Ipsecvpn - Revision history

WFilter at 09:41, 28 November 2019

2019-11-28T09:41:04Z

WFilter at 07:56, 24 May 2019

2019-05-24T07:56:47Z

WFilter: /* IPSec Tunnel Settings */

2018-10-26T09:15:36Z

‎IPSec Tunnel Settings

WFilter: /* Tunnel Status */

2018-09-27T06:36:32Z

‎Tunnel Status

WFilter: /* Tunnel Status */

2018-09-27T06:35:42Z

‎Tunnel Status

WFilter at 03:47, 17 November 2017

2017-11-17T03:47:00Z

WFilter: /* IPSec Tunnel Settings */

2017-10-01T07:22:59Z

‎IPSec Tunnel Settings

WFilter: /* Settings for Headquarter A */

2017-10-01T07:02:24Z

‎Settings for Headquarter A

WFilter at 07:02, 1 October 2017

2017-10-01T07:02:00Z

WFilter at 09:43, 13 June 2017

2017-06-13T09:43:31Z

@@ Line 15: / Line 15: @@
 * Create tunnels in B and C networks, set "Remote IP" to A's public ip address.
 * Now the tunnels are ready. A, B, C now are in a VPN network. The tunnels are between AB and AC.
-* To enable access between B and C, you need to setup routering rules and enable FORWARD in A.
+* To enable access between B and C, you need to enable FORWARD in A.
 Description of tunnel settings:
@@ Line 65: / Line 65: @@
 * Setup the IPSec tunnel
 [[File:ipsec_client01.png|800px]]
 === Branch C ===
 * Setup the IPSec tunnel
 [[File:ipsec_client03.png|800px]]
-* Add a routing rule to branch B
-Set branch B's LAN subnet to "Destination", set headquarter A's public IP to "Gateway". Without this routing rule, branch C can not access branch B.
+By above steps, AB and AC are now connected. If you also want B and C to communicate with each other, you need to add B&C subnets in headquartor's local subnet.
 [[File:ipsec_client04.png|800px]]
 == One-armed Deployment of IPSecVPN ==

@@ Line 24: / Line 24: @@
 * Remote Subnet: remote LAN subnets which will be forwarded to the tunnel.
 * PreShared Key: tunnel secret key. With a correct key, the tunnel can not be established.
-* Start: Manually or Automatically.
+* Mode: Server -- Waiting for clients to connect, Client -- Initiate connection to a server.
 * IKE, ESP: algorithm for authentication and transfer. Both sides of the tunnel shall have the same version and algorithm.
-Server side settings examples:
+[[File:ipsec01.png|800px]]
-−
-[[File:ipsec01.png|650px]]
-−
-Client side settings examples:
-−
-[[File:ipsec02.png|650px]]
 '''Notice''':
-* Access of tunnels are also applied with [[Firewallrule|firewall rules]]. For example, if you want to block VPN tunnels users from accessing a local server, you need to setup a firewall rule to block the target server ip from WAN interface.
+* In "manual" mode, tunnel clients are blocked to local subnets. You need to set the firewall rules by yourself in "Config"->"Firewall".(Interface: WAN, type: forward.）
 * If you enable DMZ or "Static NAT", please add IPSec port "500,4500" to "port exception". Otherwise, IPSec connections can not be established.
 * If the WAN interface has multiple static ip addresses, IPSec only listens in the first IP address.

@@ Line 25: / Line 25: @@
 * PreShared Key: tunnel secret key. With a correct key, the tunnel can not be established.
 * Start: Manually or Automatically.
-* IKE, ESP: algorithm for authentication and transfer. Both sides of the tunnel shall have the same algorithm.
+* IKE, ESP: algorithm for authentication and transfer. Both sides of the tunnel shall have the same version and algorithm.
 Server side settings examples:

@@ Line 44: / Line 44: @@
 Move your mouse into the "state" icon, you will see the tunnel status and connected clients. You also can click the "view log" icon to check more log details.
-[[File:ipseclog_01.png|1000px]]
+[[File:ipseclog_01.png|800px]]
-[[File:ipseclog_02.png|1000px]]
+[[File:ipseclog_02.png|800px]]
 == A site to site ipsec vpn sample ==

@@ Line 42: / Line 42: @@
 == Tunnel Status ==
-Move your mouse into the "state" icon, you will see the tunnel status and connected clients.
+Move your mouse into the "state" icon, you will see the tunnel status and connected clients. You also can click the "view log" icon to check more log details.
-[[File:ipsec03.png|1000px]]
+[[File:ipseclog_01.png|1000px]]
 == A site to site ipsec vpn sample ==

← Older revision		Revision as of 03:47, 17 November 2017
Line 82:		Line 82:

	By above steps, A,B,C are now in a virtual private network. If you don't want access between B and C, there is no need to add the firewall and routing rules.		By above steps, A,B,C are now in a virtual private network. If you don't want access between B and C, there is no need to add the firewall and routing rules.
		+
		+	== One-armed Deployment of IPSecVPN ==
		+	As below network diagram, WFilter NGF is deployed as a network bridge. For IPSec VPN, this is called "one-armed deployment".
		+
		+	[[File:passby_ipsec.png\|600px]]
		+	=== Setup the IPSec tunnel ===
		+
		+	Choose "bridge" as the interface, you might need to setup customize local subnets.
		+
		+	[[File:passby_ipsec02.png\|600px]]
		+
		+	=== Setup port forwarding in gateway ===
		+	Gateway device needs to map the IPSec ports(UDP 500 and UDP 4500) to WFilter NGF.
		+
		+	[[File:passby_ipsec03.png\|800px]]
		+
		+	=== Setup routing in gateway ===
		+
		+	You also need to setup static routing in gateway to point nexthop of remote subnet to WFilter NGF.
		+
		+	[[File:passby_ipsec04.png\|800px]]
		+
		+	IPSec tunnels are available now.
		+
		+	[[File:passby_ipsec05.png\|800px]]


	[[Category:VPN]]		[[Category:VPN]]

@@ Line 21: / Line 21: @@
 * Interface: WAN interface to setup the tunnel.
 * Local Subnet: local subnet to be connected with the tunnel.
-* Remote Site: another side of the tunnel, "Any" to allow any others to connect. The remote site can be IP address or domain.
+* Remote Site: another side of the tunnel, "Any" to allow any others to connect. The remote site can be an IP address or domain.
 * Remote Subnet: remote LAN subnets which will be forwarded to the tunnel.
 * PreShared Key: tunnel secret key. With a correct key, the tunnel can not be established.

@@ Line 62: / Line 62: @@
 * Enable forwarding of branches
 Without this setting, branches can access headquarter, but no access between branches.
 [[File:ipsec_center03.png|800px]]

@@ Line 7: / Line 7: @@
 == IPSec Tunnel Settings ==
-Before you setup a IPSec tunnel, you need to design your tunnels. Only a network with a static internet ip address can act as a tunnel server. For example:
+Before you setup a IPSec tunnel, you need to design your tunnels. For example:
 * Suppose you have 3 network: A, B, C.
 * A has a static public IP, B and C ip addresses are dynamic.
@@ Line 21: / Line 21: @@
 * Interface: WAN interface to setup the tunnel.
 * Local Subnet: local subnet to be connected with the tunnel.
-* Remote IP: another side of the tunnel, "Any" to allow any others to connect.
+* Remote Site: another side of the tunnel, "Any" to allow any others to connect. The remote site can be IP address or domain.
 * Remote Subnet: remote LAN subnets which will be forwarded to the tunnel.
 * PreShared Key: tunnel secret key. With a correct key, the tunnel can not be established.

@@ Line 2: / Line 2: @@
 == IPSec Tunnels ==
-This modules can build IPSec tunnels between multiple WFilter ROS networks, and make a secure site-to-site VPN.
+This modules can build IPSec tunnels between multiple WFilter NGF networks, and make a secure site-to-site VPN.
 The number of IPSec Tunnels depends on your hardware performance, there is no software limit on the tunnels number.
@@ Line 11: / Line 11: @@
 * A has a static public IP, B and C ip addresses are dynamic.
 The solution will be:
 * Create a tunnel in A network, set "Remote IP" to "Any".
 * Create tunnels in B and C networks, set "Remote IP" to A's public ip address.
-* Now the tunnels are ready. A, B, C now are in a VPN network. The tunnels are between A&B and A&C. Since there is no tunnel between B and C, B and C can not visit each other.
+* Now the tunnels are ready. A, B, C now are in a VPN network. The tunnels are between AB and AC.
 Description of tunnel settings:
@@ Line 20: / Line 22: @@
 * Local Subnet: local subnet to be connected with the tunnel.
 * Remote IP: another side of the tunnel, "Any" to allow any others to connect.
-* Remote Subnet: remote LAN subnet which will be forwarded to the tunnel.
+* Remote Subnet: remote LAN subnets which will be forwarded to the tunnel.
 * PreShared Key: tunnel secret key. With a correct key, the tunnel can not be established.
 * Start: Manually or Automatically.
@@ Line 44: / Line 46: @@
 [[File:ipsec03.png|1000px]]
-== FAQ ==
+== A site to site ipsec vpn sample ==
 [[Category:VPN]]