Difference between revisions of "VPN"

From "PTTLink Wiki"
Jump to navigation Jump to search
 
(75 intermediate revisions by 2 users not shown)
Line 1: Line 1:
−
<div style="clear:both; position:relative; box-sizing:border-box; width:100%; margin:1.2em 0 6px; min-width:47em; border:2pm solid #ddd; background-color:#ebebeb; color:#000; white-space:nowrap; text-align:center; font-size:18px;">THIS ARTICLE IS A WORK IN PROGRESS AND IS STILL BEING EDITED BY THE AUTHOR</div>
 
  
−
= VPN =  
+
[[Category:VPN]]
−
The following contains information on how to setup a Virtual Private Network (VPN) connection using various popular packages.  
+
[[Category:Node Configuration]]
 +
[[Category:Administration]]
 +
[[Category:Networking]]
 +
[[Category:Software]]
 +
{{Infobox PTTLink
 +
| image = Cyber-security-4072712 1920.jpg
 +
| caption = VPN Security
 +
| category = How to
 +
}}
 +
{{ Note|'''This document is a work in progress and is still being updated by the author.''' }}
 +
The following contains information on how to setup a Virtual Private Network (VPN) connection using various popular software packages and hardware devices.  
  
 
== IPSEC ==
 
== IPSEC ==
 
Information on how to setup IPSEC tunnels.
 
Information on how to setup IPSEC tunnels.
  
−
=== MikroTik to strongSwan ===
+
=== strongSwan to strongSwan ===
−
Use the following configurations to connect a system running stongSwan<ref>strongSwan Official Site [https://www.strongswan.org/]</ref> to a MikroTik<ref>MikroTik Official Site [https://mikrotik.com/]</ref> device using IPSEC.
+
Use the following config for a strongSwan<ref>strongSwan Official Site [https://www.strongswan.org/]</ref> to strongSwan configuration.  Make sure the left and right IP addresses are updated to match each system.  You can use the same ipsec.secrets file on both systems without changing the IP address order, although I recommend changing it to having the local IP on the left and the remote on the right as shown below.
 +
 
 +
====ipsec.conf====
 +
/sec/ipsec/conf:
 +
 
 +
  conn <name>
 +
            authby=secret
 +
            auto=route        # can also be start
 +
            keyexchange=ike
 +
            left=<your local IP>
 +
            right=<remote IP of Mikrotik system>
 +
            leftikeport=500
 +
            rightikeport=500
 +
            type=transport
 +
            esp=aes128gcm16!
 +
            dpddelay=5
 +
            dpdtimeout=20
 +
            dpdaction=clear  # can also be restart
 +
 
 +
====ipsec.secrets====
 +
/etc/ipsec.secrets:
 +
 
 +
    <your local IP> <remote IP of Mikrotik system> :  PSK "<Put your preshared key here>"
 +
 
 +
=== strongSwan to MikroTik ===
 +
Use the following configurations to connect a system running strongSwan to a MikroTik<ref>MikroTik Official Site [https://mikrotik.com/]</ref> device using IPSEC.
  
 
==== strongSwan config ====
 
==== strongSwan config ====
 
The following configuration will work on FreeBSD or Linux systems with strongSwan installed.
 
The following configuration will work on FreeBSD or Linux systems with strongSwan installed.
−
 
−
''Note:  You can use this config to connect two non-MikroTik systems as well.  Just replicate the config below for each system you wish to connect.''
 
  
 
=====ipsec.conf=====
 
=====ipsec.conf=====
Line 39: Line 71:
  
 
==== MikroTik Config ====
 
==== MikroTik Config ====
−
 
+
{{go to top}}
 
The following config is best done from the terminal on a MikroTik device.
 
The following config is best done from the terminal on a MikroTik device.
  
−
''Note:  You can use the following config to connect two MikroTik system.  Just replicate the config below on each system you wish to connect.''
+
''Note:  You can use the following config to connect two MikroTik systems.  Just replicate the config below on each system you wish to connect.''
  
 
   /ip ipsec policy
 
   /ip ipsec policy
Line 58: Line 90:
 
   /ip ipsec profile
 
   /ip ipsec profile
 
   add name="ike2" hash-algorithm=sha1 enc-algorithm=aes-256,aes-192,aes-128,3des,des dh-group=modp2048,modp1024 lifetime=8h proposal-check=obey nat-traversal=no dpd-interval=2m dpd-maximum-failures=5
 
   add name="ike2" hash-algorithm=sha1 enc-algorithm=aes-256,aes-192,aes-128,3des,des dh-group=modp2048,modp1024 lifetime=8h proposal-check=obey nat-traversal=no dpd-interval=2m dpd-maximum-failures=5
 +
 +
=== strongSwan to Cisco - IKEv1 ===
 +
==== Cisco IOS Config ====
 +
 +
  crypto isakmp policy 10
 +
    encr aes
 +
    authentication pre-share
 +
    group 5
 +
  crypto isakmp key cisco address 172.16.10.2   
 +
 
 +
  crypto ipsec transform-set TS esp-aes esp-sha-hmac
 +
    mode tunnel
 +
 
 +
  crypto map cmap 10 ipsec-isakmp
 +
    set peer 172.16.10.2
 +
    set transform-set TS
 +
    match address cryptoacl
 +
 
 +
  interface Ethernet0/1
 +
    ip address 192.168.1.1 255.255.255.0
 +
 
 +
  interface Ethernet0/0
 +
    ip address 172.16.10.1 255.255.255.0
 +
    crypto map cmap
 +
 
 +
  ip access-list extended cryptoacl
 +
    permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
 +
 +
==== strongSwan Config ====
 +
=====ipsec.conf=====
 +
/etc/ipsec.conf:
 +
 +
  config setup
 +
          # strictcrlpolicy=yes
 +
          # uniqueids = no
 +
 
 +
  conn %default
 +
          ikelifetime=1440m
 +
          keylife=60m
 +
          rekeymargin=3m
 +
          keyingtries=1
 +
          keyexchange=ikev1
 +
          authby=secret
 +
 
 +
  conn ciscoios
 +
          left=172.16.10.2                  #strongswan outside address
 +
          leftsubnet=192.168.2.0/24        #network behind strongswan
 +
          leftid=172.16.10.2                #IKEID sent by strongswan
 +
          leftfirewall=yes
 +
          right=172.16.10.1                #IOS outside address
 +
          rightsubnet=192.168.1.0/24        #network behind IOS
 +
          rightid=172.16.10.1              #IKEID sent by IOS
 +
          auto=add
 +
          ike=aes128-md5-modp1536          #P1: modp1536 = DH group 5
 +
          esp=aes128-sha1                  #P2
 +
 +
=====ipsec.secrets=====
 +
/etc/ipsec.secrets:
 +
 +
  172.16.10.2 172.16.10.1 : PSK cisco
 +
 +
=== strongSwan to Cisco - IKEv2 ===
 +
Source: [[https://www.cisco.com/c/en/us/support/docs/ip/internet-key-exchange-ike/117258-config-l2l.html#anc10]]
 +
 +
==== Cisco IOS Config ====
 +
 +
  crypto ikev2 proposal ikev2proposal
 +
    encryption aes-cbc-128
 +
    integrity sha1
 +
    group 5
 +
 
 +
  crypto ikev2 policy ikev2policy
 +
    match fvrf any
 +
    proposal ikev2proposal
 +
 
 +
  crypto ikev2 keyring keys
 +
    peer strongswan
 +
    address 172.16.10.2
 +
    pre-shared-key local cisco
 +
    pre-shared-key remote cisco
 +
   
 +
  crypto ikev2 profile ikev2profile
 +
    match identity remote address 172.16.10.2 255.255.255.255
 +
    authentication remote pre-share
 +
    authentication local pre-share
 +
    keyring local keys
 +
 
 +
  crypto ipsec transform-set TS esp-aes esp-sha-hmac
 +
    mode tunnel
 +
 
 +
  crypto map cmap 10 ipsec-isakmp
 +
    set peer 172.16.10.2
 +
    set transform-set TS
 +
    set ikev2-profile ikev2profile
 +
    match address cryptoacl
 +
 
 +
  interface Ethernet0/1
 +
    ip address 192.168.1.1 255.255.255.0
 +
 
 +
  interface Ethernet0/0
 +
    ip address 172.16.10.1 255.255.255.0
 +
    crypto map cmap
 +
   
 +
  ip access-list extended cryptoacl
 +
    permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
 +
 +
==== strongSwan Config ====
 +
=====ipsec.conf=====
 +
/etc/ipsec.conf:
 +
 +
  config setup
 +
          # strictcrlpolicy=yes
 +
          # uniqueids = no
 +
 
 +
  conn %default
 +
          ikelifetime=1440m
 +
          keylife=60m
 +
          rekeymargin=3m
 +
          keyingtries=1
 +
          keyexchange=ikev1
 +
          authby=secret
 +
 
 +
  conn ciscoios
 +
          left=172.16.10.2
 +
          leftsubnet=192.168.2.0/24
 +
          leftid=172.16.10.2
 +
          leftfirewall=yes
 +
          right=172.16.10.1
 +
          rightsubnet=192.168.1.0/24
 +
          rightid=172.16.10.1
 +
          auto=add
 +
          ike=aes128-sha1-modp1536
 +
          esp=aes128-sha1
 +
          keyexchange=ikev2
 +
 +
=====ipsec.secrets=====
 +
/etc/ipsec.secrets:
 +
 +
  172.16.10.2 : PSK "cisco"
 +
  172.16.10.1 : PSK "cisco"
 +
 +
== PPTP ==
 +
{{go to top}}
 +
 +
==Persistent SSH Tunnels==
 +
The following is how to create a persistent SSH Tunnel between two systems.  This is handy if you want to secure data flowing across networks, or even setup a tunnel without messing with VPN configuration.
 +
 +
===Create User/Generate SSH key===
 +
First you will create the user you will use for the tunnel.  This will allow you to forward non-privileged ports over 1024.
 +
 +
''Note:  This user does not have a password assigned or a shell.  This will prevent user logins to the system.''
 +
<pre>
 +
useradd -m -s /bin/false autossh
 +
</pre>
 +
Now switch to the user and generate an SSH key:
 +
<pre>
 +
su -s /bin/bash autossh
 +
cd ~
 +
ssh-keygen -b 4096
 +
</pre>
 +
''Note:  Leave password blank''
 +
 +
Once done, exit back to your normal user shell
 +
<pre>
 +
exit
 +
</pre>
 +
 +
===Copy public key to target system===
 +
You will need to copy '''''id_rsa.pub''''' file from '''''/home/autossh/.ssh/''''' to the '''''authorized_keys''''' file on the remote system you want to connect to for the tunnel.
 +
 +
''Note:  It is recommended that you also create a normal user on the remote system and not use root.''
 +
 +
===Install autossh===
 +
You will need to install the autossh program on the system that will initiate the SSH tunnel.  Autossh automatically restarts the SSH tunnel when it exits.
 +
<pre>
 +
apt-get install autossh
 +
</pre>
 +
 +
===Setup script===
 +
Copy the following script, making the necessary changes as specified between the <> and place on the system that will initiate the tunnel (here we will save it as /opt/ssh-tunnel.sh):
 +
<pre>
 +
#!/bin/sh
 +
#
 +
 +
su -s /bin/sh autossh -c 'autossh -M 0 -N -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -o "ExitOnForwardFailure=yes" -f -T -R localhost:<target port>:<local IP or localhost>:<local port> <user>@<domain>'
 +
 +
</pre>
 +
 +
{| class="wikitable"
 +
! Parameter !! Description
 +
|-
 +
|  localhost || localhost or IP address on target system
 +
|-
 +
|  <target port> || port on target system
 +
|-
 +
|  <local IP or localhost> || localhost or IP address on system initiating tunnel
 +
|-
 +
|  <local port> || port on system initiating tunnel
 +
|-
 +
|  <user@domain> || username and domain to use when SSHing to target system
 +
|}
 +
 +
An example of this command is:
 +
 +
<pre>
 +
su -s /bin/sh autossh -c 'autossh -M 0 -N -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -o "ExitOnForwardFailure=yes" -f -T -R localhost:3306:localhost:3306 joe@blow.com'
 +
</pre>
 +
 +
This would allow the target (remote) system to access the local (system initiating the SSH tunnel) system's MySQL server over the tunnel. 
 +
 +
You can also use -L to change the direction of the port forwarding from Remote to Local and have the initiating system forward data over the tunnel the the remote.
 +
 +
===Make script executable===
 +
Make sure you mark the script as executable with:
 +
 +
<pre>
 +
chmod +x /opt/ssh-tunnel.sh
 +
</pre>
 +
===Tunnel at startup===
 +
To have the tunnel up when the system restarts, choose one of the following methods
 +
 +
====rc.local====
 +
Add a line to /etc/rc.local that calls the script.
 +
 +
<pre>
 +
# Start AutoSSH tunnel at boot
 +
/opt/ssh-tunnel.sh
 +
</pre>
 +
 +
''Note:  You may have to enable rc.local on Ubuntu and Debian based systems via systemd.  Refer to your distributions documentation for information on how to enable it.''
 +
====systemd====
 +
To have the script start at boot with systemd, create the following file and add it to /etc/systemd/system/ssh-tunnel.service
 +
 +
=====ssh-tunnel.service=====
 +
<pre>
 +
[Unit]
 +
Description=AutoSSH Tunnel at boot
 +
 +
[Service]
 +
Type=oneshot
 +
ExecStart=/opt/ssh-tunnel.sh
 +
 +
[Install]
 +
WantedBy=multi-user.target
 +
</pre>
 +
 +
=====Enable service=====
 +
To enable the service to run via systemd run:
 +
<pre>
 +
systemctl enable ssh-tunnel.service
 +
</pre>
 +
 +
== GRE Tunnel ==
 +
{{go to top}}
 +
GRE Tunnels
 +
 +
===Public/Private VM tunnel===
 +
GRE tunnels are useful for connecting a VM in a private/home network to the internet via a public server/VM.  The following information will connect Server A (public server) to Server B (private server), and allow requests to Server B to be passed to Server A's resources for use on the Internet.
 +
 +
====Configuration====
 +
'''IP addresses'''
 +
* Server A will have a public IP of 30.30.30.30/24 and the GRE interface will be assigned 192.168.168.1/30
 +
* Server B will have a private IP of 10.0.0.50/24, a public IP of 40.40.40.40/24 and the GRE interface will be assigned 192.168.168.2/30
 +
'''Ports'''
 +
* Ports 22, 80 and 443 will be forwarded over the GRE tunnel
 +
 +
=====Server A (Public)=====
 +
Copy the following to /etc/gre.sh
 +
<syntaxhighlight lang="bash">
 +
#!/bin/sh
 +
ip tunnel add gre1 mode gre local 10.0.0.50 remote 40.40.40.40 ttl 255
 +
ip add add 192.168.168.1/30 dev gre1
 +
ip link set gre1 up
 +
 +
iptables -t nat -A POSTROUTING -s 192.168.168.0/30 ! -o gre+ -j SNAT --to-source 30.30.30.30
 +
iptables -A FORWARD -d 192.168.168.2 -m state --state NEW.ESTABLISHED,RELATED -j ACCEPT
 +
iptables -A FORWARD -d 192.168.168.2 -m state --state NEW.ESTABLISHED,RELATED -j ACCEPT
 +
 +
iptables -t nat -A PREROUTING -d 30.30.30.30 -p tcp -m tcp --dport 22 -j DNAT --to-destination 192.168.168.2
 +
iptables -t nat -A PREROUTING -d 30.30.30.30 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.168.2
 +
iptables -t nat -A PREROUTING -d 30.30.30.30 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.168.2
 +
</syntaxhighlight>
 +
 +
=====Server B (Private)=====
 +
* Add the following to /etc/iproute2/rt_tables<syntaxhighlight lang="text">
 +
100 GRE</syntaxhighlight>
 +
* Copy the following to /etc/gre.sh
 +
<syntaxhighlight lang="bash">
 +
#!/bin/sh
 +
iptunnel add gre1 mode gre local 10.0.0.50 remote 30.30.30.30 ttl 255
 +
ip addr add 192.168.168.2/30 dev gre1
 +
ip link set gre1 up
 +
 +
ip rule add from 192.168.168.0/30 table GRE
 +
ip route add default via 192.168.168.1 table GRE
 +
</syntaxhighlight>
 +
 +
==L2TP Ethernet Pseudowires==
 +
{{go to top}}
 +
===Cisco===
 +
The following configuration will setup L2TPv3 between two Cisco Routers - R1 and R2.
 +
 +
====R1 - Router Config====
 +
pseudowire-class test
 +
encapsulation l2tpv3
 +
ip local interface Loopback0
 +
ip pmtu
 +
ip tos value 10
 +
!
 +
!
 +
interface Loopback0
 +
ip address 1.1.1.1 255.255.255.255
 +
!
 +
interface FastEthernet0/0.1
 +
encapsulation dot1Q 5
 +
xconnect 2.2.2.2 1 encapsulation l2tpv3 pw-class test
 +
!
 +
interface FastEthernet0/0.2
 +
encapsulation dot1Q 2
 +
xconnect 2.2.2.2 2 encapsulation l2tpv3 pw-class test
 +
 +
====R2 - Router Config====
 +
pseudowire-class test
 +
encapsulation l2tpv3
 +
ip local interface Loopback0
 +
ip pmtu
 +
ip tos value 10
 +
!
 +
!
 +
interface Loopback0
 +
ip address 2.2.2.2 255.255.255.255
 +
!
 +
!
 +
interface FastEthernet0/1.1
 +
encapsulation dot1Q 5
 +
xconnect 1.1.1.1 1 encapsulation l2tpv3 pw-class test
 +
!
 +
interface FastEthernet0/1.2
 +
encapsulation dot1Q 2
 +
xconnect 1.1.1.1 2 encapsulation l2tpv3 pw-class test
 +
 +
===Linux===
 +
Create an L2TP ethernet pseudowires connection using the Linux kernel's L2TP drivers along with the ip utility.
 +
 +
Note:  This setup does not have any security.  You will need to route it over IPSEC to create a secure connection.
 +
 +
In this example we use separate systems to establish the tunnels across the Gateway (which represents the Internet). 
 +
 +
====Topology====
 +
{| class="wikitable" style="text-align: center; width: 35%"
 +
|+ L2TP Tunnel Topology
 +
! System
 +
! Network
 +
|-
 +
| Gateway
 +
| eth1: 1.1.1.1/30; eth2: 2.2.2.1.30
 +
|-
 +
| Tunnel1
 +
| eth1/l2tpeth0 (bridged); eth1: No IP configured; eth2: 1.1.1.2/30
 +
|-
 +
| Tunnel2
 +
| eth1/l2tpeth0 (bridged); eth1: No IP configured; eth2: 2.2.2.2/30
 +
|}
 +
 +
====Configuration====
 +
*Enable IP forwarding on Gateway, '''Tunnel1''' and '''Tunnel2''' systems by running this command on each:
 +
  # echo 1 > /proc/sys/net/ipv4/ip_forward
 +
 +
*Establish L3 connectivity between '''Tunnel1''' and '''Tunnel2''' systems:
 +
 +
On '''Tunnel1''' run:
 +
# ip route add 2.2.2.0/30 via 1.1.1.1
 +
 +
On '''Tunnel2''' run:
 +
# ip route add 1.1.1.0/30 via 2.2.2.1
 +
 +
Check to make sure both sides can ping each other:
 +
#tunnel1:~# ping -c1 2.2.2.2
 +
 +
PING 2.2.2.2 (2.2.2.2) 56(84) bytes of data.
 +
64 bytes from 2.2.2.2: icmp_req=1 ttl=63 time=1.03 ms
 +
 +
#tunnel2:~# ping -c1 1.1.1.2
 +
 +
PING 1.1.1.2 (1.1.1.2) 56(84) bytes of data.
 +
64 bytes from 1.1.1.2: icmp_req=1 ttl=63 time=1.20 ms
 +
 +
*Load L2TPv3 ethernet pseudowire module on '''Tunnel1''' and '''Tunnel2''' systems:
 +
# modprobe l2tp_eth
 +
 +
*Configure l2tp interface on '''Tunnel1''':
 +
# ip l2tp add tunnel tunnel_id 1000 peer_tunnel_id 2000 encap udp local 1.1.1.2 remote 2.2.2.2 udp_sport 6000 udp_dport 5000
 +
# ip l2tp add session tunnel_id 1000 session_id 3000 peer_session_id 4000
 +
 +
*Check configuration of tunnel on '''Tunnel1''' system:
 +
# ip l2tp show tunnel
 +
 +
Tunnel 1000, encap UDP
 +
  From 1.1.1.2 to 2.2.2.2
 +
  Peer tunnel 2000
 +
  UDP source / dest ports: 6000/5000
 +
  UDP checksum: disabled
 +
 +
# ip l2tp show session
 +
 +
Session 3000 in tunnel 1000
 +
  Peer session 4000, tunnel 2000
 +
  interface name: l2tpeth0
 +
  offset 0, peer offset 0
 +
 +
*Configure l2tp interface on '''Tunnel2''':
 +
# ip l2tp add tunnel tunnel_id 2000 peer_tunnel_id 1000 encap udp local 2.2.2.2 remote 1.1.1.2 udp_sport 5000 udp_dport 6000
 +
# ip l2tp add session tunnel_id 2000 session_id 4000 peer_session_id 3000
 +
 +
*Check configuration of tunnel on '''Tunnel2''' system:
 +
# ip l2tp show tunnel
 +
 +
Tunnel 2000, encap UDP
 +
  From 2.2.2.2 to 1.1.1.2
 +
  Peer tunnel 1000
 +
  UDP source / dest ports: 5000/6000
 +
  UDP checksum: disabled
 +
 +
# ip l2tp show session
 +
 +
Session 4000 in tunnel 2000
 +
  Peer session 3000, tunnel 1000
 +
  interface name: l2tpeth0
 +
  offset 0, peer offset 0
 +
 +
*Check MTU of newly created interfaces
 +
# ip a s dev l2tpeth0
 +
 +
l2tpeth0: <BROADCAST,MULTICAST> mtu 1488 qdisc noop state DOWN qlen 1000
 +
    link/ether 1a:8f:6e:04:3f:a3 brd ff:ff:ff:ff:ff:ff
 +
 +
*Adjust MTU and enforce MSS on eth1 on both '''Tunnel1''' and '''Tunnel2''' systems to prevent fragmentation that can cause issues:
 +
# ip link set eth1 mtu 1446
 +
# iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1406:1536 -j TCPMSS --set-mss 1406
 +
 +
*Install bridge-utils on '''Tunnel1''' and '''Tunnel2''' systems:
 +
# apt-get install bridge-utils
 +
 +
*Bridge the L2TP interface to eth1 on both the '''Tunnel1''' and '''Tunnel2''' systems so that is can communicate over the network:
 +
# brctl addbr l2tp
 +
# brctl addif l2tp eth1 l2tpeth0
 +
 +
*Check bridge configuration on '''Tunnel1''' and '''Tunnel2''' systems:
 +
# brctl show
 +
 +
bridge name         bridge id     STP enabled     interfaces
 +
l2tp         8000.1a8f6e043fa3  no             eth1 l2tpeth0
 +
 +
*Turn up the new l2tpeth0 interface on '''Tunnel1''' and '''Tunnel2''' systems so that it can be used:
 +
# ip l set dev l2tpeth0 up
 +
# ip l set dev l2tp up
 +
 +
Assuming you've done everything correctly here, you should now be able to use the '''Tunnel1''' and '''Tunnel2''' systems to send traffic over the same subnet on each side.
 +
 +
Example:
 +
*Using the setup above, assume you have two additional systems setup.
 +
**Computer1 is connected to Tunnel1.  No gateway set (not needed for an L2 link).
 +
**Computer1 has eth1 configured with 192.168.0.3/24
 +
**Computer2 is connected to Tunnel2.  No gateway set (not needed for an L2 link).
 +
**Computer 2 has eth1 configured wtih 192.168.0.4/24
 +
 +
*Do a ping test to make sure Computer1 can talk to Computer2 through the l2tp link:
 +
# ping -c5 192.168.0.4
 +
 +
64 bytes from 192.168.0.4: icmp_req=1 ttl=64 time=3.85 ms
 +
64 bytes from 192.168.0.4: icmp_req=2 ttl=64 time=1.93 ms
 +
64 bytes from 192.168.0.4: icmp_req=3 ttl=64 time=1.91 ms
 +
64 bytes from 192.168.0.4: icmp_req=4 ttl=64 time=1.87 ms
 +
64 bytes from 192.168.0.4: icmp_req=5 ttl=64 time=1.89 ms
 +
 +
*Successful output means that Computer1 can talk to Computer2 over the l2tp link since you're created a L2 link between each system.  Both computers act as if they are on the same local network segment, unaware of the L2TP connection over the Gateway via the Tunnels.
 +
 +
The path that data will travel is:
 +
Computer1 -> Tunnel1 -> Gateway -> Tunnel2 -> Computer2
 +
Computer1 <- Tunnel1 <- Gateway -< Tunnel2 -< Computer2
 +
 +
'''''NOTE:  THERE IS NO ENCRYPTION WITH AN L2TP TUNNEL.  ALL LAYER 2 DATA THAT IS VISIBLE TO EACH SIDE OF THE TUNNEL WILL NORMALLY BE SENT OVER THE LINK AND BE SEEN BY THE OTHER SIDE.'''''
 +
 +
===Between Cisco and Linux===
 +
{{go to top}}
 +
You can use L2TPv3 between Cisco and Linux utilizing the following script from Leif Sawyer.
 +
 +
*Script repository: https://github.com/akhepcat/Miscellaneous
 +
*Direct download link: https://raw.githubusercontent.com/akhepcat/Miscellaneous/master/l2tpv3-cisco.sh
 +
 +
This script will bring up the Linux side of the connection and generate the Cisco side config.
 +
 +
====Configuration====
 +
*Edit the variables '''TUNNEL_ID''', '''SESSION_ID''', '''LOCAL''', and '''REMOTE''' to values that are suitable for your environment.
 +
 +
====Commands====
 +
*Start the tunnel with '''l2tpv3-cisco.sh start'''
 +
*Stop the tunnel with '''l2tpv3-cisco.sh stop'''
 +
*Restart the tunnel with '''l2tpv3-cisco.sh restart'''
 +
*Generate Cisco config with '''l2tpv3-cisco.sh config'''
 +
 +
====l2tpv3-cisco.sh====
 +
  #!/bin/bash
 +
  # (c) 2020 Leif Sawyer
 +
  # License: GPL 3.0 (see https://github.com/akhepcat/)
 +
  # Permanent home:  https://github.com/akhepcat/Miscellaneous/
 +
  # Direct download: https://raw.githubusercontent.com/akhepcat/Miscellaneous/master/l2tpv3-cisco.sh
 +
  #
 +
  # using l2tpV3 between linux and cisco is sometimes weird.
 +
  # this script is how I get the linux side up.
 +
  # This will also auto-generate the cisco-side config.
 +
  ################################
 +
 
 +
  TUNNEL_ID=101
 +
  REMOTE_TUNNEL_ID=${TUNNEL_ID}
 +
 
 +
  SESSION_ID=101
 +
  REMOTE_SESSION_ID=${SESSION_ID}
 +
 
 +
  LOCAL=10.1.1.1
 +
  REMOTE=10.100.100.1
 +
 
 +
  ################################
 +
  PATH=/sbin:$PATH
 +
  IPV=$(ip -V | sed 's/.*-ss//')
 +
 
 +
  if [ ${IPV:-0} -lt 130716 ]
 +
  then
 +
  echo "Please install a newer version of iproute2 ( 3.10 or (>= 2013-07-16))"
 +
  echo "  from https://www.kernel.org/pub/linux/utils/net/iproute2/"
 +
  exit
 +
  fi
 +
 
 +
 
 +
  modules() {
 +
    for module in l2tp_core l2tp_netlink l2tp_eth l2tp_ip
 +
  do
 +
  modprobe $i
 +
  done
 +
  }
 +
 
 +
  tunnel_up() {
 +
  ip l2tp add tunnel remote ${REMOTE} local ${LOCAL} tunnel_id $TUNNEL_ID peer_tunnel_id $REMOTE_TUNNEL_ID encap ip
 +
  ip l2tp add session tunnel_id $TUNNEL_ID session_id $SESSION_ID peer_session_id $REMOTE_SESSION_ID l2spec_type none
 +
  ip link set l2tpeth0 up mtu 1488
 +
  iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1448:1536 -j TCPMSS --set-mss 1448
 +
  }
 +
 
 +
  tunnel_down() {
 +
  iptables -D FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1448:1536 -j TCPMSS --set-mss 1448
 +
  ip link set l2tpeth0 down
 +
  ip l2tp del session tunnel_id $TUNNEL_ID session_id $SESSION_ID
 +
  ip l2tp del tunnel tunnel_id $TUNNEL_ID
 +
  }
 +
 
 +
  cisco_config() {
 +
  cat <<EOF
 +
  ! Global config
 +
  !
 +
      pseudowire-class Linux-L2TP
 +
  encapsulation l2tpv3
 +
  interworking ethernet
 +
  protocol none
 +
  ip local interface $REMOTE
 +
  ip pmtu
 +
  ip tos value 41
 +
  ip ttl 100
 +
  !
 +
  ! Interface config
 +
  !
 +
      interface \$L2interface
 +
  xconnect $LOCAL $REMOTE_TUNNEL_ID encapsulation l2tpv3 manual pw-class Linux-L2TP
 +
      l2tp id $SESSION_ID $REMOTE_SESSION_ID
 +
 
 +
  EOF
 +
  }
 +
 
 +
  case $1 in
 +
  start|up) tunnel_up
 +
  ;;
 +
  stop|down) tunnel_down
 +
  ;;
 +
  restart|reload) stop; start
 +
  ;;
 +
  config|cisco|cisco-config) cisco_config
 +
  ;;
 +
  *) echo "$0  (start|up || stop|down || restart|reload || config|cisco|cisco-config)"
 +
  ;;
 +
  esac
  
 
== OpenVPN ==
 
== OpenVPN ==
−
Information on OpenVPN is available from https://openvpn.net/<ref>OpenVPN Official Site [https://openvpn.net/]</ref>
+
{{go to top}}
 +
Information on OpenVPN is available from https://openvpn.org/<ref>OpenVPN Official Site [https://openvpn.org/]</ref>
 +
 
 +
=== Road Warrior Install ===
 +
"''In business travel, a road warrior is a person that uses mobile devices such as tablet, laptop, smartphone and internet connectivity while traveling to conduct business. The term has often been used with regard to salespeople who travel often and who seldom are in the office. Today it is used for anyone who works outside the office and travels for business.''" <ref name="Road Warrior">Road warrior (computing) [https://en.wikipedia.org/wiki/Road_warrior_%28computing%29]</ref>
 +
 
 +
This will walk you through setting up the OpenVPN Road Warrior install for Ubuntu, Debian, CentOS and Fedora.
 +
 
 +
==== Installation ====
 +
*Run the script and follow the on-screen prompts:
 +
    wget https://git.io/vpn -O openvpn-install.sh && bash openvpn-install.sh
 +
 
 +
*Example install using the defaults (installed on Ubuntu 20.04.2 LTS VM):
 +
 
 +
  Welcome to this OpenVPN road warrior installer!
 +
 
 +
  Which protocol should OpenVPN use?
 +
      1) UDP (recommended)
 +
      2) TCP
 +
  Protocol [1]:
 +
 
 +
  What port should OpenVPN listen to?
 +
  Port [1194]:
 +
 
 +
  Select a DNS server for the clients:
 +
      1) Current system resolvers
 +
      2) Google
 +
      3) 1.1.1.1
 +
      4) OpenDNS
 +
      5) Quad9
 +
      6) AdGuard
 +
  DNS server [1]:
 +
 
 +
  Enter a name for the first client:
 +
  Name [client]:
 +
 
 +
  OpenVPN installation is ready to begin.
 +
  Press any key to continue...
 +
 
 +
  Get:1 http://security.ubuntu.com/ubuntu focal-security InRelease [114 kB]
 +
  Hit:2 http://us.archive.ubuntu.com/ubuntu focal InRelease
 +
  Get:3 http://us.archive.ubuntu.com/ubuntu focal-updates InRelease [114 kB]
 +
  Get:4 http://us.archive.ubuntu.com/ubuntu focal-backports InRelease [101 kB]
 +
  Fetched 328 kB in 1s (488 kB/s) 
 +
  Reading package lists... Done
 +
  Reading package lists... Done
 +
  Building dependency tree     
 +
  Reading state information... Done
 +
  ca-certificates is already the newest version (20210119~20.04.1).
 +
  openssl is already the newest version (1.1.1f-1ubuntu2.4).
 +
  Suggested packages:
 +
    resolvconf openvpn-systemd-resolved easy-rsa
 +
  The following NEW packages will be installed:
 +
    openvpn
 +
  0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
 +
  Need to get 0 B/477 kB of archives.
 +
  After this operation, 1,188 kB of additional disk space will be used.
 +
  Preconfiguring packages ...
 +
  Selecting previously unselected package openvpn.
 +
  (Reading database ... 109259 files and directories currently installed.)
 +
  Preparing to unpack .../openvpn_2.4.7-1ubuntu2.20.04.2_amd64.deb ...
 +
  Unpacking openvpn (2.4.7-1ubuntu2.20.04.2) ...
 +
  Setting up openvpn (2.4.7-1ubuntu2.20.04.2) ...
 +
    * Restarting virtual private network daemon.                      [ OK ]
 +
  Created symlink /etc/systemd/system/multi-user.target.wants/openvpn.service → /lib/systemd/system/openvpn.service.
 +
  Processing triggers for man-db (2.9.1-1) ...
 +
  Processing triggers for systemd (245.4-4ubuntu3.7) ...
 +
 
 +
  init-pki complete; you may now create a CA or requests.
 +
  Your newly created PKI dir is: /etc/openvpn/server/easy-rsa/pki
 +
 
 +
 
 +
  Using SSL: openssl OpenSSL 1.1.1f  31 Mar 2020
 +
  Generating RSA private key, 2048 bit long modulus (2 primes)
 +
  ......+++++
 +
  ...................+++++
 +
  e is 65537 (0x010001)
 +
 
 +
  Using SSL: openssl OpenSSL 1.1.1f  31 Mar 2020
 +
  Generating a RSA private key
 +
  ..........................................................................................................................................+++++
 +
  ....+++++
 +
  writing new private key to '/etc/openvpn/server/easy-rsa/pki/easy-rsa-2749.6tj7Mb/tmp.fSqcnR'
 +
  -----
 +
  Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-2749.6tj7Mb/tmp.TS5dnM
 +
  Check that the request matches the signature
 +
  Signature ok
 +
  The Subject's Distinguished Name is as follows
 +
  commonName            :ASN.1 12:'server'
 +
  Certificate is to be certified until Jul 10 05:27:40 2031 GMT (3650 days)
 +
 
 +
  Write out database with 1 new entries
 +
  Data Base Updated
 +
 
 +
  Using SSL: openssl OpenSSL 1.1.1f  31 Mar 2020
 +
  Generating a RSA private key
 +
  ............................+++++
 +
  ..............+++++
 +
  writing new private key to '/etc/openvpn/server/easy-rsa/pki/easy-rsa-2824.Fx4J3A/tmp.tlGKns'
 +
  -----
 +
  Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-2824.Fx4J3A/tmp.dVVyTl
 +
  Check that the request matches the signature
 +
  Signature ok
 +
  The Subject's Distinguished Name is as follows
 +
  commonName            :ASN.1 12:'client'
 +
  Certificate is to be certified until Jul 10 05:27:40 2031 GMT (3650 days)
 +
 
 +
  Write out database with 1 new entries
 +
  Data Base Updated
 +
 
 +
  Using SSL: openssl OpenSSL 1.1.1f  31 Mar 2020
 +
  Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-2880.kL0wa3/tmp.uyyWGn
 +
 
 +
  An updated CRL has been created.
 +
  CRL file: /etc/openvpn/server/easy-rsa/pki/crl.pem
 +
 
 +
 
 +
  Created symlink /etc/systemd/system/multi-user.target.wants/openvpn-iptables.service → /etc/systemd/system/openvpn-iptables.service.
 +
  Created symlink /etc/systemd/system/multi-user.target.wants/openvpn-server@server.service → /lib/systemd/system/openvpn-server@.service.
 +
 
 +
  Finished!
 +
 
 +
  The client configuration is available in: /root/client.ovpn
 +
  New clients can be added by running this script again.
 +
 
 +
==== Add a user ====
 +
To add a new user, run the openvpn-install.sh script again and select option '''1 - Add a new client'''
 +
  # bash openvpn-install.sh
 +
 
 +
  OpenVPN is already installed.
 +
 
 +
  Select an option:
 +
      1) Add a new client
 +
      2) Revoke an existing client
 +
      3) Remove OpenVPN
 +
      4) Exit
 +
  Option: 1
 +
*You will be prompted for a name, in this example we use client2
 +
  Provide a name for the client:
 +
  Name: client2
 +
  Using SSL: openssl OpenSSL 1.1.1f  31 Mar 2020
 +
  Generating a RSA private key
 +
  ....................................................+++++
 +
  ....+++++
 +
  writing new private key to '/etc/openvpn/server/easy-rsa/pki/easy-rsa-4310.cmbMtC/tmp.MMKA2C'
 +
  -----
 +
  Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-4310.cmbMtC/tmp.l84eev
 +
  Check that the request matches the signature
 +
  Signature ok
 +
  The Subject's Distinguished Name is as follows
 +
  commonName            :ASN.1 12:'client2'
 +
  Certificate is to be certified until Jul 10 05:41:10 2031 GMT (3650 days)
 +
 
 +
  Write out database with 1 new entries
 +
  Data Base Updated
 +
 
 +
 
 +
  client2 added. Configuration available in: /root/client2.ovpn
 +
 
 +
*Copy the configuration file above to your client to use it with OpenVPN
 +
 
 +
==== Remove a user ====
 +
To add a remove a user, run the openvpn-install.sh script again and select option '''2 - Revoke an existing client'''
 +
 
 +
  # bash openvpn-install.sh
 +
 
 +
  OpenVPN is already installed.
 +
 
 +
  Select an option:
 +
      1) Add a new client
 +
      2) Revoke an existing client
 +
      3) Remove OpenVPN
 +
      4) Exit
 +
  Option: 2
 +
*You will be presented with a list of configured users to remove.  We will choose client2 for this example.
 +
  Select the client to revoke:
 +
        1) client
 +
        2) client2
 +
  Client: 2
 +
 
 +
  Confirm client2 revocation? [y/N]: Y
 +
  Using SSL: openssl OpenSSL 1.1.1f  31 Mar 2020
 +
  Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-4407.i66z91/tmp.iS3gWM
 +
  Revoking Certificate 05D02E0DF2A242398233588721BB75E0.
 +
  Data Base Updated
 +
 
 +
  Using SSL: openssl OpenSSL 1.1.1f  31 Mar 2020
 +
  Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-4444.LpkzMp/tmp.03Azaw
 +
 
 +
  An updated CRL has been created.
 +
  CRL file: /etc/openvpn/server/easy-rsa/pki/crl.pem
 +
 
 +
 
 +
 
 +
  client2 revoked!
 +
 
 +
==== Uninstall ====
 +
*To uninstall, run the openvpn-install.sh script again and select option '''3 - Remove OpenVPN'''
 +
  Confirm OpenVPN removal? [y/N]:
 +
*When prompted answer Y to start the removal
 +
 
 +
  Removed /etc/systemd/system/multi-user.target.wants/openvpn-iptables.service.
 +
  Removed /etc/systemd/system/multi-user.target.wants/openvpn-server@server.service.
 +
  Reading package lists... Done
 +
  Building dependency tree     
 +
  Reading state information... Done
 +
  The following package was automatically installed and is no longer required:
 +
    libpkcs11-helper1
 +
  Use 'apt autoremove' to remove it.
 +
  The following packages will be REMOVED:
 +
    openvpn*
 +
  0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded.
 +
  After this operation, 1,188 kB disk space will be freed.
 +
  (Reading database ... 109344 files and directories currently installed.)
 +
  Removing openvpn (2.4.7-1ubuntu2.20.04.2) ...
 +
  Processing triggers for man-db (2.9.1-1) ...
 +
  (Reading database ... 109265 files and directories currently installed.)
 +
  Purging configuration files for openvpn (2.4.7-1ubuntu2.20.04.2) ...
 +
  Processing triggers for systemd (245.4-4ubuntu3.7) ...
 +
 
 +
  OpenVPN removed!
  
 
== TINC ==
 
== TINC ==
 +
{{go to top}}
 
Tinc is an open-source, self-routing, mesh networking protocol, used for compressed, encrypted, virtual private networks.
 
Tinc is an open-source, self-routing, mesh networking protocol, used for compressed, encrypted, virtual private networks.
  
Line 105: Line 947:
 
     └── NoMoreSecrets
 
     └── NoMoreSecrets
 
         ├── hosts
 
         ├── hosts
−
         │   ├── server1
+
         │  ├── server1
−
         │   ├── server2
+
         │  ├── server2
−
         │   └── server3
+
         │  └── server3
 
         ├── rsa_key.priv
 
         ├── rsa_key.priv
 
         ├── tinc.conf
 
         ├── tinc.conf
Line 113: Line 955:
 
         └── tinc-up
 
         └── tinc-up
 
</pre>
 
</pre>
 +
 +
==== FreeBSD Note ====
 +
FreeBSD will use the '''/usr/local/etc/tinc''' directory structure instead of the Linux '''/etc/tinc''' as shown above.  Adjust the paths below accordingly.  Additionally, the '''tinc-up''' and '''tinc-down''' files will differ. See the section below the '''Server 3''' example for notes on these differences.
  
 
====Individual node setup and configuration====
 
====Individual node setup and configuration====
Line 209: Line 1,054:
 
     ip addr del 10.0.0.3/32 dev $INTERFACE
 
     ip addr del 10.0.0.3/32 dev $INTERFACE
 
     ip link set $INTERFACE down
 
     ip link set $INTERFACE down
 +
 +
====== FreeBSD Note ======
 +
The '''tinc-up''' and '''tinc-down''' files will differ from those listed above as follows:
 +
 +
* /usr/local/etc/tinc/NoMoreSecrets/tinc-up:
 +
    #!/bin/sh
 +
    ifconfig "$INTERFACE" up
 +
    ifconfig "$INTERFACE" inet 10.0.0.3 netmask 255.255.255.255
 +
    route add -net 10.0.0.0 10.0.0.3
 +
 +
Note:  Substitute '''route add -host <remote tinc ip> <local tinc ip>''' in place of the last line above for a two node setup
 +
 +
* /usr/local/etc/tinc/NoMoreSecrets/tinc-down:
 +
    #!/bin/sh
 +
    ifconfig "$INTERFACE" destroy
 +
    exit
  
 
=====Create keypair=====
 
=====Create keypair=====
Line 234: Line 1,095:
  
 
=====Start tinc=====
 
=====Start tinc=====
 +
'''Linux:'''
 
* On all servers enable and start tinc
 
* On all servers enable and start tinc
 
     systemctl enable tinc@NoMoreSecrets
 
     systemctl enable tinc@NoMoreSecrets
 
     systemctl start tinc@NoMoreSecrets
 
     systemctl start tinc@NoMoreSecrets
 +
 +
'''FreeBSD:'''
 +
 +
You will need to ensure that tincd is properly configured on '''/etc/rc.conf''' before you attempt to start it:
 +
*Add the following to your /etc/rc.conf:
 +
  #tinc
 +
  tincd_enable="YES"
 +
  tincd_cfg="NoMoreSecrets"
 +
  tincd_flags="-d 2 -L"
 +
*Start tinc with:
 +
  service tincd start
  
 
Once tinc is up and running on all three servers you should be able to communicate over the 10.0.0.0/24 network.  
 
Once tinc is up and running on all three servers you should be able to communicate over the 10.0.0.0/24 network.  
Line 299: Line 1,172:
 
Calling tinc with -k or --kill option will cause it to automatically unregister itself.
 
Calling tinc with -k or --kill option will cause it to automatically unregister itself.
  
−
== Softether ==
+
== SOCAT ==
 +
SOCAT can be used to create a simple virtual network between two hosts using UDP and TUN devices. 
 +
 
 +
'''Note: It is possible to use TCP for this as well, but without the nodelay option it might cause problems.  You can also replace UDP with DTLS to add security to the connection.'''
 +
 
 +
*IP addresses used in this example:
 +
{| class="wikitable" style="text-align: center; width: 35%"
 +
! Host
 +
! Address
 +
! Mask
 +
|-
 +
| Physical server address
 +
| 1.2.3.4
 +
| N/A
 +
|-
 +
| Physical client address
 +
| N/A
 +
| N/A
 +
|-
 +
| TUN device on server
 +
| 192.168.255.1
 +
| 255.255.255.0
 +
|-
 +
| TUN device on client
 +
| 192.168.255.2
 +
| 255.255.255.0
 +
|}
 +
 
 +
Note: UDP connections will use PORT 11443.
 +
 
 +
=== Create TUN devices ===
 +
*TUN Server<syntaxhighlight lang="text">
 +
socat -d -d UDP-LISTEN:11443,reuseaddr TUN:192.168.255.1/24,up</syntaxhighlight>
 +
 
 +
*TUN Client<syntaxhighlight lang="text">
 +
socat UDP:1.2.3.4:11443 TUN:192.168.255.2/24,up</syntaxhighlight>
 +
 
 +
Executing these two commands will result in a connection being established from the client to the server via TUN devices.
 +
 
 +
=== Troubleshooting ===
 +
The following are common errors that you may encounter when using SOCAT to create a VPN.
 +
*Missing TUN/TAP Support<syntaxhighlight lang="text">
 +
... E unknown device/address "tun"</syntaxhighlight>
 +
 
 +
The SOCAT binary probably does not provide TUN/TAP support.  Reasons include not using Linux and using an older version of SOCAT.
 +
 
 +
*Missing Kernel Support<syntaxhighlight lang="text">
 +
,,, E open("/dev/net/tun", 02, 0666): No such file or directory</syntaxhighlight>
 +
 
 +
This incidates that your kernel does not have TUN/TAP support compiled in.
 +
 
 +
*TUN Cloning Device Permissions<syntaxhighlight lang="text">
 +
... E open("/dev/net/tun", 02, 0666): Permission denied</syntaxhighlight>
 +
 
 +
This indicates that you do not have sufficient permission to read or write to the TUN cloning device.  Check the device's permssions and ownership.
 +
 
 +
== SoftEther ==
 +
{{go to top}}
 
SoftEther VPN is an Open-Source Free Cross-platform Multi-protocol VPN Program, that is an academic project from the University of Tsukuba in Japan.
 
SoftEther VPN is an Open-Source Free Cross-platform Multi-protocol VPN Program, that is an academic project from the University of Tsukuba in Japan.
  
Line 305: Line 1,235:
  
 
=== Features ===
 
=== Features ===
−
*SSL-VPN tunnelling on HTTPS to pass though NATs and firewalls
+
*SSL-VPN tunnelling on HTTPS to pass though NAT and firewalls
 
*Revolutionary VPN over ICMP and VPN over DNS featuers
 
*Revolutionary VPN over ICMP and VPN over DNS featuers
 
*Ethernet-bridging (L2) and IP-routing (L3) over VPN.
 
*Ethernet-bridging (L2) and IP-routing (L3) over VPN.
 
*Embedded dynamic-DNS and NAT-traversal
 
*Embedded dynamic-DNS and NAT-traversal
 
*SSL-VPN (HTTPS) and support for 6 major VPN protocols: [http://www.softether.org/1-features/1._Ultimate_Powerful_VPN_Connectivity#Support_OpenVPN_Protocol OpenVPN], [http://www.softether.org/4-docs/2-howto/9.L2TPIPsec_Setup_Guide_for_SoftEther_VPN_Server IPSEC], [http://www.softether.org/4-docs/2-howto/9.L2TPIPsec_Setup_Guide_for_SoftEther_VPN_Server L2TP], [http://www.softether.org/1-features/1._Ultimate_Powerful_VPN_Connectivity#Support_Microsoft_SSTP_VPN_Protocol MS-SSTP], [http://www.softether.org/4-docs/2-howto/9.L2TPIPsec_Setup_Guide_for_SoftEther_VPN_Server/6.Cisco_IOS_L2TPv3%2F%2F%2F%2FIPsec_Edge-VPN_Router_Setup L2TPv3], and [http://www.softether.org/3-spec EtherIP])
 
*SSL-VPN (HTTPS) and support for 6 major VPN protocols: [http://www.softether.org/1-features/1._Ultimate_Powerful_VPN_Connectivity#Support_OpenVPN_Protocol OpenVPN], [http://www.softether.org/4-docs/2-howto/9.L2TPIPsec_Setup_Guide_for_SoftEther_VPN_Server IPSEC], [http://www.softether.org/4-docs/2-howto/9.L2TPIPsec_Setup_Guide_for_SoftEther_VPN_Server L2TP], [http://www.softether.org/1-features/1._Ultimate_Powerful_VPN_Connectivity#Support_Microsoft_SSTP_VPN_Protocol MS-SSTP], [http://www.softether.org/4-docs/2-howto/9.L2TPIPsec_Setup_Guide_for_SoftEther_VPN_Server/6.Cisco_IOS_L2TPv3%2F%2F%2F%2FIPsec_Edge-VPN_Router_Setup L2TPv3], and [http://www.softether.org/3-spec EtherIP])
 +
 +
====Cisco L2TPv3====
 +
Use the setup of SoftEther [https://www.softether.org/4-docs/2-howto/9.L2TPIPsec_Setup_Guide_for_SoftEther_VPN_Server/6.Cisco_IOS_L2TPv3%2F%2F%2F%2FIPsec_Edge-VPN_Router_Setup here] as a guide for an L2TPv3 connection to a Cisco device.
 +
 +
=====SoftEther settings=====
 +
Now make the following adjustments to the IPSEC/L2TPv3 settings shown there:
 +
 +
* Under IPSEC/L2TP setting select the checkbox for Enable EtherIP/L2TPv3 over IPsec Server Function
 +
* Select EtherIP / L2TP Detail Settings
 +
* ISAKMP Phase 1 ID: Specify local IP address of Cisco device here
 +
* Fill in username/password settings
 +
 +
* Under Virtual Hub management
 +
* Select Virtual NAT and virtual DHCP server function
 +
* Secure NAT settings wtill be used to set Virtual DHCP server settings
 +
 +
{| class="wikitable" style="text-align: center; width: 35%"
 +
|+ Ports used by Softether for this configuration
 +
! Type
 +
! Port #
 +
|-
 +
| UDP
 +
| 500
 +
|-
 +
| UDP
 +
| 4500
 +
|-
 +
| UDP
 +
| 1701
 +
|}
 +
 +
* Encryption:  If you have an issue with using AES during your initial testing, try using DES or 3DES.  Once you have the connection established try switching to a more secure algorithm.
 +
 +
=====Cisco config=====
 +
And then use the following config below on your Cisco device instead of what is listed on the SoftEther site to get L2TPv3 working:
 +
 +
{| class="wikitable" style="text-align: center; width: 65%"
 +
|+ Information used in this example
 +
! Local IP addess
 +
! Peer IP (SoftEther Public IP)
 +
! Pre-shared key
 +
|-
 +
| 192.168.100.100 (ISAKMP Phase 1 ID)
 +
| 1.1.1.100
 +
| CHANGEME
 +
|}
 +
 +
* Note: By default Cisco may have NAT-Traversal enabled.  This settings is not required.
 +
 +
* Specify the L2TPv3 settings and interface (change FastEterhnet0/0 to match your device's interface).
 +
 +
<pre>
 +
pseudowire-class L2TPv3
 +
  encapsulation l2tpv3
 +
  ip local interface FastEthernet0/0
 +
</pre>
 +
 +
* Note: You can chance the pseudowire-class interface's name from L2TPv3 to something more descriptive if you want.
 +
 +
* ISAKMP settings:
 +
 +
<pre>
 +
crypto isakmp policy 1
 +
  encr aes 256
 +
  authentication pre-share
 +
  group 2
 +
crypto isakmp key CHANGEME address 1.1.1.100
 +
crypto isakmp keepalive 10 periodic
 +
</pre>
 +
 +
Note: You can use AES 256 encryption here.  DH group uses type 2 1024 bit encryption.
 +
 +
* IPSEC settings:
 +
 +
<pre>
 +
crypto ipsec transform-set IPSEC esp-3des esp-sha-hmac
 +
  mode transport
 +
crypto ipsec fragmentation after-encryption
 +
</pre>
 +
 +
Note:  3des is being used here in this example.  If you put this tunnel into production make sure you change the cipher used to AES!!!
 +
 +
* Cryptographic map:
 +
 +
<pre>
 +
crypto map MAP 1 ipsec-isakmp
 +
  set peer 1.1.1.100
 +
  set transform-set IPSEC
 +
  match address IPSEC_MATCH_RULE
 +
</pre>
 +
 +
* Interface configuration
 +
 +
<pre>
 +
interface FastEthernet0/0
 +
  ip address 192.168.100.100 255.255.255.0
 +
  no ip proxy-arp
 +
  duplex auto
 +
  speed auto
 +
  crypto map MAP
 +
</pre>
 +
 +
Note:  FastEthernet0/0 uses the local IP address specified above and has the crypto map applied.
 +
 +
* Use FastEthernet0/1 as the interface for the tunnel
 +
 +
<pre>
 +
interface FastEthernet0/1
 +
  no ip address
 +
  duplex auto
 +
  speed auto
 +
  no cdp enable
 +
  xconnect 1.1.1.100 1 encapsulation l2tpv3 pw-class L2TPv3
 +
  bridge-group 1
 +
</pre>
 +
 +
* Access list:
 +
 +
<pre>
 +
ip access-list extended IPSEC_MATCH_RULE
 +
  permit 115 any any
 +
</pre>
 +
 +
* Now connect a device to FastEthernet0/1.  It should get a DHCP lease from SoftEther and be on the network.
 +
 +
=====Troubleshooting=====
 +
To troubleshoot the tunnel use the following commands:
 +
 +
<pre>
 +
debug crypt isakmp
 +
debug crypt ipsec
 +
debug l2tp all
 +
</pre>
 +
 +
* Show ISAKMP SA status:
 +
 +
<pre>
 +
#show crypto isakmp sa
 +
IPv4 Crypto ISAKMP SA
 +
dst            src            state          conn-id status
 +
1.1.1.100      192.168.100.100    QM_IDLE          1011 ACTIVE
 +
 +
IPv6 Crypto ISAKMP SA
 +
 +
・IPSec
 +
#show crypto ipsec sa
 +
 +
interface: FastEthernet0/0
 +
    Crypto map tag: MAP, local addr 192.168.100.100
 +
 +
  protected vrf: (none)
 +
  local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/115/0)
 +
  remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/115/0)
 +
  current_peer 1.1.1.100 port 4500
 +
    PERMIT, flags={origin_is_acl,}
 +
    #pkts encaps: 54342, #pkts encrypt: 54342, #pkts digest: 54342
 +
    #pkts decaps: 179917, #pkts decrypt: 179917, #pkts verify: 179917
 +
    #pkts compressed: 0, #pkts decompressed: 0
 +
    #pkts not compressed: 0, #pkts compr. failed: 0
 +
    #pkts not decompressed: 0, #pkts decompress failed: 0
 +
    #send errors 23, #recv errors 0
 +
 +
    local crypto endpt.: 192.168.100.100, remote crypto endpt.: 1.1.1.100
 +
    path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
 +
    current outbound spi: 0x48E82D7A(1223175546)
 +
    PFS (Y/N): N, DH group: none
 +
 +
    inbound esp sas:
 +
      spi: 0x1B68FD22(459865378)
 +
        transform: esp-3des esp-sha-hmac ,
 +
        in use settings ={Tunnel UDP-Encaps, }
 +
        conn id: 2107, flow_id: NETGX:107, sibling_flags 80000046, crypto map: MAP
 +
        sa timing: remaining key lifetime (k/sec): (4386973/1557)
 +
        IV size: 8 bytes
 +
        replay detection support: Y
 +
        Status: ACTIVE
 +
 +
    inbound ah sas:
 +
 +
    inbound pcp sas:
 +
 +
    outbound esp sas:
 +
      spi: 0x48E82D7A(1223175546)
 +
        transform: esp-3des esp-sha-hmac ,
 +
        in use settings ={Tunnel UDP-Encaps, }
 +
        conn id: 2108, flow_id: NETGX:108, sibling_flags 80000046, crypto map: MAP
 +
        sa timing: remaining key lifetime (k/sec): (4386975/1557)
 +
        IV size: 8 bytes
 +
        replay detection support: Y
 +
        Status: ACTIVE
 +
 +
    outbound ah sas:
 +
 +
    outbound pcp sas:
 +
</pre>
 +
 +
* Check L2TP session:
 +
 +
<pre>
 +
#show l2tp session
 +
L2TP Session Information Total tunnels 1 sessions 1
 +
 +
LocID      RemID      TunID      Username, Intf/      State  Last Chg Uniq ID
 +
                                Vcid, Circuit
 +
23239**** 1900**** 2306***** 1, Fa0/1            est    01:32:52 1
 +
</pre>
 +
 +
* Check L2TP tunnel:
 +
 +
<pre>
 +
L2TP Tunnel Information Total tunnels 1 sessions 1
 +
LocTunID  RemTunID  Remote Name  State  Remote Address  Sessn L2TP Class/
 +
                                                          Count VPDN Group
 +
230**** 1          ******* est    1.1.1.100  1    l2tp_default_cl
 +
</pre>
 +
 +
Note: If you use AES for IPSEC it will become TunID 0.
  
 
== WireGuard ==
 
== WireGuard ==
 +
{{go to top}}
 
WireGuard can be downloaded from https://www.wireguard.com/<ref>WireGuard Offical Site [https://www.wireguard.com/]</ref>
 
WireGuard can be downloaded from https://www.wireguard.com/<ref>WireGuard Offical Site [https://www.wireguard.com/]</ref>
 +
=== Road Warrior Install ===
 +
"''In business travel, a road warrior is a person that uses mobile devices such as tablet, laptop, smartphone and internet connectivity while traveling to conduct business. The term has often been used with regard to salespeople who travel often and who seldom are in the office. Today it is used for anyone who works outside the office and travels for business.''" <ref name="Road Warrior" />
 +
 +
This will walk you through setting up the WireGuard Road Warrior install for Ubuntu, Debian, CentOS and Fedora.
 +
 +
==== Installation ====
 +
*Run the script and follow the on-screen prompts:
 +
    wget https://git.io/wireguard -O wireguard-install.sh && bash wireguard-install.sh
 +
 +
*You can run it again to add/remove users or completely uninstall WireGuard
 +
 +
=== Mikrotik Wireguard Road Warrior Config ===
 +
From: https://forum.mikrotik.com/viewtopic.php?t=174417#<ref>Mikrotik Forums - MikroTik Wireguard server with Road Warrior clients [https://forum.mikrotik.com/viewtopic.php?t=174417#]</ref>
 +
 +
The following information will show you how to setup a Mikrotik Wireguard server with Road Warrior clients.
 +
 +
==== Network topology ====
 +
The network used in this examples is 192.168.66.0/24.  A Mikrotik device will be the server and client can be any device running the Wireguard software.
 +
{| class="wikitable" style="text-align: center; width: 35%"
 +
! System
 +
! IP Address
 +
|-
 +
| Wireguard server
 +
| 192.168.66.1
 +
|-
 +
| Wireguard client(s)
 +
| 192.168.66.[2-254]
 +
|}
 +
 +
==== Mikrotik Configuration ====
 +
<syntaxhighlight lang="text">
 +
# a private and public key will be automatically generated when adding the wireguard interface
 +
/interface wireguard
 +
add listen-port=13231 mtu=1420 name=wireguard1
 +
 +
/interface wireguard peers
 +
# the first client added here is ipv4 only
 +
add allowed-address=192.168.66.2/32 interface=wireguard1 public-key="*** replace-with-public-key-of-first-client ***"
 +
# this client is dual stack - public IPv6 should be used - replace 2001:db8:cafe:beef: with one of your /64 prefixes.
 +
add allowed-address=192.168.66.3/32,2001:db8:cafe:beef::3/128 interface=wireguard1 public-key="*** replace-with-public-key-of-second-client-dual-stack ***"
 +
 +
/ip address
 +
add address=192.168.66.1/24 interface=wireguard1 network=192.168.66.0
 +
 +
/ipv6 address
 +
add address=2001:db8:cafe:beef::1/64 interface=wireguard1
 +
</syntaxhighlight>
 +
 +
==== Client configuration ====
 +
<syntaxhighlight lang="text">
 +
Interface: (whatever name you want to specify)
 +
Public key: the client should automatically generate this - add this to the server above replacing "replace-with-public-key-of-second-client-dual-stack"
 +
Addresses: 192.168.66.3/24,2001:db8:cafe:beef::3/64          (note these are different subnet masks than in the server config)
 +
DNS servers: as desired - if you want to use the wireguard server for dns, specify 192.168.66.1
 +
 +
Peer:
 +
Public key - get the public key from the wireguard interface on the Mikrotik device and place here
 +
Endpoint - mydyndns.whatever:13231
 +
Allowed IPs: 0.0.0.0/0, ::/0
 +
</syntaxhighlight>
 +
 +
This client configuration will result in all traffic being forwarded via the Mikrotik Wireguard server.  You will need to ensure:
 +
*Create an input chain firewall rule to allow UDP traffic in on port 13231
 +
<syntaxhighlight lang="text">
 +
/ip firewall filter add action=accept chain=input comment="Allow Wireguard" dst-port=13231 protocol=udp
 +
</syntaxhighlight>
 +
*Ensure the Mikrotik firewall is allowing traffic from 192.168.66.0/24 and that you are NATing this traffic.  If your device is based off the default Mikrotik config and using the LAN interface list, you can add the Wireguard interface to this list to allow traffic through and NATing it as it leaves your network.  Otherwise, you will need to modify your configuration accordingly.
 +
 +
==== Get/Set Wireguard Peers ====
 +
*Get Mikrotik Wireguard peers list
 +
<syntaxhighlight lang="text">
 +
/interface wireguard peers print
 +
</syntaxhighlight>
 +
 +
*Set Mikrotik Wireguard peers list
 +
<syntaxhighlight lang="text">
 +
/interface wireguard peers set <ID> allowed-addresses=whatever,whateverelse
 +
</syntaxhighlight>
 +
 +
== VPNC ==
 +
{{go to top}}
 +
VPNC <ref>VPNC Project Homepage [https://www.unix-ag.uni-kl.de/~massar/vpnc/]</ref> is an open-source VPN client.
 +
 +
{| class="wikitable" style="text-align: center; width: 25%"
 +
|+ Works with the following
 +
! System
 +
|-
 +
| Cisco VPN concentrator 3000 Series
 +
|-
 +
| Cisco IOS routers
 +
|-
 +
| Cisco PIX / ASA Security Appliances
 +
|-
 +
| Juniper/Netscreen
 +
|}
 +
 +
* And is available for the following operating systems:
 +
{| class="wikitable" style="text-align: center; width: 15%"
 +
|+ Supported Operating Systems
 +
! Name
 +
|-
 +
| Linux
 +
|-
 +
| FreeBSD
 +
|-
 +
| OpenBSD
 +
|-
 +
| NetBSD
 +
|-
 +
| DragonFly BSD
 +
|-
 +
| Darwin / Mac OS X
 +
|-
 +
| Solaris
 +
|-
 +
| Windows / Cygwin
 +
|}
 +
 +
* Supported Authentications: Hybrid, Pre-Shared-Key + XAUTH, Pre-Shared-Key
 +
* Supported IKE DH-Groups: dh1, dh2, dh5
 +
* Supported Hash Algo (IKE/IPSEC): md5, sha1
 +
* Supported Encryptions (IKE/IPSEC): (null), (1des), 3des, aes128, aes192, aes256
 +
* Perfect Forward Secrecy: nopfs, dh1, dh2, dh5
 +
 +
=== Installation ===
 +
To install VPNC on Debian based distributions:
 +
    sudo apt-get install vpnc
 +
 +
=== Configuration ===
 +
Edit the default config file as follows (substitute your own name if you want to name the connection instead of using default.  You will use this name as @<name> when calling vpnc.)
 +
* Edit /etc/vpnc/default.conf. 
 +
    IPSec gateway <VPNC server IP or FQDN>
 +
    IPSec id AMPRNET
 +
    IPSec secret EzAsARDC
 +
    Xauth username YOUR-CALLSIGN
 +
    Xauth password _YOUR_PASSWORD_HERE_
 +
 +
=== Starting the VPN ===
 +
Use one fo the following commands to start your VPNC based VPN connection.
 +
 +
* This command would run VPNC using /etc/vpnc/default.conf, if it exists.  If it does not, it would prompt for the connection information:
 +
    sudo vpnc
 +
 +
* This would run VPNC using /etc/vpnc/external.conf, if it exists.
 +
    sudo vpnc external
 +
 +
==== Starting at boot ====
 +
You can start your VPNC based VPN connection at boot using one of the following methods.
 +
 +
===== /etc/rc.local =====
 +
This is the simplest way and does not involve creating init scripts or systemd service files.
 +
 +
Add a line such as the following into your /etc/rc.local file:
 +
  vpnc
 +
 +
===== systemd =====
 +
To control from systemd:
 +
 +
* Edit /usr/lib/systemd/system/vpnc@.service
 +
    [Unit]                                                                                                                                                                       
 +
    Description=VPNC connection to %i
 +
    Wants=network-online.target
 +
    After=network.target network-online.target
 +
   
 +
    [Service]
 +
    Type=forking
 +
    ExecStart=/usr/bin/vpnc --pid-file=/run/vpnc@%i.pid /etc/vpnc/%i.conf
 +
    PIDFile=/run/vpnc@%i.pid
 +
 
 +
    [Install]
 +
    WantedBy=multi-user.target
 +
 +
* Enable default VPNC configuration to be managed by systemd:
 +
    systemctl enable vpnc
 +
 +
* Start default VPNC connection with systemd:
 +
    systemctl start vpnc
 +
 +
Note:  If you have multiple VPNC configurations or chose to name your config, you will substitute vpnc for vpnc@<config name>.
  
 
== Other ==
 
== Other ==
 +
{{go to top}}
 
Any other information that doesn't fit elsewhere.
 
Any other information that doesn't fit elsewhere.
 +
 +
= Ham Radio VPN Providers =
 +
The following is a table of providers who offer free VPN connections to licensed Ham Radio operators.
 +
 +
'''Note:  No commercial advertisements or pay services are allowed or permitted.  Adding them will get your account removed and/or IP address banned.'''
 +
 +
{| class="wikitable" style="text-align: left; width: 85%"
 +
|+ Providers of Ham Radio VPN Connections
 +
! System
 +
! Contact
 +
! Type
 +
! Notes
 +
|-
 +
| w9cr.net
 +
| Bryan Fields, W9CR (bryan@bryanfields.net)
 +
| VPNC
 +
| Used as a means to get public IP's directly on nodes, bypassing NAT444 and man-in-the-middle IAX level filtering.  Provides 44net public IP space.  Include your callsign in the details.
 +
|-
 +
| AMPRNet VPN
 +
| https://wiki.ampr.org/wiki/AMPRNet_VPN
 +
| OpenVPN
 +
| AMPRNet VPN is an experimental method to access the AMPRNet using a VPN from anywhere on the Internet. The VPN is openly available to any amateur radio operators who have successfully applied for an X.509 certificate from one of the listed Certificate Authorities.
 +
|}
  
 
= Firewall =
 
= Firewall =
Line 321: Line 1,672:
  
 
== Linux ==
 
== Linux ==
 +
{{go to top}}
 
The following script can be used to setup a basic firewall on a Linux based system using iptables.  
 
The following script can be used to setup a basic firewall on a Linux based system using iptables.  
  
 
Supports IPv4 and IPv6.  Comment out the parts that are not need with a # or optionally delete them.
 
Supports IPv4 and IPv6.  Comment out the parts that are not need with a # or optionally delete them.
 +
 +
Note:  While this supports IPv6, some of the rules listed were only done for IPv4.  You'll need to make the necessary changes to have IPv6 protected as well.  While the parameters listed for IPv4 should work you should refer to the ip6tables man page if you have any issues.
  
 
   #!/bin/bash
 
   #!/bin/bash
Line 330: Line 1,684:
 
   INET_IF=eth0
 
   INET_IF=eth0
 
    
 
    
 +
  #IPv4
 
   #Edit IP address below to match the IP and netmask of the system or subnet you want to allow access to  
 
   #Edit IP address below to match the IP and netmask of the system or subnet you want to allow access to  
 
   #"Management only" services.  Add or remove as needed.  Make sure to update the ManagementFilterV4 with
 
   #"Management only" services.  Add or remove as needed.  Make sure to update the ManagementFilterV4 with
Line 337: Line 1,692:
 
      
 
      
 
   ManagementFilterV4=$System1,$System2
 
   ManagementFilterV4=$System1,$System2
 +
 
 +
  #IPv6
 +
  #Edit IP address below to match the IP and netmask of the system or subnet you want to allow access to
 +
  #"Management only" services.  Add or remove as needed.  Make sure to update the ManagementFilterV6 with
 +
  #the changes
 +
  V6System1="2001:db8:a::123/64" 
 +
  V6System2="2001:db8:b::123/64"
 +
   
 +
  ManagementFilterV6=$V6System1,$V6System2
 
    
 
    
 
   #Flush and zero all tables
 
   #Flush and zero all tables
Line 372: Line 1,736:
 
   ip6tables -N log-and-reject
 
   ip6tables -N log-and-reject
 
    
 
    
−
   #Now add in rules to affect DOCKER containers - uncomment if using Docker
+
  #Remove/comment this out and all references to the FILTERS chain if Docker isn't being used
 +
  #Restart Docker
 +
  echo "Restarting Docker"
 +
  systemctl restart docker
 +
 
 +
   #Now add in rules to affect DOCKER containers
 
   #See https://unrouted.io/2017/08/15/docker-firewall/
 
   #See https://unrouted.io/2017/08/15/docker-firewall/
−
   #iptables -F DOCKER-USER
+
   iptables -F DOCKER-USER
−
   #iptables -X DOCKER-USER
+
   iptables -X DOCKER-USER
−
   #iptables -N DOCKER-USER
+
   iptables -N DOCKER-USER
 
    
 
    
−
   #ip6tables -F DOCKER-USER
+
   iptables -F FILTERS
−
   #ip6tables -X DOCKER-USER
+
   iptables -X FILTERS
−
   #ip6tables -N DOCKER-USER
+
   iptables -N FILTERS
 
    
 
    
−
   #iptables -F FILTERS
+
   echo "all tables flushed and dropped"
−
  #iptables -X FILTERS
 
−
  #iptables -N FILTERS
 
−
 
 
−
  #ip6tables -F FILTERS
 
−
  #ip6tables -X FILTERS
 
−
  #ip6tables -N FILTERS
 
 
    
 
    
−
  echo "all tables flushed and dropped"
 
 
   # Specific chain used for logging packets before blocking them
 
   # Specific chain used for logging packets before blocking them
 
   iptables -A log-and-drop -j LOG --log-prefix "[IPTables] Drop "
 
   iptables -A log-and-drop -j LOG --log-prefix "[IPTables] Drop "
Line 406: Line 1,768:
 
    
 
    
 
   echo "logging chains setup"
 
   echo "logging chains setup"
−
   
+
 
 +
  #setup DOCKER-USER related rules- you will place all rules for Docker under the FILTERS chain
 +
  iptables -A DOCKER-USER -i $INET_IF -j FILTERS
 +
 
 +
  # Check if NEW incoming tcp connections are SYN, drop if not
 +
  iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
 +
  iptables -A FILTERS -p tcp ! --syn -m state --state NEW -j DROP
 +
 
 +
  #Drop fragmented packets
 +
  iptables -A INPUT -f -j DROP
 +
  iptables -A FILTERS -f -j DROP
 +
  iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
 +
  iptables -A FILTERS -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
 +
  iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
 +
  iptables -A FILTERS -p tcp --tcp-flags ALL ALL -j DROP
 +
 
 +
  # Drop incoming malformed XMAS packets
 +
  iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "[IPT-XMAX Pkts] "
 +
  iptables -A FILTERS -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "[IPT-XMAX Pkts] "
 +
  iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
 +
  iptables -A FILTERS -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
 +
 
 +
  #Drop all NULL pakcets
 +
  iptables -A INPUT -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "[IPT-NULL Pkts] "
 +
  iptables -A FILTERS -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "[IPT-NULL Pkts] "
 +
  iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
 +
  iptables -A FILTERS -p tcp --tcp-flags ALL NONE -j DROP
 +
  iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
 +
  iptables -A FILTERS -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
 +
 
 +
  #Drop FIN packet scans
 +
  iptables -A INPUT -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "[IPT-FIN Scan] "
 +
  iptables -A FILTERS -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "[IPT-FIN Scan] "
 +
  iptables -A INPUT -p tcp --tcp-flags FIN,ACK FIN -j DROP
 +
  iptables -A FILTERS -p tcp --tcp-flags FIN,ACK FIN -j DROP
 +
  iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
 +
  iptables -A FILTERS -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
 +
 
 +
  #Log and drop broadcast /multicast and invalid
 +
  iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG --log-prefix "[IPT-Broadcast] "
 +
  iptables -A INPUT -m pkttype --pkt-type broadcast -j DROP
 +
  iptables -A INPUT -m pkttype --pkt-type multicast -j LOG --log-prefix "i[IPT-Multicast] "
 +
  iptables -A INPUT -m pkttype --pkt-type multicast -j DROP
 +
  iptables -A INPUT -m state --state INVALID -j LOG --log-prefix "[IPT-Invalid] "
 +
  iptables -A FILTERS -m state --state INVALID -j LOG --log-prefix "[IPT-Invalid] "
 +
  iptables -A INPUT -m state --state INVALID -j DROP
 +
  iptables -A FILTERS -m state --state INVALID -j DROP
 +
 
 
   # The packets having the TCP flags activated are dropped
 
   # The packets having the TCP flags activated are dropped
 
   # and so for the ones with no flag at all (often used with Nmap scans)
 
   # and so for the ones with no flag at all (often used with Nmap scans)
 
   iptables -A FORWARD -p tcp --tcp-flags ALL ALL -j log-and-drop
 
   iptables -A FORWARD -p tcp --tcp-flags ALL ALL -j log-and-drop
 +
  iptables -A FILTERS -p tcp --tcp-flags ALL ALL -j log-and-drop
 
   iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j log-and-drop
 
   iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j log-and-drop
 +
  iptables -A FILTERS -p tcp --tcp-flags ALL NONE -j log-and-drop
 
    
 
    
 
   ip6tables -A FORWARD -p tcp --tcp-flags ALL ALL -j log-and-drop
 
   ip6tables -A FORWARD -p tcp --tcp-flags ALL ALL -j log-and-drop
 
   ip6tables -A FORWARD -p tcp --tcp-flags ALL NONE -j log-and-drop
 
   ip6tables -A FORWARD -p tcp --tcp-flags ALL NONE -j log-and-drop
 
    
 
    
−
  #setup DOCKER-USER related rules - uncomment if using Docker
+
   #limit traffic to 80 an 443 - Change chain from INPUT to FILTERS to Docker and don't forget to open below
−
  #iptables -A DOCKER-USER -i $INET_IF -j FILTERS
 
−
 
 
−
  #Now add any rules you want Docker to abide by for containers to -A FILTERS
 
−
 
 
−
   #limit traffic to 80 an 443
 
 
   #DCQ="2"  #max requests in 1 second
 
   #DCQ="2"  #max requests in 1 second
 
   #DCH="25"  #max requests over 7 seconds
 
   #DCH="25"  #max requests over 7 seconds
 
    
 
    
−
   #iptables -A FILTERS -p tcp --dport 80 -m state --state NEW -m recent --set --name P80QF --rsource
+
   #iptables -A INPUT-p tcp --dport 80 -m state --state NEW -m recent --set --name P80QF --rsource
−
   #iptables -A FILTERS -p tcp --dport 80 -m state --state NEW -m recent --update --second 1 --hitcount ${DCQ} --name P80QF --rsource -j log-and-drop
+
   #iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --update --second 1 --hitcount ${DCQ} --name P80QF --rsource -j log-and-drop
−
   #iptables -A FILTERS -p tcp --dport 80 -m state --state NEW -m recent --set --name P80HF --rsource
+
   #iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --set --name P80HF --rsource
−
   #iptables -A FILTERS -p tcp --dport 80 -m state --state NEW -m recent --update --second 7 --hitcount ${DCH} --name P80HF --rsource -j log-and-drop
+
   #iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --update --second 7 --hitcount ${DCH} --name P80HF --rsource -j log-and-drop
 
    
 
    
−
   #iptables -A FILTERS -p tcp --dport 443 -m state --state NEW -m recent --set --name P443QF --rsource
+
   #iptables -A INPUT -p tcp --dport 443 -m state --state NEW -m recent --set --name P443QF --rsource
−
   #iptables -A FILTERS -p tcp --dport 443 -m state --state NEW -m recent --update --second 1 --hitcount ${DCQ} --name P443QF --rsource -j log-and-drop
+
   #iptables -A INPUT -p tcp --dport 443 -m state --state NEW -m recent --update --second 1 --hitcount ${DCQ} --name P443QF --rsource -j log-and-drop
−
   #iptables -A FILTERS -p tcp --dport 443 -m state --state NEW -m recent --set --name P443HF --rsource
+
   #iptables -A INPUT -p tcp --dport 443 -m state --state NEW -m recent --set --name P443HF --rsource
−
   #iptables -A FILTERS -p tcp --dport 443 -m state --state NEW -m recent --update --second 7 --hitcount ${DCH} --name P443HF --rsource -j log-and-drop
+
   #iptables -A INPUT -p tcp --dport 443 -m state --state NEW -m recent --update --second 7 --hitcount ${DCH} --name P443HF --rsource -j log-and-drop
 
      
 
      
−
   #default return chain
+
   #default return chain for Docker- skipped.  Enable if needed
 
   #iptables -A FILTERS -j RETURN
 
   #iptables -A FILTERS -j RETURN
 
    
 
    
Line 441: Line 1,847:
 
    
 
    
 
   #Limit DNS requests to prevent flood attacks - use if you are running a DNS server on the system this is installed on.   
 
   #Limit DNS requests to prevent flood attacks - use if you are running a DNS server on the system this is installed on.   
 +
  #Don't forget to allow in the rules below
 
   # Requests per second
 
   # Requests per second
 
   #RQS="15"
 
   #RQS="15"
Line 466: Line 1,873:
 
   # this is needed to allow all ipsec packets when it's host to host
 
   # this is needed to allow all ipsec packets when it's host to host
 
   #iptables -A INPUT -m policy --dir in --pol ipsec -j ACCEPT --src "$IPSECsrc"  
 
   #iptables -A INPUT -m policy --dir in --pol ipsec -j ACCEPT --src "$IPSECsrc"  
−
 
 
−
  #allow DNS in
 
−
  #iptables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 53
 
−
  #iptables -t filter -A INPUT -j ACCEPT --protocol udp --dport 53
 
−
 
 
−
  #ip6tables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 53
 
−
  #ip6tables -t filter -A INPUT -j ACCEPT --protocol udp --dport 53
 
 
    
 
    
 
   #allow port 80 in
 
   #allow port 80 in
 
   #iptables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 80
 
   #iptables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 80
 +
  #iptables -t filter -A FILTERS -j ACCEPT --protocol tcp --dport 80
 
   #ip6tables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 80
 
   #ip6tables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 80
 
    
 
    
 
   #allow port 443 in
 
   #allow port 443 in
 
   #iptables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 443
 
   #iptables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 443
 +
  #iptables -t filter -A FILTERS -j ACCEPT --protocol tcp --dport 443
 
   #ip6tables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 443
 
   #ip6tables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 443
 
    
 
    
−
   # allow all ssh in - uncomment ManagemetnFilterV4 and comment out the two lines below to restrict SSH access on port 22
+
   # allow all ssh in - uncomment ManagementFilterV4 and comment out the lines below it to restrict SSH access on port 22
 
   #iptables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 22 --src $ManagementFilterV4
 
   #iptables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 22 --src $ManagementFilterV4
 
   iptables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 22  
 
   iptables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 22  
−
   ip6tables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 22  
+
 
 +
  #uncomment ManagementFilterV6 and commentout the line below it to restruct SSH for IPv6 on port 22
 +
  #ip6tables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 22 --src ManagementFilterV6
 +
   ip6tables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 22
 
    
 
    
 
   echo "end of services"
 
   echo "end of services"
Line 525: Line 1,930:
 
   echo "2" >$i
 
   echo "2" >$i
 
   done
 
   done
 +
 
 
   # setup a default deny rule for outside traffic
 
   # setup a default deny rule for outside traffic
 
   iptables -t filter -A INPUT --in-interface $INET_IF -j log-and-drop
 
   iptables -t filter -A INPUT --in-interface $INET_IF -j log-and-drop
 +
  iptables -t filter -A FILTERS --in-interface $INET_IF -j log-and-drop
 
   ip6tables -t filter -A INPUT --in-interface $INET_IF -j log-and-drop
 
   ip6tables -t filter -A INPUT --in-interface $INET_IF -j log-and-drop
−
 
+
   
−
  #uncomment if you are using Docker
 
−
  #echo "Restarting Docker"
 
−
  #systemctl restart docker
 
−
 
 
 
   #uncomment the next two lines if fail2ban is installed
 
   #uncomment the next two lines if fail2ban is installed
 
   #echo "Restarting fail2ban"
 
   #echo "Restarting fail2ban"

Latest revision as of 01:16, 23 February 2024

VPN
Cyber-security-4072712 1920.jpg
VPN Security
This document is a work in progress and is still being updated by the author.

The following contains information on how to setup a Virtual Private Network (VPN) connection using various popular software packages and hardware devices.

IPSEC

Information on how to setup IPSEC tunnels.

strongSwan to strongSwan

Use the following config for a strongSwan[1] to strongSwan configuration. Make sure the left and right IP addresses are updated to match each system. You can use the same ipsec.secrets file on both systems without changing the IP address order, although I recommend changing it to having the local IP on the left and the remote on the right as shown below.

ipsec.conf

/sec/ipsec/conf: 

  conn <name>
            authby=secret
            auto=route        # can also be start
            keyexchange=ike
            left=<your local IP>
            right=<remote IP of Mikrotik system>
            leftikeport=500
            rightikeport=500
            type=transport
            esp=aes128gcm16!
            dpddelay=5
            dpdtimeout=20
            dpdaction=clear   # can also be restart

ipsec.secrets

/etc/ipsec.secrets: 

   <your local IP> <remote IP of Mikrotik system> :  PSK "<Put your preshared key here>"

strongSwan to MikroTik

Use the following configurations to connect a system running strongSwan to a MikroTik[2] device using IPSEC.

strongSwan config

The following configuration will work on FreeBSD or Linux systems with strongSwan installed.

ipsec.conf

/etc/ipsec.conf: 

  conn <name>
            authby=secret
            auto=route
            keyexchange=ike
            left=<your local IP>
            right=<remote IP of Mikrotik system>
            leftikeport=500
            rightikeport=500
            type=transport
            ike=aes256-sha1-modp1024!
            esp=aes256-sha1!
            dpddelay=5
            dpdtimeout=20
            dpdaction=clear
ipsec.secrets

/etc/ipsec.secrets: 

   <your local IP> <remote IP of Mikrotik system> :  PSK "<Put your preshared key here>"

MikroTik Config

   [top]

The following config is best done from the terminal on a MikroTik device.

Note: You can use the following config to connect two MikroTik systems. Just replicate the config below on each system you wish to connect. 

 /ip ipsec policy
 add src-address=0.0.0.0/0 dst-address=<remote IP of strongswan system> proposal=ike2 ipsec-protocols=esp
 
 /ip ipsec proposal
 add name="ike2" auth-algorithms=sha256,sha1 enc-algorithms=aes-256-cbc,aes-128-cbc lifetime=30m pfs-group=none
 
 /ip ipsec peer
 add name="<name of strongswan system>" address=<local IP> profile=ike2 exchange-mode=main send-initial-contact=yes
 
 /ip ipsec identity
 add peer=<remote IP of strongswan system> auth-method=pre-shared-key secret="<Put your preshared key here>" generate-policy=no
 
 /ip ipsec profile
 add name="ike2" hash-algorithm=sha1 enc-algorithm=aes-256,aes-192,aes-128,3des,des dh-group=modp2048,modp1024 lifetime=8h proposal-check=obey nat-traversal=no dpd-interval=2m dpd-maximum-failures=5

strongSwan to Cisco - IKEv1

Cisco IOS Config

  crypto isakmp policy 10
   encr aes
   authentication pre-share
   group 5
  crypto isakmp key cisco address 172.16.10.2    
  
  crypto ipsec transform-set TS esp-aes esp-sha-hmac 
   mode tunnel
 
  crypto map cmap 10 ipsec-isakmp 
   set peer 172.16.10.2
   set transform-set TS 
   match address cryptoacl
  
  interface Ethernet0/1
   ip address 192.168.1.1 255.255.255.0
  
  interface Ethernet0/0
   ip address 172.16.10.1 255.255.255.0
   crypto map cmap
  
  ip access-list extended cryptoacl
   permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

strongSwan Config

ipsec.conf

/etc/ipsec.conf: 

  config setup
          # strictcrlpolicy=yes
          # uniqueids = no
  
  conn %default
          ikelifetime=1440m
          keylife=60m
          rekeymargin=3m
          keyingtries=1
          keyexchange=ikev1
          authby=secret
  
  conn ciscoios
          left=172.16.10.2                  #strongswan outside address
          leftsubnet=192.168.2.0/24         #network behind strongswan
          leftid=172.16.10.2                #IKEID sent by strongswan
          leftfirewall=yes
          right=172.16.10.1                 #IOS outside address
          rightsubnet=192.168.1.0/24        #network behind IOS
          rightid=172.16.10.1               #IKEID sent by IOS
          auto=add
          ike=aes128-md5-modp1536           #P1: modp1536 = DH group 5
          esp=aes128-sha1                   #P2
ipsec.secrets

/etc/ipsec.secrets: 

  172.16.10.2 172.16.10.1 : PSK cisco

strongSwan to Cisco - IKEv2

Source: [[10]]

Cisco IOS Config

  crypto ikev2 proposal ikev2proposal 
   encryption aes-cbc-128
   integrity sha1
   group 5
  
  crypto ikev2 policy ikev2policy 
   match fvrf any
   proposal ikev2proposal
  
  crypto ikev2 keyring keys
   peer strongswan
    address 172.16.10.2
    pre-shared-key local cisco
    pre-shared-key remote cisco
   
  crypto ikev2 profile ikev2profile
   match identity remote address 172.16.10.2 255.255.255.255 
   authentication remote pre-share
   authentication local pre-share
   keyring local keys
  
  crypto ipsec transform-set TS esp-aes esp-sha-hmac 
   mode tunnel
  
  crypto map cmap 10 ipsec-isakmp 
   set peer 172.16.10.2
   set transform-set TS 
   set ikev2-profile ikev2profile
   match address cryptoacl
  
  interface Ethernet0/1
   ip address 192.168.1.1 255.255.255.0
  
  interface Ethernet0/0
   ip address 172.16.10.1 255.255.255.0
   crypto map cmap
   
  ip access-list extended cryptoacl
   permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

strongSwan Config

ipsec.conf

/etc/ipsec.conf: 

  config setup
          # strictcrlpolicy=yes
          # uniqueids = no
  
  conn %default
          ikelifetime=1440m
          keylife=60m
          rekeymargin=3m
          keyingtries=1
          keyexchange=ikev1
          authby=secret
  
  conn ciscoios
          left=172.16.10.2
          leftsubnet=192.168.2.0/24
          leftid=172.16.10.2
          leftfirewall=yes
          right=172.16.10.1
          rightsubnet=192.168.1.0/24
          rightid=172.16.10.1
          auto=add
          ike=aes128-sha1-modp1536
          esp=aes128-sha1
          keyexchange=ikev2
ipsec.secrets

/etc/ipsec.secrets: 

  172.16.10.2 : PSK "cisco"
  172.16.10.1 : PSK "cisco"

PPTP

   [top]

Persistent SSH Tunnels

The following is how to create a persistent SSH Tunnel between two systems. This is handy if you want to secure data flowing across networks, or even setup a tunnel without messing with VPN configuration.

Create User/Generate SSH key

First you will create the user you will use for the tunnel. This will allow you to forward non-privileged ports over 1024.

Note: This user does not have a password assigned or a shell. This will prevent user logins to the system. 

useradd -m -s /bin/false autossh

Now switch to the user and generate an SSH key: 

su -s /bin/bash autossh
cd ~
ssh-keygen -b 4096

Note: Leave password blank

Once done, exit back to your normal user shell 

exit

Copy public key to target system

You will need to copy id_rsa.pub file from /home/autossh/.ssh/ to the authorized_keys file on the remote system you want to connect to for the tunnel.

Note: It is recommended that you also create a normal user on the remote system and not use root.

Install autossh

You will need to install the autossh program on the system that will initiate the SSH tunnel. Autossh automatically restarts the SSH tunnel when it exits. 

apt-get install autossh

Setup script

Copy the following script, making the necessary changes as specified between the <> and place on the system that will initiate the tunnel (here we will save it as /opt/ssh-tunnel.sh): 

#!/bin/sh
#

su -s /bin/sh autossh -c 'autossh -M 0 -N -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -o "ExitOnForwardFailure=yes" -f -T -R localhost:<target port>:<local IP or localhost>:<local port> <user>@<domain>'
Parameter Description
localhost localhost or IP address on target system
<target port> port on target system
<local IP or localhost> localhost or IP address on system initiating tunnel
<local port> port on system initiating tunnel
<user@domain> username and domain to use when SSHing to target system

An example of this command is: 

su -s /bin/sh autossh -c 'autossh -M 0 -N -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -o "ExitOnForwardFailure=yes" -f -T -R localhost:3306:localhost:3306 joe@blow.com'

This would allow the target (remote) system to access the local (system initiating the SSH tunnel) system's MySQL server over the tunnel.

You can also use -L to change the direction of the port forwarding from Remote to Local and have the initiating system forward data over the tunnel the the remote.

Make script executable

Make sure you mark the script as executable with: 

chmod +x /opt/ssh-tunnel.sh

Tunnel at startup

To have the tunnel up when the system restarts, choose one of the following methods

rc.local

Add a line to /etc/rc.local that calls the script. 

# Start AutoSSH tunnel at boot
/opt/ssh-tunnel.sh

Note: You may have to enable rc.local on Ubuntu and Debian based systems via systemd. Refer to your distributions documentation for information on how to enable it.

systemd

To have the script start at boot with systemd, create the following file and add it to /etc/systemd/system/ssh-tunnel.service

ssh-tunnel.service
[Unit]
Description=AutoSSH Tunnel at boot

[Service]
Type=oneshot
ExecStart=/opt/ssh-tunnel.sh

[Install]
WantedBy=multi-user.target
Enable service

To enable the service to run via systemd run: 

systemctl enable ssh-tunnel.service

GRE Tunnel

   [top]

GRE Tunnels

Public/Private VM tunnel

GRE tunnels are useful for connecting a VM in a private/home network to the internet via a public server/VM. The following information will connect Server A (public server) to Server B (private server), and allow requests to Server B to be passed to Server A's resources for use on the Internet.

Configuration

IP addresses

  • Server A will have a public IP of 30.30.30.30/24 and the GRE interface will be assigned 192.168.168.1/30
  • Server B will have a private IP of 10.0.0.50/24, a public IP of 40.40.40.40/24 and the GRE interface will be assigned 192.168.168.2/30

Ports

  • Ports 22, 80 and 443 will be forwarded over the GRE tunnel
Server A (Public)

Copy the following to /etc/gre.sh 

#!/bin/sh
ip tunnel add gre1 mode gre local 10.0.0.50 remote 40.40.40.40 ttl 255
ip add add 192.168.168.1/30 dev gre1
ip link set gre1 up

iptables -t nat -A POSTROUTING -s 192.168.168.0/30 ! -o gre+ -j SNAT --to-source 30.30.30.30
iptables -A FORWARD -d 192.168.168.2 -m state --state NEW.ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -d 192.168.168.2 -m state --state NEW.ESTABLISHED,RELATED -j ACCEPT

iptables -t nat -A PREROUTING -d 30.30.30.30 -p tcp -m tcp --dport 22 -j DNAT --to-destination 192.168.168.2
iptables -t nat -A PREROUTING -d 30.30.30.30 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.168.2
iptables -t nat -A PREROUTING -d 30.30.30.30 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.168.2
Server B (Private)
  • Add the following to /etc/iproute2/rt_tables
    100 GRE
  • Copy the following to /etc/gre.sh
#!/bin/sh
iptunnel add gre1 mode gre local 10.0.0.50 remote 30.30.30.30 ttl 255
ip addr add 192.168.168.2/30 dev gre1
ip link set gre1 up

ip rule add from 192.168.168.0/30 table GRE
ip route add default via 192.168.168.1 table GRE

L2TP Ethernet Pseudowires

   [top]

Cisco

The following configuration will setup L2TPv3 between two Cisco Routers - R1 and R2.

R1 - Router Config

pseudowire-class test
encapsulation l2tpv3
ip local interface Loopback0
ip pmtu
ip tos value 10
!
!
interface Loopback0
ip address 1.1.1.1 255.255.255.255
!
interface FastEthernet0/0.1
encapsulation dot1Q 5
xconnect 2.2.2.2 1 encapsulation l2tpv3 pw-class test
!
interface FastEthernet0/0.2
encapsulation dot1Q 2
xconnect 2.2.2.2 2 encapsulation l2tpv3 pw-class test

R2 - Router Config

pseudowire-class test
encapsulation l2tpv3
ip local interface Loopback0
ip pmtu
ip tos value 10
!
!
interface Loopback0
ip address 2.2.2.2 255.255.255.255
!
!
interface FastEthernet0/1.1
encapsulation dot1Q 5
xconnect 1.1.1.1 1 encapsulation l2tpv3 pw-class test
!
interface FastEthernet0/1.2
encapsulation dot1Q 2
xconnect 1.1.1.1 2 encapsulation l2tpv3 pw-class test

Linux

Create an L2TP ethernet pseudowires connection using the Linux kernel's L2TP drivers along with the ip utility.

Note: This setup does not have any security. You will need to route it over IPSEC to create a secure connection.

In this example we use separate systems to establish the tunnels across the Gateway (which represents the Internet).

Topology

L2TP Tunnel Topology
System Network
Gateway eth1: 1.1.1.1/30; eth2: 2.2.2.1.30
Tunnel1 eth1/l2tpeth0 (bridged); eth1: No IP configured; eth2: 1.1.1.2/30
Tunnel2 eth1/l2tpeth0 (bridged); eth1: No IP configured; eth2: 2.2.2.2/30

Configuration

  • Enable IP forwarding on Gateway, Tunnel1 and Tunnel2 systems by running this command on each:
 # echo 1 > /proc/sys/net/ipv4/ip_forward
  • Establish L3 connectivity between Tunnel1 and Tunnel2 systems:

On Tunnel1 run: 

# ip route add 2.2.2.0/30 via 1.1.1.1

On Tunnel2 run: 

# ip route add 1.1.1.0/30 via 2.2.2.1

Check to make sure both sides can ping each other: 

#tunnel1:~# ping -c1 2.2.2.2

PING 2.2.2.2 (2.2.2.2) 56(84) bytes of data.
64 bytes from 2.2.2.2: icmp_req=1 ttl=63 time=1.03 ms

#tunnel2:~# ping -c1 1.1.1.2

PING 1.1.1.2 (1.1.1.2) 56(84) bytes of data.
64 bytes from 1.1.1.2: icmp_req=1 ttl=63 time=1.20 ms
  • Load L2TPv3 ethernet pseudowire module on Tunnel1 and Tunnel2 systems:
# modprobe l2tp_eth
  • Configure l2tp interface on Tunnel1:
# ip l2tp add tunnel tunnel_id 1000 peer_tunnel_id 2000 encap udp local 1.1.1.2 remote 2.2.2.2 udp_sport 6000 udp_dport 5000
# ip l2tp add session tunnel_id 1000 session_id 3000 peer_session_id 4000
  • Check configuration of tunnel on Tunnel1 system:
# ip l2tp show tunnel

Tunnel 1000, encap UDP
  From 1.1.1.2 to 2.2.2.2
  Peer tunnel 2000
  UDP source / dest ports: 6000/5000
  UDP checksum: disabled

# ip l2tp show session

Session 3000 in tunnel 1000
  Peer session 4000, tunnel 2000
  interface name: l2tpeth0
  offset 0, peer offset 0
  • Configure l2tp interface on Tunnel2:
# ip l2tp add tunnel tunnel_id 2000 peer_tunnel_id 1000 encap udp local 2.2.2.2 remote 1.1.1.2 udp_sport 5000 udp_dport 6000
# ip l2tp add session tunnel_id 2000 session_id 4000 peer_session_id 3000
  • Check configuration of tunnel on Tunnel2 system:
# ip l2tp show tunnel

Tunnel 2000, encap UDP
  From 2.2.2.2 to 1.1.1.2
  Peer tunnel 1000
  UDP source / dest ports: 5000/6000
  UDP checksum: disabled

# ip l2tp show session

Session 4000 in tunnel 2000
  Peer session 3000, tunnel 1000
  interface name: l2tpeth0
  offset 0, peer offset 0
  • Check MTU of newly created interfaces
# ip a s dev l2tpeth0

l2tpeth0: <BROADCAST,MULTICAST> mtu 1488 qdisc noop state DOWN qlen 1000
    link/ether 1a:8f:6e:04:3f:a3 brd ff:ff:ff:ff:ff:ff
  • Adjust MTU and enforce MSS on eth1 on both Tunnel1 and Tunnel2 systems to prevent fragmentation that can cause issues:
# ip link set eth1 mtu 1446
# iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1406:1536 -j TCPMSS --set-mss 1406
  • Install bridge-utils on Tunnel1 and Tunnel2 systems:
# apt-get install bridge-utils
  • Bridge the L2TP interface to eth1 on both the Tunnel1 and Tunnel2 systems so that is can communicate over the network:
# brctl addbr l2tp
# brctl addif l2tp eth1 l2tpeth0
  • Check bridge configuration on Tunnel1 and Tunnel2 systems:
# brctl show

bridge name	        bridge id	    STP enabled	     interfaces
l2tp		        8000.1a8f6e043fa3   no	             eth1 l2tpeth0
  • Turn up the new l2tpeth0 interface on Tunnel1 and Tunnel2 systems so that it can be used:
# ip l set dev l2tpeth0 up
# ip l set dev l2tp up

Assuming you've done everything correctly here, you should now be able to use the Tunnel1 and Tunnel2 systems to send traffic over the same subnet on each side.

Example:

  • Using the setup above, assume you have two additional systems setup.
    • Computer1 is connected to Tunnel1. No gateway set (not needed for an L2 link).
    • Computer1 has eth1 configured with 192.168.0.3/24
    • Computer2 is connected to Tunnel2. No gateway set (not needed for an L2 link).
    • Computer 2 has eth1 configured wtih 192.168.0.4/24
  • Do a ping test to make sure Computer1 can talk to Computer2 through the l2tp link:
# ping -c5 192.168.0.4

64 bytes from 192.168.0.4: icmp_req=1 ttl=64 time=3.85 ms
64 bytes from 192.168.0.4: icmp_req=2 ttl=64 time=1.93 ms
64 bytes from 192.168.0.4: icmp_req=3 ttl=64 time=1.91 ms
64 bytes from 192.168.0.4: icmp_req=4 ttl=64 time=1.87 ms
64 bytes from 192.168.0.4: icmp_req=5 ttl=64 time=1.89 ms
  • Successful output means that Computer1 can talk to Computer2 over the l2tp link since you're created a L2 link between each system. Both computers act as if they are on the same local network segment, unaware of the L2TP connection over the Gateway via the Tunnels.

The path that data will travel is: 

Computer1 -> Tunnel1 -> Gateway -> Tunnel2 -> Computer2
Computer1 <- Tunnel1 <- Gateway -< Tunnel2 -< Computer2

NOTE: THERE IS NO ENCRYPTION WITH AN L2TP TUNNEL. ALL LAYER 2 DATA THAT IS VISIBLE TO EACH SIDE OF THE TUNNEL WILL NORMALLY BE SENT OVER THE LINK AND BE SEEN BY THE OTHER SIDE.

Between Cisco and Linux

   [top]

You can use L2TPv3 between Cisco and Linux utilizing the following script from Leif Sawyer.

This script will bring up the Linux side of the connection and generate the Cisco side config.

Configuration

  • Edit the variables TUNNEL_ID, SESSION_ID, LOCAL, and REMOTE to values that are suitable for your environment.

Commands

  • Start the tunnel with l2tpv3-cisco.sh start
  • Stop the tunnel with l2tpv3-cisco.sh stop
  • Restart the tunnel with l2tpv3-cisco.sh restart
  • Generate Cisco config with l2tpv3-cisco.sh config

l2tpv3-cisco.sh

  #!/bin/bash
  # (c) 2020 Leif Sawyer
  # License: GPL 3.0 (see https://github.com/akhepcat/)
  # Permanent home:  https://github.com/akhepcat/Miscellaneous/
  # Direct download: https://raw.githubusercontent.com/akhepcat/Miscellaneous/master/l2tpv3-cisco.sh
  # 
  # using l2tpV3 between linux and cisco is sometimes weird.
  # this script is how I get the linux side up.
  # This will also auto-generate the cisco-side config.
  ################################
  
  TUNNEL_ID=101
  REMOTE_TUNNEL_ID=${TUNNEL_ID}
  
  SESSION_ID=101
  REMOTE_SESSION_ID=${SESSION_ID}
  
  LOCAL=10.1.1.1
  REMOTE=10.100.100.1
  
  ################################
  PATH=/sbin:$PATH
  IPV=$(ip -V | sed 's/.*-ss//')
  
  if [ ${IPV:-0} -lt 130716 ]
  then
  	echo "Please install a newer version of iproute2 ( 3.10 or (>= 2013-07-16))"
  	echo "  from https://www.kernel.org/pub/linux/utils/net/iproute2/"
 	exit
  fi
  
  
  modules() {
   	for module in l2tp_core l2tp_netlink l2tp_eth l2tp_ip
  	do
  		modprobe $i
  	done
  }
  	
  tunnel_up() {
  	ip l2tp add tunnel remote ${REMOTE} local ${LOCAL} tunnel_id $TUNNEL_ID peer_tunnel_id $REMOTE_TUNNEL_ID encap ip
  	ip l2tp add session tunnel_id $TUNNEL_ID session_id $SESSION_ID peer_session_id $REMOTE_SESSION_ID l2spec_type none
  	ip link set l2tpeth0 up mtu 1488
  	iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1448:1536 -j TCPMSS --set-mss 1448
  }
  
  tunnel_down() {
  	iptables -D FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1448:1536 -j TCPMSS --set-mss 1448
  	ip link set l2tpeth0 down
  	ip l2tp del session tunnel_id $TUNNEL_ID session_id $SESSION_ID
 	ip l2tp del tunnel tunnel_id $TUNNEL_ID
  }
  
  cisco_config() {
  cat <<EOF
  ! Global config
  !
      pseudowire-class Linux-L2TP
  	encapsulation l2tpv3
  	interworking ethernet
  	protocol none
 	ip local interface $REMOTE
  	ip pmtu
  	ip tos value 41
  	ip ttl 100
  !
  ! Interface config
  !
      interface \$L2interface
  	xconnect $LOCAL $REMOTE_TUNNEL_ID encapsulation l2tpv3 manual pw-class Linux-L2TP
  	    l2tp id $SESSION_ID $REMOTE_SESSION_ID
  
  EOF
  }
  
  case $1 in
  	start|up) tunnel_up
  	;;
  	stop|down) tunnel_down
  	;;
  	restart|reload) stop; start
  	;;
  	config|cisco|cisco-config) cisco_config
  	;;
  	*) echo "$0  (start|up || stop|down || restart|reload || config|cisco|cisco-config)"
  	;;
  esac

OpenVPN

   [top]

Information on OpenVPN is available from https://openvpn.org/[3]

Road Warrior Install

"In business travel, a road warrior is a person that uses mobile devices such as tablet, laptop, smartphone and internet connectivity while traveling to conduct business. The term has often been used with regard to salespeople who travel often and who seldom are in the office. Today it is used for anyone who works outside the office and travels for business." [4]

This will walk you through setting up the OpenVPN Road Warrior install for Ubuntu, Debian, CentOS and Fedora.

Installation

  • Run the script and follow the on-screen prompts:
   wget https://git.io/vpn -O openvpn-install.sh && bash openvpn-install.sh
  • Example install using the defaults (installed on Ubuntu 20.04.2 LTS VM):
  Welcome to this OpenVPN road warrior installer!
  
  Which protocol should OpenVPN use?
     1) UDP (recommended)
     2) TCP
  Protocol [1]: 
  
  What port should OpenVPN listen to?
  Port [1194]: 
  
  Select a DNS server for the clients:
     1) Current system resolvers
     2) Google
     3) 1.1.1.1
     4) OpenDNS
     5) Quad9
     6) AdGuard
  DNS server [1]: 
  
  Enter a name for the first client:
  Name [client]: 
  
  OpenVPN installation is ready to begin.
  Press any key to continue...
  
  Get:1 http://security.ubuntu.com/ubuntu focal-security InRelease [114 kB]
  Hit:2 http://us.archive.ubuntu.com/ubuntu focal InRelease
  Get:3 http://us.archive.ubuntu.com/ubuntu focal-updates InRelease [114 kB]
  Get:4 http://us.archive.ubuntu.com/ubuntu focal-backports InRelease [101 kB]
  Fetched 328 kB in 1s (488 kB/s)   
  Reading package lists... Done
  Reading package lists... Done
  Building dependency tree       
  Reading state information... Done
  ca-certificates is already the newest version (20210119~20.04.1).
  openssl is already the newest version (1.1.1f-1ubuntu2.4).
  Suggested packages:
    resolvconf openvpn-systemd-resolved easy-rsa
  The following NEW packages will be installed:
    openvpn
  0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
  Need to get 0 B/477 kB of archives.
  After this operation, 1,188 kB of additional disk space will be used.
  Preconfiguring packages ...
  Selecting previously unselected package openvpn.
  (Reading database ... 109259 files and directories currently installed.)
  Preparing to unpack .../openvpn_2.4.7-1ubuntu2.20.04.2_amd64.deb ...
  Unpacking openvpn (2.4.7-1ubuntu2.20.04.2) ...
  Setting up openvpn (2.4.7-1ubuntu2.20.04.2) ...
   * Restarting virtual private network daemon.                       [ OK ] 
  Created symlink /etc/systemd/system/multi-user.target.wants/openvpn.service → /lib/systemd/system/openvpn.service.
  Processing triggers for man-db (2.9.1-1) ...
  Processing triggers for systemd (245.4-4ubuntu3.7) ...
  
  init-pki complete; you may now create a CA or requests.
  Your newly created PKI dir is: /etc/openvpn/server/easy-rsa/pki
  
  
  Using SSL: openssl OpenSSL 1.1.1f  31 Mar 2020
  Generating RSA private key, 2048 bit long modulus (2 primes)
  ......+++++
  ...................+++++
  e is 65537 (0x010001)
  
  Using SSL: openssl OpenSSL 1.1.1f  31 Mar 2020
  Generating a RSA private key
  ..........................................................................................................................................+++++
  ....+++++
  writing new private key to '/etc/openvpn/server/easy-rsa/pki/easy-rsa-2749.6tj7Mb/tmp.fSqcnR'
  -----
  Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-2749.6tj7Mb/tmp.TS5dnM
  Check that the request matches the signature
  Signature ok
  The Subject's Distinguished Name is as follows
  commonName            :ASN.1 12:'server'
  Certificate is to be certified until Jul 10 05:27:40 2031 GMT (3650 days)
  
  Write out database with 1 new entries
  Data Base Updated
  
  Using SSL: openssl OpenSSL 1.1.1f  31 Mar 2020
  Generating a RSA private key
  ............................+++++
  ..............+++++
  writing new private key to '/etc/openvpn/server/easy-rsa/pki/easy-rsa-2824.Fx4J3A/tmp.tlGKns'
  -----
  Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-2824.Fx4J3A/tmp.dVVyTl
  Check that the request matches the signature
  Signature ok
  The Subject's Distinguished Name is as follows
  commonName            :ASN.1 12:'client'
  Certificate is to be certified until Jul 10 05:27:40 2031 GMT (3650 days)
  
  Write out database with 1 new entries
  Data Base Updated
  
  Using SSL: openssl OpenSSL 1.1.1f  31 Mar 2020
  Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-2880.kL0wa3/tmp.uyyWGn
  
  An updated CRL has been created.
  CRL file: /etc/openvpn/server/easy-rsa/pki/crl.pem
  
  
  Created symlink /etc/systemd/system/multi-user.target.wants/openvpn-iptables.service → /etc/systemd/system/openvpn-iptables.service.
  Created symlink /etc/systemd/system/multi-user.target.wants/openvpn-server@server.service → /lib/systemd/system/openvpn-server@.service.
  
  Finished!
  
  The client configuration is available in: /root/client.ovpn
  New clients can be added by running this script again.

Add a user

To add a new user, run the openvpn-install.sh script again and select option 1 - Add a new client 

  # bash openvpn-install.sh

  OpenVPN is already installed.
  
  Select an option:
     1) Add a new client
     2) Revoke an existing client
     3) Remove OpenVPN
     4) Exit
  Option: 1
  • You will be prompted for a name, in this example we use client2
  Provide a name for the client:
  Name: client2
  Using SSL: openssl OpenSSL 1.1.1f  31 Mar 2020
  Generating a RSA private key
  ....................................................+++++
  ....+++++
  writing new private key to '/etc/openvpn/server/easy-rsa/pki/easy-rsa-4310.cmbMtC/tmp.MMKA2C'
  -----
  Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-4310.cmbMtC/tmp.l84eev
  Check that the request matches the signature
  Signature ok
  The Subject's Distinguished Name is as follows
  commonName            :ASN.1 12:'client2'
  Certificate is to be certified until Jul 10 05:41:10 2031 GMT (3650 days)
  
  Write out database with 1 new entries
  Data Base Updated
  
  
  client2 added. Configuration available in: /root/client2.ovpn
  • Copy the configuration file above to your client to use it with OpenVPN

Remove a user

To add a remove a user, run the openvpn-install.sh script again and select option 2 - Revoke an existing client 

  # bash openvpn-install.sh

  OpenVPN is already installed.
  
  Select an option:
     1) Add a new client
     2) Revoke an existing client
     3) Remove OpenVPN
     4) Exit
  Option: 2
  • You will be presented with a list of configured users to remove. We will choose client2 for this example.
  Select the client to revoke:
       1) client
       2) client2
  Client: 2
  
  Confirm client2 revocation? [y/N]: Y
  Using SSL: openssl OpenSSL 1.1.1f  31 Mar 2020
  Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-4407.i66z91/tmp.iS3gWM
  Revoking Certificate 05D02E0DF2A242398233588721BB75E0.
  Data Base Updated
  
  Using SSL: openssl OpenSSL 1.1.1f  31 Mar 2020
  Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-4444.LpkzMp/tmp.03Azaw
  
  An updated CRL has been created.
  CRL file: /etc/openvpn/server/easy-rsa/pki/crl.pem
  
  
  
  client2 revoked!

Uninstall

  • To uninstall, run the openvpn-install.sh script again and select option 3 - Remove OpenVPN
  Confirm OpenVPN removal? [y/N]:
  • When prompted answer Y to start the removal
  Removed /etc/systemd/system/multi-user.target.wants/openvpn-iptables.service.
  Removed /etc/systemd/system/multi-user.target.wants/openvpn-server@server.service.
  Reading package lists... Done
  Building dependency tree       
  Reading state information... Done
  The following package was automatically installed and is no longer required:
    libpkcs11-helper1
  Use 'apt autoremove' to remove it.
  The following packages will be REMOVED:
    openvpn*
  0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded.
  After this operation, 1,188 kB disk space will be freed.
  (Reading database ... 109344 files and directories currently installed.)
  Removing openvpn (2.4.7-1ubuntu2.20.04.2) ...
  Processing triggers for man-db (2.9.1-1) ...
  (Reading database ... 109265 files and directories currently installed.)
  Purging configuration files for openvpn (2.4.7-1ubuntu2.20.04.2) ...
  Processing triggers for systemd (245.4-4ubuntu3.7) ...
  
  OpenVPN removed!

TINC

   [top]

Tinc is an open-source, self-routing, mesh networking protocol, used for compressed, encrypted, virtual private networks.

Tinc is available for FreeBSD, OpenBSD, NetBSD, Dragonfly BSD, Mac OS X, Linux, Microsoft Windows, Solaris, IOS (jailbroken only), and Android with full support for IPv6.

You can download tinc for *nix and Windows systems from https://www.tinc-vpn.org/[5]

The tinc website includes many examples on common setups. They can be found at https://www.tinc-vpn.org/examples/

Standard tinc setup

Tinc can be setup in a mesh network with multiple systems.

Note: You can setup tinc with just two systems using these instructions and adjusting the steps accordingly.

For this setup we will have three hosts called Server 1, Server 2, and Server 3. The following is a brief synopsis of the network config for each:

Tinc Mesh Network Example

VPN NAME: NoMoreSecrets
SERVER 1: 

   public ip:    1.1.1.100
   vpn ip:       10.0.0.1
   connects to:  server 2, server 3

SERVER 2: 

   public ip:    1.1.2.100
   vpn ip:       10.0.0.2
   connects to:  server 1, server 3

SERVER 3: 

   public ip:    1.1.3.100
   vpn ip:       10.0.0.3
   connects to:  server 1, server 2



The following directory tree will be present on all three hosts for this setup: 

/etc
└── tinc
    └── NoMoreSecrets
        ├── hosts
        │   ├── server1
        │   ├── server2
        │   └── server3
        ├── rsa_key.priv
        ├── tinc.conf
        ├── tinc-down
        └── tinc-up

FreeBSD Note

FreeBSD will use the /usr/local/etc/tinc directory structure instead of the Linux /etc/tinc as shown above. Adjust the paths below accordingly. Additionally, the tinc-up and tinc-down files will differ. See the section below the Server 3 example for notes on these differences.

Individual node setup and configuration

All servers used in this example will be running Ubuntu 18.04.

Server1
  • Install tinc
   apt install tinc -y
  • Create directories
   mkdir -p /etc/tinc/NoMoreSecrets/hosts/

Create the following files:

  • /etc/tinc/NoMoreSecrets/hosts/server1:
   Address = 1.1.1.100
   Subnet = 10.0.0.1
  • /etc/tinc/NoMoreSecrets/tinc.conf:
   Name = server1
   Interface = tun0
   AddressFamily = ipv4
   ConnectTo = server2
   ConnectTo = server3
  • /etc/tinc/NoMoreSecrets/tinc-up:
   #!/bin/sh
   ip link set $INTERFACE up
   ip addr add 10.0.0.1/32 dev $INTERFACE
   ip route add 10.0.0.0/24 dev $INTERFACE
  • /etc/tinc/NoMoreSecrets/tinc-down:
   #!/bin/sh
   ip route del 10.0.0.0/24 dev $INTERFACE
   ip addr del 10.0.0.1/32 dev $INTERFACE
   ip link set $INTERFACE down
Server2
  • Install tinc
   apt install tinc -y
  • Create directories
   mkdir -p /etc/tinc/NoMoreSecrets/hosts/

Create the following files:

  • /etc/tinc/NoMoreSecrets/hosts/server2:
   Address = 1.1.2.100
   Subnet = 10.0.0.2
  • /etc/tinc/NoMoreSecrets/tinc.conf:
   Name = server2
   Interface = tun0
   AddressFamily = ipv4
   ConnectTo = server1
   ConnectTo = server3
  • /etc/tinc/NoMoreSecrets/tinc-up:
   #!/bin/sh
   ip link set $INTERFACE up
   ip addr add 10.0.0.2/32 dev $INTERFACE
   ip route add 10.0.0.0/24 dev $INTERFACE
  • /etc/tinc/NoMoreSecrets/tinc-down:
   #!/bin/sh
   ip route del 10.0.0.0/24 dev $INTERFACE
   ip addr del 10.0.0.2/32 dev $INTERFACE
   ip link set $INTERFACE down
Server3
  • Install tinc
   apt install tinc -y
  • Create directories
   mkdir -p /etc/tinc/NoMoreSecrets/hosts/

Create the following files:

  • /etc/tinc/NoMoreSecrets/hosts/server3:
   Address = 1.1.3.100
   Subnet = 10.0.0.3
  • /etc/tinc/NoMoreSecrets/tinc.conf:
   Name = server3
   Interface = tun0
   AddressFamily = ipv4
   ConnectTo = server1
   ConnectTo = server2
  • /etc/tinc/NoMoreSecrets/tinc-up:
   #!/bin/sh
   ip link set $INTERFACE up
   ip addr add 10.0.0.3/32 dev $INTERFACE
   ip route add 10.0.0.0/24 dev $INTERFACE
  • /etc/tinc/NoMoreSecrets/tinc-down:
   #!/bin/sh
   ip route del 10.0.0.0/24 dev $INTERFACE
   ip addr del 10.0.0.3/32 dev $INTERFACE
   ip link set $INTERFACE down
FreeBSD Note

The tinc-up and tinc-down files will differ from those listed above as follows:

  • /usr/local/etc/tinc/NoMoreSecrets/tinc-up:
   #!/bin/sh
   ifconfig "$INTERFACE" up
   ifconfig "$INTERFACE" inet 10.0.0.3 netmask 255.255.255.255
   route add -net 10.0.0.0 10.0.0.3

Note: Substitute route add -host <remote tinc ip> <local tinc ip> in place of the last line above for a two node setup

  • /usr/local/etc/tinc/NoMoreSecrets/tinc-down:
   #!/bin/sh
   ifconfig "$INTERFACE" destroy
   exit
Create keypair
  • On all servers create public/private keypair with:
   tincd -n NoMoreSecrets -K4096
Synchronize host files
  • Synchronize host files with public keys between all three servers with rsync:
  • From Server1:
   rsync -avz /etc/tinc/NoMoreSecrets/hosts/ server2:/etc/tinc/NoMoreSecrets/hosts/
   rsync -avz /etc/tinc/NoMoreSecrets/hosts/ server3:/etc/tinc/NoMoreSecrets/hosts/
  • From Server2:
   rsync -avz /etc/tinc/NoMoreSecrets/hosts/ server1:/etc/tinc/NoMoreSecrets/hosts/
   rsync -avz /etc/tinc/NoMoreSecrets/hosts/ server3:/etc/tinc/NoMoreSecrets/hosts/
  • From Server3:
   rsync -avz /etc/tinc/NoMoreSecrets/hosts/ server1:/etc/tinc/NoMoreSecrets/hosts/
   rsync -avz /etc/tinc/NoMoreSecrets/hosts/ server2:/etc/tinc/NoMoreSecrets/hosts/
  • On all servers set the executable bit on the tinc-up and tinc-down scripts
   chmod +x /etc/tinc/NoMoreSecrets/tinc-up
   chmod +x /etc/tinc/NoMoreSecrets/tinc-down
Start tinc

Linux:

  • On all servers enable and start tinc
   systemctl enable tinc@NoMoreSecrets
   systemctl start tinc@NoMoreSecrets

FreeBSD:

You will need to ensure that tincd is properly configured on /etc/rc.conf before you attempt to start it:

  • Add the following to your /etc/rc.conf:
  #tinc
  tincd_enable="YES"
  tincd_cfg="NoMoreSecrets"
  tincd_flags="-d 2 -L"
  • Start tinc with:
  service tincd start

Once tinc is up and running on all three servers you should be able to communicate over the 10.0.0.0/24 network.

Since this is a mesh network, if direct communication between two nodes drops, tinc will route all traffic through the remaining node until direct communication is restored.

Troubleshooting

  1. Check tinc logs to see what the error shown is. Refer to official documentation at https://www.tinc-vpn.org/docs/
  2. Check firewall on both hosts to make sure port 655 is being accepted.
  3. Check IP on Address line of hosts to ensure they are correct.
  4. Check IP on Subnet line of hosts files to ensure they are correct.

Simplified tinc 1.1 Windows setup

Examples on how to setup tinc 1.1 on Windows as either a server or client.

Server side config

  1. Download tinc
  2. Install tinc
  3. Open command prompt and type the following:
   cd "C:\Program Files\tinc"
   tinc -n vpn init master
   tinc -n vpn add subnet 10.0.1.1
   tinc -n vpn add address=public.domain-or-ip
   cd tap-win64
   addtap.bat
   netsh interface ipv4 show interfaces      (Note disconnected interface.  May be called Ethernet 2)
   netsh interface set interface name = "Ethernet 2" newname = "tinc"
   netsh interface ip set address "tinc" static 10.0.1.1  255.255.255.0
   netsh interface ipv4 show config          (Should create a tinc interface with IP and subnet)
   cd ..

To start tinc: 

   tincd -n vpn

To invite clients: 

   tinc -n vpn invite client1

Client side config

  1. Download tinc
  2. Install tinc
  3. Open command prompt and type the following:
   cd "C:\Program Files\tinc"
   tinc join <invite-url>
   tinc -n vpn add subnet 10.0.1.2
   cd tap-win64
   addtap.bat
   netsh interface ipv4 show interfaces      (Note disconnected interface.  May be called Ethernet 2)
   netsh interface set interface name = "Ethernet 2" newname = "tinc"
   netsh interface ip set address "tinc" static 10.0.1.2  255.255.255.0
   cd ..

To test connection: 

   tincd -n vpn -D -d3

To run tinc as service: 

   tincd -n vpn

Notes

Tinc will automatically register itself as a service when started without -D or --no-detach option.

Calling tinc with -k or --kill option will cause it to automatically unregister itself.

SOCAT

SOCAT can be used to create a simple virtual network between two hosts using UDP and TUN devices.

Note: It is possible to use TCP for this as well, but without the nodelay option it might cause problems. You can also replace UDP with DTLS to add security to the connection.

  • IP addresses used in this example:
Host Address Mask
Physical server address 1.2.3.4 N/A
Physical client address N/A N/A
TUN device on server 192.168.255.1 255.255.255.0
TUN device on client 192.168.255.2 255.255.255.0

Note: UDP connections will use PORT 11443.

Create TUN devices

  • TUN Server
    socat -d -d UDP-LISTEN:11443,reuseaddr TUN:192.168.255.1/24,up
  • TUN Client
    socat UDP:1.2.3.4:11443 TUN:192.168.255.2/24,up

Executing these two commands will result in a connection being established from the client to the server via TUN devices.

Troubleshooting

The following are common errors that you may encounter when using SOCAT to create a VPN.

  • Missing TUN/TAP Support
    ... E unknown device/address "tun"

The SOCAT binary probably does not provide TUN/TAP support. Reasons include not using Linux and using an older version of SOCAT.

  • Missing Kernel Support
    ,,, E open("/dev/net/tun", 02, 0666): No such file or directory

This incidates that your kernel does not have TUN/TAP support compiled in.

  • TUN Cloning Device Permissions
    ... E open("/dev/net/tun", 02, 0666): Permission denied

This indicates that you do not have sufficient permission to read or write to the TUN cloning device. Check the device's permssions and ownership.

SoftEther

   [top]

SoftEther VPN is an Open-Source Free Cross-platform Multi-protocol VPN Program, that is an academic project from the University of Tsukuba in Japan.

You can download SoftEther for FreeBSD, Linux, Mac, Solaris, and Windows from https://www.softether.org/[6]

Features

  • SSL-VPN tunnelling on HTTPS to pass though NAT and firewalls
  • Revolutionary VPN over ICMP and VPN over DNS featuers
  • Ethernet-bridging (L2) and IP-routing (L3) over VPN.
  • Embedded dynamic-DNS and NAT-traversal
  • SSL-VPN (HTTPS) and support for 6 major VPN protocols: OpenVPN, IPSEC, L2TP, MS-SSTP, L2TPv3, and EtherIP)

Cisco L2TPv3

Use the setup of SoftEther here as a guide for an L2TPv3 connection to a Cisco device.

SoftEther settings

Now make the following adjustments to the IPSEC/L2TPv3 settings shown there:

  • Under IPSEC/L2TP setting select the checkbox for Enable EtherIP/L2TPv3 over IPsec Server Function
  • Select EtherIP / L2TP Detail Settings
  • ISAKMP Phase 1 ID: Specify local IP address of Cisco device here
  • Fill in username/password settings
  • Under Virtual Hub management
  • Select Virtual NAT and virtual DHCP server function
  • Secure NAT settings wtill be used to set Virtual DHCP server settings
Ports used by Softether for this configuration
Type Port #
UDP 500
UDP 4500
UDP 1701
  • Encryption: If you have an issue with using AES during your initial testing, try using DES or 3DES. Once you have the connection established try switching to a more secure algorithm.
Cisco config

And then use the following config below on your Cisco device instead of what is listed on the SoftEther site to get L2TPv3 working:

Information used in this example
Local IP addess Peer IP (SoftEther Public IP) Pre-shared key
192.168.100.100 (ISAKMP Phase 1 ID) 1.1.1.100 CHANGEME
  • Note: By default Cisco may have NAT-Traversal enabled. This settings is not required.
  • Specify the L2TPv3 settings and interface (change FastEterhnet0/0 to match your device's interface).
pseudowire-class L2TPv3
   encapsulation l2tpv3
   ip local interface FastEthernet0/0
  • Note: You can chance the pseudowire-class interface's name from L2TPv3 to something more descriptive if you want.
  • ISAKMP settings:
crypto isakmp policy 1
   encr aes 256
   authentication pre-share
   group 2
crypto isakmp key CHANGEME address 1.1.1.100
crypto isakmp keepalive 10 periodic

Note: You can use AES 256 encryption here. DH group uses type 2 1024 bit encryption.

  • IPSEC settings:
crypto ipsec transform-set IPSEC esp-3des esp-sha-hmac
   mode transport
crypto ipsec fragmentation after-encryption

Note: 3des is being used here in this example. If you put this tunnel into production make sure you change the cipher used to AES!!!

  • Cryptographic map:
crypto map MAP 1 ipsec-isakmp
   set peer 1.1.1.100
   set transform-set IPSEC
   match address IPSEC_MATCH_RULE
  • Interface configuration
interface FastEthernet0/0
   ip address 192.168.100.100 255.255.255.0
   no ip proxy-arp
   duplex auto
   speed auto
   crypto map MAP

Note: FastEthernet0/0 uses the local IP address specified above and has the crypto map applied.

  • Use FastEthernet0/1 as the interface for the tunnel
interface FastEthernet0/1
   no ip address
   duplex auto
   speed auto
   no cdp enable
   xconnect 1.1.1.100 1 encapsulation l2tpv3 pw-class L2TPv3
   bridge-group 1
  • Access list:
ip access-list extended IPSEC_MATCH_RULE
   permit 115 any any
  • Now connect a device to FastEthernet0/1. It should get a DHCP lease from SoftEther and be on the network.
Troubleshooting

To troubleshoot the tunnel use the following commands: 

debug crypt isakmp
debug crypt ipsec
debug l2tp all
  • Show ISAKMP SA status:
#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
1.1.1.100       192.168.100.100    QM_IDLE           1011 ACTIVE
 
IPv6 Crypto ISAKMP SA
 
・IPSec
#show crypto ipsec sa
 
interface: FastEthernet0/0
    Crypto map tag: MAP, local addr 192.168.100.100
 
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/115/0)
   remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/115/0)
   current_peer 1.1.1.100 port 4500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 54342, #pkts encrypt: 54342, #pkts digest: 54342
    #pkts decaps: 179917, #pkts decrypt: 179917, #pkts verify: 179917
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 23, #recv errors 0
 
     local crypto endpt.: 192.168.100.100, remote crypto endpt.: 1.1.1.100
     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
     current outbound spi: 0x48E82D7A(1223175546)
     PFS (Y/N): N, DH group: none
 
     inbound esp sas:
      spi: 0x1B68FD22(459865378)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Tunnel UDP-Encaps, }
        conn id: 2107, flow_id: NETGX:107, sibling_flags 80000046, crypto map: MAP
        sa timing: remaining key lifetime (k/sec): (4386973/1557)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE
 
     inbound ah sas:
 
     inbound pcp sas:
 
     outbound esp sas:
      spi: 0x48E82D7A(1223175546)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Tunnel UDP-Encaps, }
        conn id: 2108, flow_id: NETGX:108, sibling_flags 80000046, crypto map: MAP
        sa timing: remaining key lifetime (k/sec): (4386975/1557)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE
 
     outbound ah sas:
 
     outbound pcp sas:
  • Check L2TP session:
#show l2tp session
L2TP Session Information Total tunnels 1 sessions 1
 
LocID      RemID      TunID      Username, Intf/      State  Last Chg Uniq ID
                                 Vcid, Circuit
23239**** 1900**** 2306***** 1, Fa0/1             est    01:32:52 1
  • Check L2TP tunnel:
L2TP Tunnel Information Total tunnels 1 sessions 1
LocTunID   RemTunID   Remote Name   State  Remote Address  Sessn L2TP Class/
                                                           Count VPDN Group
230**** 1          ******* est    1.1.1.100   1     l2tp_default_cl

Note: If you use AES for IPSEC it will become TunID 0.

WireGuard

   [top]

WireGuard can be downloaded from https://www.wireguard.com/[7]

Road Warrior Install

"In business travel, a road warrior is a person that uses mobile devices such as tablet, laptop, smartphone and internet connectivity while traveling to conduct business. The term has often been used with regard to salespeople who travel often and who seldom are in the office. Today it is used for anyone who works outside the office and travels for business." [4]

This will walk you through setting up the WireGuard Road Warrior install for Ubuntu, Debian, CentOS and Fedora.

Installation

  • Run the script and follow the on-screen prompts:
   wget https://git.io/wireguard -O wireguard-install.sh && bash wireguard-install.sh
  • You can run it again to add/remove users or completely uninstall WireGuard

Mikrotik Wireguard Road Warrior Config

From: https://forum.mikrotik.com/viewtopic.php?t=174417#[8]

The following information will show you how to setup a Mikrotik Wireguard server with Road Warrior clients.

Network topology

The network used in this examples is 192.168.66.0/24. A Mikrotik device will be the server and client can be any device running the Wireguard software.

System IP Address
Wireguard server 192.168.66.1
Wireguard client(s) 192.168.66.[2-254]

Mikrotik Configuration

# a private and public key will be automatically generated when adding the wireguard interface
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1

/interface wireguard peers
# the first client added here is ipv4 only
add allowed-address=192.168.66.2/32 interface=wireguard1 public-key="*** replace-with-public-key-of-first-client ***"
# this client is dual stack - public IPv6 should be used - replace 2001:db8:cafe:beef: with one of your /64 prefixes.
add allowed-address=192.168.66.3/32,2001:db8:cafe:beef::3/128 interface=wireguard1 public-key="*** replace-with-public-key-of-second-client-dual-stack ***"

/ip address
add address=192.168.66.1/24 interface=wireguard1 network=192.168.66.0

/ipv6 address
add address=2001:db8:cafe:beef::1/64 interface=wireguard1

Client configuration

Interface: (whatever name you want to specify)
Public key: the client should automatically generate this - add this to the server above replacing "replace-with-public-key-of-second-client-dual-stack"
Addresses: 192.168.66.3/24,2001:db8:cafe:beef::3/64          (note these are different subnet masks than in the server config)
DNS servers: as desired - if you want to use the wireguard server for dns, specify 192.168.66.1

Peer:
Public key - get the public key from the wireguard interface on the Mikrotik device and place here
Endpoint - mydyndns.whatever:13231
Allowed IPs: 0.0.0.0/0, ::/0

This client configuration will result in all traffic being forwarded via the Mikrotik Wireguard server. You will need to ensure:

  • Create an input chain firewall rule to allow UDP traffic in on port 13231
/ip firewall filter add action=accept chain=input comment="Allow Wireguard" dst-port=13231 protocol=udp
  • Ensure the Mikrotik firewall is allowing traffic from 192.168.66.0/24 and that you are NATing this traffic. If your device is based off the default Mikrotik config and using the LAN interface list, you can add the Wireguard interface to this list to allow traffic through and NATing it as it leaves your network. Otherwise, you will need to modify your configuration accordingly.

Get/Set Wireguard Peers

  • Get Mikrotik Wireguard peers list
/interface wireguard peers print
  • Set Mikrotik Wireguard peers list
/interface wireguard peers set <ID> allowed-addresses=whatever,whateverelse

VPNC

   [top]

VPNC [9] is an open-source VPN client.

Works with the following
System
Cisco VPN concentrator 3000 Series
Cisco IOS routers
Cisco PIX / ASA Security Appliances
Juniper/Netscreen
  • And is available for the following operating systems:
Supported Operating Systems
Name
Linux
FreeBSD
OpenBSD
NetBSD
DragonFly BSD
Darwin / Mac OS X
Solaris
Windows / Cygwin
  • Supported Authentications: Hybrid, Pre-Shared-Key + XAUTH, Pre-Shared-Key
  • Supported IKE DH-Groups: dh1, dh2, dh5
  • Supported Hash Algo (IKE/IPSEC): md5, sha1
  • Supported Encryptions (IKE/IPSEC): (null), (1des), 3des, aes128, aes192, aes256
  • Perfect Forward Secrecy: nopfs, dh1, dh2, dh5

Installation

To install VPNC on Debian based distributions: 

   sudo apt-get install vpnc

Configuration

Edit the default config file as follows (substitute your own name if you want to name the connection instead of using default. You will use this name as @<name> when calling vpnc.)

  • Edit /etc/vpnc/default.conf.
   IPSec gateway <VPNC server IP or FQDN>
   IPSec id AMPRNET
   IPSec secret EzAsARDC
   Xauth username YOUR-CALLSIGN
   Xauth password _YOUR_PASSWORD_HERE_

Starting the VPN

Use one fo the following commands to start your VPNC based VPN connection.

  • This command would run VPNC using /etc/vpnc/default.conf, if it exists. If it does not, it would prompt for the connection information:
   sudo vpnc
  • This would run VPNC using /etc/vpnc/external.conf, if it exists.
   sudo vpnc external

Starting at boot

You can start your VPNC based VPN connection at boot using one of the following methods.

/etc/rc.local

This is the simplest way and does not involve creating init scripts or systemd service files.

Add a line such as the following into your /etc/rc.local file: 

  vpnc
systemd

To control from systemd:

  • Edit /usr/lib/systemd/system/vpnc@.service
   [Unit]                                                                                                                                                                        
   Description=VPNC connection to %i
   Wants=network-online.target
   After=network.target network-online.target
   
   [Service]
   Type=forking
   ExecStart=/usr/bin/vpnc --pid-file=/run/vpnc@%i.pid /etc/vpnc/%i.conf
   PIDFile=/run/vpnc@%i.pid 
  
   [Install]
   WantedBy=multi-user.target
  • Enable default VPNC configuration to be managed by systemd:
   systemctl enable vpnc
  • Start default VPNC connection with systemd:
   systemctl start vpnc

Note: If you have multiple VPNC configurations or chose to name your config, you will substitute vpnc for vpnc@<config name>.

Other

   [top]

Any other information that doesn't fit elsewhere.

Ham Radio VPN Providers

The following is a table of providers who offer free VPN connections to licensed Ham Radio operators.

Note: No commercial advertisements or pay services are allowed or permitted. Adding them will get your account removed and/or IP address banned.

Providers of Ham Radio VPN Connections
System Contact Type Notes
w9cr.net Bryan Fields, W9CR (bryan@bryanfields.net) VPNC Used as a means to get public IP's directly on nodes, bypassing NAT444 and man-in-the-middle IAX level filtering. Provides 44net public IP space. Include your callsign in the details.
AMPRNet VPN https://wiki.ampr.org/wiki/AMPRNet_VPN OpenVPN AMPRNet VPN is an experimental method to access the AMPRNet using a VPN from anywhere on the Internet. The VPN is openly available to any amateur radio operators who have successfully applied for an X.509 certificate from one of the listed Certificate Authorities.

Firewall

Information regarding firewall setup as related to the VPN configs above.

Linux

   [top]

The following script can be used to setup a basic firewall on a Linux based system using iptables.

Supports IPv4 and IPv6. Comment out the parts that are not need with a # or optionally delete them.

Note: While this supports IPv6, some of the rules listed were only done for IPv4. You'll need to make the necessary changes to have IPv6 protected as well. While the parameters listed for IPv4 should work you should refer to the ip6tables man page if you have any issues. 

 #!/bin/bash
 
 #Modify to match your network interface  
 INET_IF=eth0
 
 #IPv4
 #Edit IP address below to match the IP and netmask of the system or subnet you want to allow access to 
 #"Management only" services.  Add or remove as needed.  Make sure to update the ManagementFilterV4 with
 #the changes
 System1="XX.XX.XX.XX/YY"  
 System2="XX.XX.XX.XX/YY"
   
 ManagementFilterV4=$System1,$System2
 
 #IPv6
 #Edit IP address below to match the IP and netmask of the system or subnet you want to allow access to 
 #"Management only" services.  Add or remove as needed.  Make sure to update the ManagementFilterV6 with
 #the changes
 V6System1="2001:db8:a::123/64"  
 V6System2="2001:db8:b::123/64"
   
 ManagementFilterV6=$V6System1,$V6System2
 
 #Flush and zero all tables
 modprobe ip_tables
 modprobe ipt_limit
 modprobe iptable_mangle
 modprobe ipt_state
 modprobe ipt_LOG
 modprobe iptable_filter
 modprobe ipv6
 
 iptables -F INPUT
 iptables -F FORWARD
 iptables -t nat -F POSTROUTING
 iptables -t nat -F PREROUTING
 
 ip6tables -F INPUT
 ip6tables -F FORWARD
 
 #init the log-and-drop chain
 iptables -F log-and-drop
 iptables -X log-and-drop
 iptables -N log-and-drop
 
 ip6tables -F log-and-drop
 ip6tables -X log-and-drop
 ip6tables -N log-and-drop
 
 iptables -F log-and-reject
 iptables -X log-and-reject
 iptables -N log-and-reject
 
 ip6tables -F log-and-reject
 ip6tables -X log-and-reject
 ip6tables -N log-and-reject
 
 #Remove/comment this out and all references to the FILTERS chain if Docker isn't being used
 #Restart Docker
 echo "Restarting Docker"
 systemctl restart docker
 
 #Now add in rules to affect DOCKER containers
 #See https://unrouted.io/2017/08/15/docker-firewall/
 iptables -F DOCKER-USER
 iptables -X DOCKER-USER
 iptables -N DOCKER-USER
 
 iptables -F FILTERS
 iptables -X FILTERS
 iptables -N FILTERS
 
 echo "all tables flushed and dropped"
 
 # Specific chain used for logging packets before blocking them
 iptables -A log-and-drop -j LOG --log-prefix "[IPTables] Drop "
 iptables -A log-and-drop -j DROP
 
 ip6tables -A log-and-drop -j LOG --log-prefix "[IPTables] Drop "
 ip6tables -A log-and-drop -j DROP
 
 # Specific chain used for logging packets before blocking them
 iptables -A log-and-reject -j LOG --log-prefix "[IPTables] Reject "
 iptables -A log-and-reject -j REJECT
 
 ip6tables -A log-and-reject -j LOG --log-prefix "[IPTables] Reject "
 ip6tables -A log-and-reject -j REJECT
 
 echo "logging chains setup"
 
 #setup DOCKER-USER related rules- you will place all rules for Docker under the FILTERS chain
 iptables -A DOCKER-USER -i $INET_IF -j FILTERS
 
 # Check if NEW incoming tcp connections are SYN, drop if not
 iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
 iptables -A FILTERS -p tcp ! --syn -m state --state NEW -j DROP
 
 #Drop fragmented packets
 iptables -A INPUT -f -j DROP
 iptables -A FILTERS -f -j DROP
 iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
 iptables -A FILTERS -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
 iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
 iptables -A FILTERS -p tcp --tcp-flags ALL ALL -j DROP
 
 # Drop incoming malformed XMAS packets
 iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "[IPT-XMAX Pkts] "
 iptables -A FILTERS -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "[IPT-XMAX Pkts] "
 iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
 iptables -A FILTERS -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
 
 #Drop all NULL pakcets
 iptables -A INPUT -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "[IPT-NULL Pkts] "
 iptables -A FILTERS -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "[IPT-NULL Pkts] "
 iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
 iptables -A FILTERS -p tcp --tcp-flags ALL NONE -j DROP
 iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
 iptables -A FILTERS -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
 
 #Drop FIN packet scans
 iptables -A INPUT -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "[IPT-FIN Scan] "
 iptables -A FILTERS -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "[IPT-FIN Scan] "
 iptables -A INPUT -p tcp --tcp-flags FIN,ACK FIN -j DROP
 iptables -A FILTERS -p tcp --tcp-flags FIN,ACK FIN -j DROP
 iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
 iptables -A FILTERS -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
 
 #Log and drop broadcast /multicast and invalid
 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG --log-prefix "[IPT-Broadcast] "
 iptables -A INPUT -m pkttype --pkt-type broadcast -j DROP
 iptables -A INPUT -m pkttype --pkt-type multicast -j LOG --log-prefix "i[IPT-Multicast] "
 iptables -A INPUT -m pkttype --pkt-type multicast -j DROP
 iptables -A INPUT -m state --state INVALID -j LOG --log-prefix "[IPT-Invalid] "
 iptables -A FILTERS -m state --state INVALID -j LOG --log-prefix "[IPT-Invalid] "
 iptables -A INPUT -m state --state INVALID -j DROP
 iptables -A FILTERS -m state --state INVALID -j DROP
 
 # The packets having the TCP flags activated are dropped
 # and so for the ones with no flag at all (often used with Nmap scans)
 iptables -A FORWARD -p tcp --tcp-flags ALL ALL -j log-and-drop
 iptables -A FILTERS -p tcp --tcp-flags ALL ALL -j log-and-drop
 iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j log-and-drop
 iptables -A FILTERS -p tcp --tcp-flags ALL NONE -j log-and-drop
 
 ip6tables -A FORWARD -p tcp --tcp-flags ALL ALL -j log-and-drop
 ip6tables -A FORWARD -p tcp --tcp-flags ALL NONE -j log-and-drop
 
 #limit traffic to 80 an 443 - Change chain from INPUT to FILTERS to Docker and don't forget to open below
 #DCQ="2"   #max requests in 1 second
 #DCH="25"   #max requests over 7 seconds
 
 #iptables -A INPUT-p tcp --dport 80 -m state --state NEW -m recent --set --name P80QF --rsource
 #iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --update --second 1 --hitcount ${DCQ} --name P80QF --rsource -j log-and-drop
 #iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --set --name P80HF --rsource
 #iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --update --second 7 --hitcount ${DCH} --name P80HF --rsource -j log-and-drop
  
 #iptables -A INPUT -p tcp --dport 443 -m state --state NEW -m recent --set --name P443QF --rsource
 #iptables -A INPUT -p tcp --dport 443 -m state --state NEW -m recent --update --second 1 --hitcount ${DCQ} --name P443QF --rsource -j log-and-drop
 #iptables -A INPUT -p tcp --dport 443 -m state --state NEW -m recent --set --name P443HF --rsource
 #iptables -A INPUT -p tcp --dport 443 -m state --state NEW -m recent --update --second 7 --hitcount ${DCH} --name P443HF --rsource -j log-and-drop
   
 #default return chain for Docker- skipped.  Enable if needed
 #iptables -A FILTERS -j RETURN
 
 #Global blocks
 #iptables -t filter -A INPUT -j DROP -s 12.34.56.78/32
 
 #Limit DNS requests to prevent flood attacks - use if you are running a DNS server on the system this is installed on.  
 #Don't forget to allow in the rules below
 # Requests per second
 #RQS="15"
 # Requests per 7 seconds
 #RQH="35"
 
 #iptables -A INPUT -p udp --dport 53 -m state --state NEW -m recent --set --name DNSQF --rsource
 #iptables -A INPUT -p udp --dport 53 -m state --state NEW -m recent --update --seconds 1 --hitcount ${RQS} --name DNSQF --rsource -j DROP
 #iptables -A INPUT -p udp --dport 53 -m state --state NEW -m recent --set --name DNSHF --rsource
 #iptables -A INPUT -p udp --dport 53 -m state --state NEW -m recent --update --seconds 7 --hitcount ${RQH} --name DNSHF --rsource -j DROP
 
 #Uncomment the next sections if using IPSEC
 #Clamp MSS on IPSEC tunnels
 #iptables -t mangle -A FORWARD -m policy --pol ipsec --dir in -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
 #iptables -t mangle -A FORWARD -m policy --pol ipsec --dir out -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
 
 # allow IPSEC from other boxes
 #IPSECsrc='XX.XX.XX.XX/YY'  # Put in the form of XX.XX.XX.XX = IP address you want to allow IPSEC in from and YY is the netmask.
 
 #Technically the next two are not needed as we have the policy
 #iptables -A INPUT -i $INET_IF -p 50 -j ACCEPT --src "$IPSECsrc"
 #iptables -A INPUT -i $INET_IF -p 51 -j ACCEPT --src "$IPSECsrc"
 #iptables -A INPUT -i $INET_IF -p udp --dport 500 -j ACCEPT --src "$IPSECsrc"
 #iptables -A INPUT -i $INET_IF -p udp --dport 4500 -j ACCEPT --src "$IPSECsrc"
 # this is needed to allow all ipsec packets when it's host to host
 #iptables -A INPUT -m policy --dir in --pol ipsec -j ACCEPT --src "$IPSECsrc" 
 
 #allow port 80 in
 #iptables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 80
 #iptables -t filter -A FILTERS -j ACCEPT --protocol tcp --dport 80
 #ip6tables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 80
 
 #allow port 443 in
 #iptables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 443
 #iptables -t filter -A FILTERS -j ACCEPT --protocol tcp --dport 443
 #ip6tables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 443
 
 # allow all ssh in - uncomment ManagementFilterV4 and comment out the lines below it to restrict SSH access on port 22
 #iptables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 22 --src $ManagementFilterV4
 iptables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 22 
 
 #uncomment ManagementFilterV6 and commentout the line below it to restruct SSH for IPv6 on port 22
 #ip6tables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 22 --src ManagementFilterV6
 ip6tables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 22
 
 echo "end of services"
 # allow ping at 2 per sec
 iptables -t filter -A INPUT -j ACCEPT --in-interface $INET_IF --protocol icmp --icmp-type echo-request --match limit --limit 4/s --limit-burst 3
 iptables -t filter -A INPUT -j log-and-drop  --in-interface $INET_IF --protocol icmp --icmp-type echo-request
 
 ip6tables -A INPUT -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -m hl --hl-eq 255 -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -m hl --hl-eq 255 -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type 141 -m hl --hl-eq 255 -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type 142 -m hl --hl-eq 255 -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type 130 -s fe80::/10 -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type 131 -s fe80::/10 -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type 132 -s fe80::/10 -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type 143 -s fe80::/10 -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type 148 -m hl --hl-eq 255 -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type 151 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type 152 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
 ip6tables -A INPUT -p icmpv6 --icmpv6-type 153 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT 
 
 # allow responces to local initated connections
 #iptables -A INPUT -i  $INET_IF --match state --state NEW,INVALID -j log-and-drop
 #iptables -A FORWARD -i $INET_IF  --match state --state NEW,INVALID -j log-and-drop
 iptables -t filter -A INPUT -j ACCEPT --match state --state RELATED,ESTABLISHED
 ip6tables -t filter -A INPUT -j ACCEPT --match state --state RELATED,ESTABLISHED
 
 # Set rp_filter to 2
 for i in `find /proc/sys/net/ipv*/conf -name rp_filter`
 do
 	echo "2" >$i
 done
 
 # setup a default deny rule for outside traffic
 iptables -t filter -A INPUT --in-interface $INET_IF -j log-and-drop
 iptables -t filter -A FILTERS --in-interface $INET_IF -j log-and-drop
 ip6tables -t filter -A INPUT --in-interface $INET_IF -j log-and-drop
   
 #uncomment the next two lines if fail2ban is installed
 #echo "Restarting fail2ban"
 #systemctl restart fail2ban

External Links

  1. ↑ strongSwan Official Site [1]
  2. ↑ MikroTik Official Site [2]
  3. ↑ OpenVPN Official Site [3]
  4. ↑ 4.0 4.1 Road warrior (computing) [4]
  5. ↑ Tinc-vpn Official Site [5]
  6. ↑ SoftEther VPN Official Site [6]
  7. ↑ WireGuard Offical Site [7]
  8. ↑ Mikrotik Forums - MikroTik Wireguard server with Road Warrior clients [8]
  9. ↑ VPNC Project Homepage [9]
Retrieved from "http://wiki.pttlink.org/index.php?title=VPN&oldid=12361"