ASL-Corp members, Bureaucrats, Check users, Structured Discussions bots, oversight, Suppressors, Administrators, Upload Wizard campaign editors
1,714
edits
Changes
Jump to navigation
Jump to search
Line 15:
Line 15: + + + + + + + + + + + + + + + + + + + + + + + + + − + − − ''Note: You can use this config to connect two non-MikroTik systems as well. Just replicate the config below for each system you wish to connect.'' Line 210:
Line 233: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
no edit summary
== IPSEC ==
== IPSEC ==
Information on how to setup IPSEC tunnels.
Information on how to setup IPSEC tunnels.
=== strongSwan to strongSwan ===
Use the following config for a strongSwan<ref>strongSwan Official Site [https://www.strongswan.org/]</ref> to strongSwan configuration. Make sure the left and right IP addresses are updated to match each system. You can use the same ipsec.secrets file on both systems without changing the IP address order, although I recommend changing it to having the local IP on the left and the remote on the right as shown below.
====ipsec.conf====
/sec/ipsec/conf:
conn <name>
authby=secret
auto=route # can also be start
keyexchange=ike
left=<your local IP>
right=<remote IP of Mikrotik system>
leftikeport=500
rightikeport=500
type=transport
esp=aes128gcm16!
dpddelay=5
dpdtimeout=20
dpdaction=clear # can also be restart
====ipsec.secrets====
/etc/ipsec.secrets:
<your local IP> <remote IP of Mikrotik system> : PSK "<Put your preshared key here>"
=== strongSwan to MikroTik ===
=== strongSwan to MikroTik ===
Use the following configurations to connect a system running stongSwan<ref>strongSwan Official Site [https://www.strongswan.org/]</ref> to a MikroTik<ref>MikroTik Official Site [https://mikrotik.com/]</ref> device using IPSEC.
Use the following configurations to connect a system running strongSwan to a MikroTik<ref>MikroTik Official Site [https://mikrotik.com/]</ref> device using IPSEC.
==== strongSwan config ====
==== strongSwan config ====
The following configuration will work on FreeBSD or Linux systems with strongSwan installed.
The following configuration will work on FreeBSD or Linux systems with strongSwan installed.
=====ipsec.conf=====
=====ipsec.conf=====
== PPTP ==
== PPTP ==
{{go to top}}
{{go to top}}
==Persistent SSH Tunnels==
The following is how to create a persistent SSH Tunnel between two systems. This is handy if you want to secure data flowing across networks, or even setup a tunnel without messing with VPN configuration.
===Create User/Generate SSH key===
First you will create the user you will use for the tunnel. This will allow you to forward non-privileged ports over 1024.
''Note: This user does not have a password assigned or a shell. This will prevent user logins to the system.''
<pre>
useradd -m -s /bin/false autossh
</pre>
Now switch to the user and generate an SSH key:
<pre>
su -s /bin/bash autossh
cd ~
ssh-keygen -b 4096
</pre>
''Note: Leave password blank''
Once done, exit back to your normal user shell
<pre>
exit
</pre>
===Copy public key to target system===
You will need to copy '''''id_rsa.pub''''' file from '''''/home/autossh/.ssh/''''' to the '''''authorized_keys''''' file on the remote system you want to connect to for the tunnel.
''Note: It is recommended that you also create a normal user on the remote system and not use root.''
===Install autossh===
You will need to install the autossh program on the system that will initiate the SSH tunnel. Autossh automatically restarts the SSH tunnel when it exits.
<pre>
apt-get install autossh
</pre>
===Setup script===
Copy the following script, making the necessary changes as specified between the <> and place on the system that will initiate the tunnel (here we will save it as /opt/ssh-tunnel.sh):
<pre>
#!/bin/sh
#
su -s /bin/sh autossh -c 'autossh -M 0 -N -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -o "ExitOnForwardFailure=yes" -f -T -R localhost:<target port>:<local IP or localhost>:<local port> <user>@<domain>'
</pre>
{| class="wikitable"
! Parameter !! Description
|-
| localhost || localhost or IP address on target system
|-
| <target port> || port on target system
|-
| <local IP or localhost> || localhost or IP address on system initiating tunnel
|-
| <local port> || port on system initiating tunnel
|-
| <user@domain> || username and domain to use when SSHing to target system
|}
An example of this command is:
<pre>
su -s /bin/sh autossh -c 'autossh -M 0 -N -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -o "ExitOnForwardFailure=yes" -f -T -R localhost:3306:localhost:3306 joe@blow.com'
</pre>
This would allow the target (remote) system to access the local (system initiating the SSH tunnel) system's MySQL server over the tunnel.
You can also use -L to change the direction of the port forwarding from Remote to Local and have the initiating system forward data over the tunnel the the remote.
===Make script executable===
Make sure you mark the script as executable with:
<pre>
chmod +x /opt/ssh-tunnel.sh
</pre>
===Tunnel at startup===
To have the tunnel up when the system restarts, choose one of the following methods
====rc.local====
Add a line to /etc/rc.local that calls the script.
<pre>
# Start AutoSSH tunnel at boot
/opt/ssh-tunnel.sh
</pre>
''Note: You may have to enable rc.local on Ubuntu and Debian based systems via systemd. Refer to your distributions documentation for information on how to enable it.''
====systemd====
To have the script start at boot with systemd, create the following file and add it to /etc/systemd/system/ssh-tunnel.service
=====ssh-tunnel.service=====
<pre>
[Unit]
Description=AutoSSH Tunnel at boot
[Service]
Type=oneshot
ExecStart=/opt/ssh-tunnel.sh
[Install]
WantedBy=multi-user.target
</pre>
=====Enable service=====
To enable the service to run via systemd run:
<pre>
systemctl enable ssh-tunnel.service
</pre>
== GRE Tunnel ==
== GRE Tunnel ==