IPSEC with OpenBSD
Page content
Intro
Stage a few Machines, puffy206 - 209 puffy206 has got a static ip, while puffy207 - 209 got dynamic ip addresses
Master, puffy206
Loopback
doas su -
cat << 'EOF' > /etc/hostname.lo1
inet 10.0.0.6/32
up
EOF
Enable IPSEC & IP Forwarding
cat << 'EOF' >> /etc/sysctl.conf
net.inet.ip.forwarding=1
net.inet.gre.allow=1
EOF
rcctl enable ipsec isakmpd
rcctl set isakmpd flags -K
Create Tunnel Endpoint
cat << 'EOF' > /etc/ipsec.conf
ike dynamic esp tunnel from 10.0.0.6/32 to 10.0.0.7/32 peer any \
main group "modp1024" quick group "modp1024" \
psk "my-tunnel-is-private"
ike dynamic esp tunnel from 10.0.0.6/32 to 10.0.0.8/32 peer any \
main group "modp1024" quick group "modp1024" \
psk "my-tunnel-is-private"
ike dynamic esp tunnel from 10.0.0.6/32 to 10.0.0.8/32 peer any \
main group "modp1024" quick group "modp1024" \
psk "my-tunnel-is-private"
EOF
chmod 600 /etc/ipsec.conf
Reboot and Check
reboot
gnuwatch "ipsecctl -s all"
Slave, puffy207
Loopback
doas su -
cat << 'EOF' > /etc/hostname.lo1
inet 10.0.0.7/32
up
EOF
Enable IPSEC & IP Forwarding
cat << 'EOF' >> /etc/sysctl.conf
net.inet.ip.forwarding=1
net.inet.gre.allow=1
EOF
rcctl enable ipsec isakmpd
rcctl set isakmpd flags -K
IPSEC
cat << 'EOF' > /etc/ipsec.conf
ike esp tunnel from 10.0.0.7/32 to 10.0.0.6/32 peer 192.168.108.206 \
main group "modp1024" quick group "modp1024" \
psk "my-tunnel-is-private"
EOF
chmod 600 /etc/ipsec.conf
Slave, puffy208
Loopback
doas su -
cat << 'EOF' > /etc/hostname.lo1
inet 10.0.0.8/32
up
EOF
Enable IPSEC & IP Forwarding
cat << 'EOF' >> /etc/sysctl.conf
net.inet.ip.forwarding=1
net.inet.gre.allow=1
EOF
rcctl enable ipsec isakmpd
rcctl set isakmpd flags -K
IPSEC
cat << 'EOF' > /etc/ipsec.conf
ike esp tunnel from 10.0.0.8/32 to 10.0.0.6/32 peer 192.168.108.206 \
main group "modp1024" quick group "modp1024" \
psk "my-tunnel-is-private"
EOF
chmod 600 /etc/ipsec.conf
Slave, puffy209
Loopback
doas su -
cat << 'EOF' > /etc/hostname.lo1
inet 10.0.0.9/32
up
EOF
Enable IPSEC & IP Forwarding
cat << 'EOF' >> /etc/sysctl.conf
net.inet.ip.forwarding=1
net.inet.gre.allow=1
EOF
rcctl enable ipsec isakmpd
rcctl set isakmpd flags -K
IPSEC
cat << 'EOF' > /etc/ipsec.conf
ike esp tunnel from 10.0.0.9/32 to 10.0.0.6/32 peer 192.168.108.206 \
main group "modp1024" quick group "modp1024" \
psk "my-tunnel-is-private"
EOF
chmod 600 /etc/ipsec.conf
Full IPSEC Example
cat /etc/ipsec.conf
#
# https://man.openbsd.org/ipsec.conf.5
# http://www.kernel-panic.it/openbsd/vpn/vpn3.html
# https://www.packetmischief.ca/openbsd-ipsec-tunnel-guide/
#
# ike [mode] [encap] [tmode] [proto protocol] \
# from src [port sport] [(srcnat)] to dst [port dport] \
# [local localip] [peer remote] \
# [mode auth algorithm enc algorithm group group] \
# [quick auth algorithm enc algorithm group group] \
# [srcid string] [dstid string] \
# [psk string] [tag string]
# mode: active (default), passive, dynamic
# encap: esp (default), ah
# tmode: tunnel (default), transport
# mode: main (default), aggressive -> this is phase 1
# quick: -> this is phase 2
# Var
local_gw = "MEINE-PUBLIC-IP"
local_net = "MEIN-NETZWERK/MASK"
auth1 = "hmac-sha1" # hmac-sha1, hmac-sha2-256, hmac-sha2-384, hmac-sha2-512
enc1 = "aes-128" # aes-128 (=aes), aes-192, aes-256, blowfish
group1 = "modp3072" # modp768 (g1), modp1024 (g2), modp1536 (g5), modp2048 (g14), modp3072 (g15), modp4096 (g16), modp6144 (g17), modp8192 (g18), ... (g30)
time1 = "3600" # in Seconds, or 10m, resp 12h
auth2 = "hmac-sha2-256" # siehe oben
enc2 = "aes-128" # siehe oben
group2 = "modp3072" # siehe oben
time2 = "1200" # siehe oben
# Tunnel to Remote
remote_gw = "DEINE-PUBLIC-IP"
remote_net = "DEIN-NETZWERK/MASK"
key = "super-huper-secret-key""
ike dynamic esp tunnel from $local_net to $remote_net peer $remote_gw \
main auth $auth1 enc $enc1 group $group1 lifetime $time1 \
quick auth $auth2 enc $enc2 group $group2 lifetime $time2 \
srcid $local_gw \
psk $key
ike dynamic esp tunnel from $remote_net to $local_net peer $remote_gw \
main auth $auth1 enc $enc1 group $group1 lifetime $time1 \
quick auth $auth2 enc $enc2 group $group2 lifetime $time2 \
srcid $local_gw \
psk $key
Links
Any Comments ?
sha256: 520f63f7fc89628690accefc9bcae1247f7425f9baaff5847bdbda16dae089ba