care but no responsibility taken”. Comments and suggestions are welcome.
SECTION AProcedure:
Install ipsec-tools on both machines.
#yum –enablerepo=base –enablerepo=addons install ipsec-tools
Edit /etc/sysconfig/network-scripts/ifcfg-ipsec0 (
smeserverA) and enter the
following:
TYPE=IPSEC
ONBOOT=no
IKE_METHOD=PSK
SRCNET=192.168.xx.0/24 (
smeserverA's LAN address)
DSTNET=192.168.yy.0/24 (
smeserverB's LAN address)
DST=xxx.xxx.xxx.xxx (replace xxx’s with
smeserverB’s external static IP)
Add the preshared key into /etc/sysconfig/network-scripts/keys-ipsec0
#mcedit /etc/sysconfig/network-scripts/keys-ipsec0
and add the following line:
IKE_PSK=my_shared_secret
Repeat the above procedure on
smeserverB#yum –enablerepo=base –enablerepo=addons install ipsec-tools
Edit /etc/sysconfig/network-scripts/ifcfg-ipsec0 (
smeserverB) and enter the
Following:
TYPE=IPSEC
ONBOOT=no
IKE_METHOD=PSK
SRCNET=192.168.yy.0/24 (
smeserverB’s LAN address)
DSTNET=192.168.xx.0/24 (
smeserverA’s LAN address)
DST=xxx.xxx.xxx.xxx (replace xxx’s with
smeserverA’s external static IP)
Add the preshared key into /etc/sysconfig/network-scripts/keys-ipsec0
#mcedit /etc/sysconfig/network-scripts/keys-ipsec0
and add the following line:
IKE_PSK=my_shared_secret
NOTE: If you have a PPPoE connection you don't want the interface
to come up at boot time (ONBOOT=no). You need IPsec to come up AFTER the
ppp interface. You can address this issue by adding /sbin/ifup-ipsec to the
bottom of /etc/ppp/ip-up.local and /sbin/ifdown-ipsec into the
/etc/ppp/ip-down.local scripts as described later in this document. If you have
a bridged Ethernet connection then you can set this option to ONBOOT=yes.
Now open up the server-manager on both servers and add the appropriate network
settings into the "Local Networks" panel. For example on
smeserverA you would
enter the following values:
Network Address: 192.168.yy.1
Subnet Mask: 255.255.255.0
Router 192.168.xx.1
SECTION B: This section contains information on modifying the firewall and installing modified
scripts to fix routing issues.
#mkdir -p /etc/e-smith/templates-custom/etc/rc.d/init.d/masq/
#cd /etc/e-smith/templates-custom/etc/rc.d/init.d/masq/
#mcedit 15AllowIPsec
and add the following:
/sbin/iptables -A INPUT -i $OUTERIF -p udp --sport 500 --dport 500 -j ACCEPT
/sbin/iptables -t mangle -A PREROUTING -i $OUTERIF -p 50 -j MARK --set-mark 1
/sbin/iptables -A INPUT -i $OUTERIF -m mark --mark 1 -j ACCEPT
/sbin/iptables -A FORWARD -i $OUTERIF -m mark --mark 1 -j ACCEPT
/sbin/iptables -t mangle -A PREROUTING -i $OUTERIF -p 51 -j MARK --set-mark 2
/sbin/iptables -A INPUT -i $OUTERIF -m mark --mark 2 -j ACCEPT
/sbin/iptables -A FORWARD -i $OUTERIF -m mark --mark 2 -j ACCEPT
Make sure to leave a blank line at the top of the file and carriage return at the end of the file.
Then do:
#/sbin/e-smith/expand-template /etc/rc.d/init.d/masq
#/etc/init.d/masq restart
There appears to be a bug in the way ifup-ipsec and ifdown-ipsec sets up the
routing so you will need to install modified versions of these scripts from here
www.comnetel.com/sme7_ipsec For more information about this bug see
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=146169. There is some minor
code duplication in the scripts, but it works. If you have any comments or suggestions
we’d be glad to hear them. Any changes made in the scripts have been documented
where applicable.
#cd /etc/sysconfig/network-scripts
#mv ifup-ipsec ifup-ipsec.old
#mv ifdown-ipsec ifdown-ipsec.old
#wget
http://www.comnetel.com/sme7_ipsec/ifup-ipsec # wget
http://www.comnetel.com/sme7_ipsec/ifdown-ipsecIf you have a bridged ethernet connection you can skip the next section and either
reboot or bring up the tunnel with the following command:
#ifup ipsec0
SECTION C:Only complete this section if you have a PPPoE connection on the external interface.
And finally as mentioned previously in this document, we need to add a command
to bring up the tunnel automatically at boot time.
#mcedit /etc/ppp/ip-up.local
and add the following line to the bottom of the file:
/sbin/ifup-ipsec
#mcedit /etc/ppp/ip-down.local
and add the following into this file:
/sbin/ifdown-ipsec
Reboot or bring up the tunnel with the following command:
#ifup ipsec0
You should be able to ping between subnets now, and if you connect a workstation
from
smeserverA to a workstation on
smeserverB (using remote desktop) you should
be able to sniff the external interface on
smeserverB (using tcpdump –I eth1
Note: replace eth1 with your external interface) and notice that the traffic
between the two is encrypted (look for AH and ESP packets). Be aware that traffic
is only encrypted between the two gateways (across the internet). Traffic is NOT
encrypted from the gateway to the workstation.
13 Replies
7702 Views