I've already covered how to set up a VPN tunnel using IPsec on FreeBSD - here's the link. So I won't repeat everything again. This particular topic covers a somewhat more complex situation than the one described there. Here we'll look at what to do if you need to connect not 2 subnets, but several at once. As well as what to do if FreeBSD is the central router that routes subnets of a higher class than on the other side, while the subnets on the other side fall within that class.
Situation 1. The FreeBSD being configured is the central router.Conditions:
- Networks on the side of the FreeBSD being configured: 10.0.0.0/16 (i.e. the entire 10.0.B class)
- Remote subnet (via IPsec): 10.0.15.0/24
- External IP of the local central gateway: 88.77.66.55
- External IP of the remote branch: 55.44.33.22
In this scenario: the router being configured is the central router, into which streams converge via other VPNs, over fiber, copper links, etc. So it routes a bunch of subnets (for example, let's say these are subnets 10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24, etc.) And among other things it needs an IPsec VPN channel to subnet 10.0.15.0/24.
So, as you can see - we have a tiiiny nuance: subnet 10.0.15.0/24 falls within subnet 10.0.0.0/16.
Here are the racoon.conf and ipsec.conf configs corresponding to this situation (just in case, let me clarify - these are working configs with the IP addresses changed, i.e. everything works with them as-is).
racoon.conf:
path include "/usr/local/etc/racoon";
path pre_shared_key "/usr/local/etc/racoon/psk.txt";
padding
{
maximum_length 20; # maximum padding length.
randomize off; # enable randomize length.
strict_check off; # enable strict check.
exclusive_tail off; # extract last one octet.
}
listen
{
isakmp 88.77.66.55 [500];
}
# Specify various default timers.
timer
{
counter 5; # maximum trying count to send.
interval 20 sec; # maximum interval to resend.
persend 1; # the number of packets per send.
phase1 30 sec;
phase2 15 sec;
}
#############
# NET 1
#############
remote 55.44.33.22
{
exchange_mode main,base;
lifetime time 28800 sec;
generate_policy on;
proposal_check strict;
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 2;
}
}
sainfo subnet 10.0.0.0/16 any address 10.0.15.0/24 any
{
lifetime time 28800 sec;
encryption_algorithm aes128, 3des, cast128, blowfish 448, des, rijndael;
authentication_algorithm hmac_md5, hmac_sha1;
compression_algorithm deflate;
}
ipsec.conf:
flush;
spdflush;
spdadd 10.0.0.0/16 10.0.15.0/24 any -P out ipsec esp/tunnel/88.77.66.55-55.44.33.22/unique;
spdadd 10.0.15.0/24 10.0.0.0/16 any -P in ipsec esp/tunnel/55.44.33.22-88.77.66.55/unique;
Situation 2. The FreeBSD being configured is the central router, but the branch side has several subnets.Conditions:
- Networks on the side of the FreeBSD being configured: 10.0.0.0/16 (i.e. the entire 10.0.B class)
- Remote subnets (via IPsec): 10.0.15.0/24, 10.0.16.0/24
- External IP of the local central gateway: 88.77.66.55
- External IP of the remote branch: 55.44.33.22
The configs are very similar.
racoon.conf:
path include "/usr/local/etc/racoon";
path pre_shared_key "/usr/local/etc/racoon/psk.txt";
padding
{
maximum_length 20; # maximum padding length.
randomize off; # enable randomize length.
strict_check off; # enable strict check.
exclusive_tail off; # extract last one octet.
}
listen
{
isakmp 88.77.66.55 [500];
}
# Specify various default timers.
timer
{
counter 5; # maximum trying count to send.
interval 20 sec; # maximum interval to resend.
persend 1; # the number of packets per send.
phase1 30 sec;
phase2 15 sec;
}
#############
# BRANCH 1; NETS 15, 16
#############
remote 55.44.33.22
{
exchange_mode main,base;
lifetime time 28800 sec;
generate_policy on;
proposal_check strict;
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 2;
}
}
sainfo subnet 10.0.0.0/16 any address 10.0.15.0/24 any
{
lifetime time 28800 sec;
encryption_algorithm aes128, 3des, cast128, blowfish 448, des, rijndael;
authentication_algorithm hmac_md5, hmac_sha1;
compression_algorithm deflate;
}
sainfo subnet 10.0.0.0/16 any address 10.0.16.0/24 any
{
lifetime time 28800 sec;
encryption_algorithm aes128, 3des, cast128, blowfish 448, des, rijndael;
authentication_algorithm hmac_md5, hmac_sha1;
compression_algorithm deflate;
}
ipsec.conf:
flush;
spdflush;
spdadd 10.0.0.0/16 10.0.15.0/24 any -P out ipsec esp/tunnel/88.77.66.55-55.44.33.22/unique;
spdadd 10.0.15.0/24 10.0.0.0/16 any -P in ipsec esp/tunnel/55.44.33.22-88.77.66.55/unique;
spdadd 10.0.0.0/16 10.0.16.0/24 any -P out ipsec esp/tunnel/88.77.66.55-55.44.33.22/unique;
spdadd 10.0.16.0/24 10.0.0.0/16 any -P in ipsec esp/tunnel/55.44.33.22-88.77.66.55/unique;
Situation 3. The FreeBSD router being configured is a branch gateway.Conditions:
- Networks on the side of the FreeBSD being configured: 10.0.15.0/24, 10.0.16.0/24
- Remote subnets (via IPsec): 10.0.0.0/16 (everything via the central gateway)
- External IP of the local branch router: 55.44.33.22
- External IP of the remote central router: 88.55.44.33
As we can see, the situation here is reversed - we're configuring the FreeBSD router on the branch side, which routes two local networks and reaches through IPsec via the central gateway to the rest of the corporate networks.
racoon.conf:
path include "/usr/local/etc/racoon";
path pre_shared_key "/usr/local/etc/racoon/psk.txt";
padding
{
maximum_length 20; # maximum padding length.
randomize off; # enable randomize length.
strict_check off; # enable strict check.
exclusive_tail off; # extract last one octet.
}
listen
{
isakmp 55.44.33.22 [500];
}
# Specify various default timers.
timer
{
counter 5; # maximum trying count to send.
interval 20 sec; # maximum interval to resend.
persend 1; # the number of packets per send.
phase1 30 sec;
phase2 15 sec;
}
#############
# CENTRAL
#############
remote 88.77.66.55
{
exchange_mode main,base;
lifetime time 28800 sec;
generate_policy on;
proposal_check strict;
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 2;
}
}
sainfo subnet 10.0.15.0/24 any address 10.0.0.0/16 any
{
lifetime time 28800 sec;
encryption_algorithm aes128, 3des, cast128, blowfish 448, des, rijndael;
authentication_algorithm hmac_md5, hmac_sha1;
compression_algorithm deflate;
}
sainfo subnet 10.0.16.0/24 any address 10.0.0.0/16 any
{
lifetime time 28800 sec;
encryption_algorithm aes128, 3des, cast128, blowfish 448, des, rijndael;
authentication_algorithm hmac_md5, hmac_sha1;
compression_algorithm deflate;
}
ipsec.conf:
flush;
spdflush;
spdadd 10.0.15.0/24 10.0.15.0/24 any -P out none;
spdadd 10.0.15.0/24 10.0.15.0/24 any -P in none;
spdadd 10.0.16.0/24 10.0.16.0/24 any -P out none;
spdadd 10.0.16.0/24 10.0.16.0/24 any -P in none;
spdadd 10.0.15.0/24 10.0.16.0/24 any -P out none;
spdadd 10.0.15.0/24 10.0.16.0/24 any -P in none;
spdadd 10.0.16.0/24 10.0.15.0/24 any -P out none;
spdadd 10.0.16.0/24 10.0.15.0/24 any -P int none;
spdadd 10.0.15.0/24 10.0.0.0/16 any -P out ipsec esp/tunnel/55.44.33.22-88.77.66.55/unique;
spdadd 10.0.0.0/16 10.0.15.0/24 any -P in ipsec esp/tunnel/88.77.66.55-55.44.33.22/unique;
spdadd 10.0.16.0/24 10.0.0.0/16 any -P out ipsec esp/tunnel/55.44.33.22-88.77.66.55/unique;
spdadd 10.0.0.0/16 10.0.16.0/24 any -P in ipsec esp/tunnel/88.77.66.55-55.44.33.22/unique;
Whoa, here we see a difference! We wrote options with the "none" action in the ipsec.conf file.
This is done because 10.0.15.0/24 and 10.0.16.0/24 fall within subnet 10.0.0.0/16, and while on the central router side, when passing packets FROM subnet 10.0.0.0/16 TO subnet 10.0.15.0/24 (or 10.0.16.0/24) we didn't run into problems, in this particular case we have a situation where everything leaving subnets 10.0.15.0/24 and 10.0.16.0/24 into subnet 10.0.0.0/16 must be encrypted. Which means that even everything that goes around the tunnel (for example, between the subnets) will get encrypted too. Accordingly, absolutely nothing will work anymore!
To avoid this trap, we write "pass through, don't encrypt" rules for everything that enters or leaves subnet 10.0.15.0/24 itself (and 10.0.16.0/24 too), as well as rules to let packets pass between the subnets.
In the simpler case, when the branch side has only a single subnet (let's say it's 10.0.15.0/24) we can get by with this entry in ipsec.conf:
flush;
spdflush;
spdadd 10.0.15.0/24 10.0.15.0/24 any -P out none;
spdadd 10.0.15.0/24 10.0.15.0/24 any -P in none;
spdadd 10.0.15.0/24 10.0.0.0/16 any -P out ipsec esp/tunnel/55.44.33.22-88.77.66.55/unique;
spdadd 10.0.0.0/16 10.0.15.0/24 any -P in ipsec esp/tunnel/88.77.66.55-55.44.33.22/unique;
Comments