VPN - Revision history

Kg7qin at 01:16, 23 February 2024

2024-02-23T01:16:36Z

Kg7qin: Undo revision 12359 by Kg7qin (talk)

2024-02-23T01:15:29Z

Undo revision 12359 by Kg7qin (talk)

Show changes

Kg7qin: Reverted edits by Kg7qin (talk) to last revision by Bryan

2024-02-23T01:14:45Z

Reverted edits by Kg7qin (talk) to last revision by Bryan

Show changes

Kg7qin at 01:14, 23 February 2024

2024-02-23T01:14:20Z

Kg7qin: /* Persistent SSH Tunnels */ Updated article

2024-02-17T20:37:17Z

Persistent SSH Tunnels: Updated article

Kg7qin: /* MikroTik Config */

2024-02-17T03:45:28Z

MikroTik Config

Kg7qin: /* MikroTik Config */

2024-02-17T03:44:40Z

MikroTik Config

Kg7qin: /* strongSwan to MikroTik */

2024-02-17T03:44:15Z

strongSwan to MikroTik

Kg7qin at 03:42, 17 February 2024

2024-02-17T03:42:08Z

Kg7qin: /* stongSwan to strongSwan */

2024-02-17T03:40:21Z

stongSwan to strongSwan

@@ Line 234: / Line 234: @@
 {{go to top}}
-=Persistent SSH Tunnels=
+==Persistent SSH Tunnels==
 The following is how to create a persistent SSH Tunnel between two systems.  This is handy if you want to secure data flowing across networks, or even setup a tunnel without messing with VPN configuration.
-==Create User/Generate SSH key==
+===Create User/Generate SSH key===
 First you will create the user you will use for the tunnel.  This will allow you to forward non-privileged ports over 1024.
@@ Line 257: / Line 257: @@
 </pre>
-==Copy public key to target system==
+===Copy public key to target system===
 You will need to copy '''''id_rsa.pub''''' file from '''''/home/autossh/.ssh/''''' to the '''''authorized_keys''''' file on the remote system you want to connect to for the tunnel.
 ''Note:  It is recommended that you also create a normal user on the remote system and not use root.''
-==Install autossh==
+===Install autossh===
 You will need to install the autossh program on the system that will initiate the SSH tunnel.  Autossh automatically restarts the SSH tunnel when it exits.
 <pre>
@@ Line 268: / Line 268: @@
 </pre>
-==Setup script==
+===Setup script===
 Copy the following script, making the necessary changes as specified between the <> and place on the system that will initiate the tunnel (here we will save it as /opt/ssh-tunnel.sh):
 <pre>
@@ Line 302: / Line 302: @@
 You can also use -L to change the direction of the port forwarding from Remote to Local and have the initiating system forward data over the tunnel the the remote.
-==Make script executable==
+===Make script executable===
 Make sure you mark the script as executable with:
@@ Line 308: / Line 308: @@
 chmod +x /opt/ssh-tunnel.sh
 </pre>
-==Tunnel at startup==
+===Tunnel at startup===
 To have the tunnel up when the system restarts, choose one of the following methods
-===rc.local===
+====rc.local====
 Add a line to /etc/rc.local that calls the script.
@@ Line 320: / Line 320: @@
 ''Note:  You may have to enable rc.local on Ubuntu and Debian based systems via systemd.  Refer to your distributions documentation for information on how to enable it.''
-===systemd===
+====systemd====
 To have the script start at boot with systemd, create the following file and add it to /etc/systemd/system/ssh-tunnel.service
-====ssh-tunnel.service====
+=====ssh-tunnel.service=====
 <pre>
 [Unit]
@@ Line 336: / Line 336: @@
 </pre>
-====Enable service====
+=====Enable service=====
 To enable the service to run via systemd run:
 <pre>

@@ Line 237: / Line 237: @@
 The following is how to create a persistent SSH Tunnel between two systems.  This is handy if you want to secure data flowing across networks, or even setup a tunnel without messing with VPN configuration.
-=Create User/Generate SSH key=
+==Create User/Generate SSH key==
 First you will create the user you will use for the tunnel.  This will allow you to forward non-privileged ports over 1024.
@@ Line 257: / Line 257: @@
 </pre>
-=Copy public key to target system=
+==Copy public key to target system==
 You will need to copy '''''id_rsa.pub''''' file from '''''/home/autossh/.ssh/''''' to the '''''authorized_keys''''' file on the remote system you want to connect to for the tunnel.
 ''Note:  It is recommended that you also create a normal user on the remote system and not use root.''
-=Install autossh=
+==Install autossh==
 You will need to install the autossh program on the system that will initiate the SSH tunnel.  Autossh automatically restarts the SSH tunnel when it exits.
 <pre>
@@ Line 268: / Line 268: @@
 </pre>
-=Setup script=
+==Setup script==
 Copy the following script, making the necessary changes as specified between the <> and place on the system that will initiate the tunnel (here we will save it as /opt/ssh-tunnel.sh):
 <pre>
@@ Line 302: / Line 302: @@
 You can also use -L to change the direction of the port forwarding from Remote to Local and have the initiating system forward data over the tunnel the the remote.
-=Make script executable=
+==Make script executable==
 Make sure you mark the script as executable with:
@@ Line 308: / Line 308: @@
 chmod +x /opt/ssh-tunnel.sh
 </pre>
-=Tunnel at startup=
+==Tunnel at startup==
 To have the tunnel up when the system restarts, choose one of the following methods
-==rc.local==
+===rc.local===
 Add a line to /etc/rc.local that calls the script.
@@ Line 320: / Line 320: @@
 ''Note:  You may have to enable rc.local on Ubuntu and Debian based systems via systemd.  Refer to your distributions documentation for information on how to enable it.''
-==systemd==
+===systemd===
 To have the script start at boot with systemd, create the following file and add it to /etc/systemd/system/ssh-tunnel.service
-===ssh-tunnel.service===
+====ssh-tunnel.service====
 <pre>
 [Unit]
@@ Line 336: / Line 336: @@
 </pre>
-===Enable service===
+====Enable service====
 To enable the service to run via systemd run:
 <pre>

@@ Line 234: / Line 234: @@
 {{go to top}}
-==Persistent SSH Tunnels==
+=Persistent SSH Tunnels=
 The following is how to create a persistent SSH Tunnel between two systems.  This is handy if you want to secure data flowing across networks, or even setup a tunnel without messing with VPN configuration.
-===Create User/Generate SSH key===
+=Create User/Generate SSH key=
 First you will create the user you will use for the tunnel.  This will allow you to forward non-privileged ports over 1024.
@@ Line 247: / Line 246: @@
 Now switch to the user and generate an SSH key:
 <pre>
-su -s /bin/bash useradd
+su -s /bin/bash autossh
 cd ~
 ssh-keygen -b 4096
@@ Line 258: / Line 257: @@
 </pre>
-===Copy public key to target system===
+=Copy public key to target system=
-You will need to copy '''''id_rsa.pub''''' file from '''''/home/useradd/.ssh/''''' to the '''''authorized_keys''''' file on the remote system you want to connect to for the tunnel.
+You will need to copy '''''id_rsa.pub''''' file from '''''/home/autossh/.ssh/''''' to the '''''authorized_keys''''' file on the remote system you want to connect to for the tunnel.
 ''Note:  It is recommended that you also create a normal user on the remote system and not use root.''
-===Install autossh===
+=Install autossh=
 You will need to install the autossh program on the system that will initiate the SSH tunnel.  Autossh automatically restarts the SSH tunnel when it exits.
 <pre>
@@ Line 269: / Line 268: @@
 </pre>
-===Setup script===
+=Setup script=
-Copy the following script, making the necessary changes as specified between the <> and place on the system that will initiate the tunnel (usually /opt):
+Copy the following script, making the necessary changes as specified between the <> and place on the system that will initiate the tunnel (here we will save it as /opt/ssh-tunnel.sh):
 <pre>
 #!/bin/sh
+#
 su -s /bin/sh autossh -c 'autossh -M 0 -N -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -o "ExitOnForwardFailure=yes" -f -T -R localhost:<target port>:<local IP or localhost>:<local port> <user>@<domain>'
 </pre>
 {| class="wikitable"
@@ Line 305: / Line 302: @@
 You can also use -L to change the direction of the port forwarding from Remote to Local and have the initiating system forward data over the tunnel the the remote.
-===Make script executable===
+=Make script executable=
 Make sure you mark the script as executable with:
 <pre>
-chmod +x <name_of_script>.sh
+chmod +x /opt/ssh-tunnel.sh
 </pre>
-===Tunnel at startup===
+=Tunnel at startup=
-To have this tunnel automatically start if the system is rebooted, add a call to the script to rc.local.
+To have the tunnel up when the system restarts, choose one of the following methods
 <pre>
-/opt/<name_of_script>.sh
+# Start AutoSSH tunnel at boot
 </pre>
 ''Note:  You may have to enable rc.local on Ubuntu and Debian based systems via systemd.  Refer to your distributions documentation for information on how to enable it.''
 == GRE Tunnel ==

@@ Line 73: / Line 73: @@
 {{go to top}}
 The following config is best done from the terminal on a MikroTik device.
    /ip ipsec policy

@@ Line 73: / Line 73: @@
 {{go to top}}
 The following config is best done from the terminal on a MikroTik device.
    /ip ipsec policy

@@ Line 42: / Line 42: @@
 === strongSwan to MikroTik ===
-Use the following configurations to connect a system running strongSwan<ref>strongSwan Official Site [https://www.strongswan.org/]</ref> to a MikroTik<ref>MikroTik Official Site [https://mikrotik.com/]</ref> device using IPSEC.
+Use the following configurations to connect a system running strongSwan to a MikroTik<ref>MikroTik Official Site [https://mikrotik.com/]</ref> device using IPSEC.
 ==== strongSwan config ====

@@ Line 16: / Line 16: @@
 Information on how to setup IPSEC tunnels.
-=== stongSwan to strongSwan ===
+=== strongSwan to strongSwan ===
 Use the following config for a strongSwan<ref>strongSwan Official Site [https://www.strongswan.org/]</ref> to strongSwan configuration.  Make sure the left and right IP addresses are updated to match each system.  You can use the same ipsec.secrets file on both systems without changing the IP address order, although I recommend changing it to having the local IP on the left and the remote on the right as shown below.