Ipsecvpn

From Wiki of WFilter NG Firewall
(Difference between revisions)
Jump to: navigation, search
(→‎IPSec Tunnel Settings)
 
(5 intermediate revisions by one user not shown)
Line 15: Line 15:
 
* Create tunnels in B and C networks, set "Remote IP" to A's public ip address.
 
* Create tunnels in B and C networks, set "Remote IP" to A's public ip address.
 
* Now the tunnels are ready. A, B, C now are in a VPN network. The tunnels are between AB and AC.  
 
* Now the tunnels are ready. A, B, C now are in a VPN network. The tunnels are between AB and AC.  
−
* To enable access between B and C, you need to setup routering rules and enable FORWARD in A.
+
* To enable access between B and C, you need to enable FORWARD in A.
  
 
Description of tunnel settings:
 
Description of tunnel settings:
Line 24: Line 24:
 
* Remote Subnet: remote LAN subnets which will be forwarded to the tunnel.
 
* Remote Subnet: remote LAN subnets which will be forwarded to the tunnel.
 
* PreShared Key: tunnel secret key. With a correct key, the tunnel can not be established.
 
* PreShared Key: tunnel secret key. With a correct key, the tunnel can not be established.
−
* Start: Manually or Automatically.
+
* Mode: Server -- Waiting for clients to connect, Client -- Initiate connection to a server.
−
* IKE, ESP: algorithm for authentication and transfer. Both sides of the tunnel shall have the same algorithm.
+
* Firewall: Automatic -- automatic allow clients to access local subnets, Manual -- block VPN clients in default.
 +
* IKE, ESP: algorithm for authentication and transfer. Both sides of the tunnel shall have the same version and algorithm.
  
−
Server side settings examples:
+
[[File:ipsec01.png|800px]]
−
 
+
−
[[File:ipsec01.png|650px]]
+
−
 
+
−
Client side settings examples:
+
−
 
+
−
[[File:ipsec02.png|650px]]
+
  
 
'''Notice''':  
 
'''Notice''':  
−
* Access of tunnels are also applied with [[Firewallrule|firewall rules]]. For example, if you want to block VPN tunnels users from accessing a local server, you need to setup a firewall rule to block the target server ip from WAN interface.
+
* In "manual" mode, tunnel clients are blocked to local subnets. You need to set the firewall rules by yourself in "Config"->"Firewall".(Interface: WAN, type: forward.）
 
* If you enable DMZ or "Static NAT", please add IPSec port "500,4500" to "port exception". Otherwise, IPSec connections can not be established.
 
* If you enable DMZ or "Static NAT", please add IPSec port "500,4500" to "port exception". Otherwise, IPSec connections can not be established.
 
* If the WAN interface has multiple static ip addresses, IPSec only listens in the first IP address.
 
* If the WAN interface has multiple static ip addresses, IPSec only listens in the first IP address.
Line 42: Line 37:
 
== Tunnel Status ==
 
== Tunnel Status ==
  
−
Move your mouse into the "state" icon, you will see the tunnel status and connected clients.
+
Move your mouse into the "state" icon, you will see the tunnel status and connected clients. You also can click the "view log" icon to check more log details.
  
−
[[File:ipsec03.png|1000px]]
+
[[File:ipseclog_01.png|800px]]
 +
 
 +
[[File:ipseclog_02.png|800px]]
  
 
== A site to site ipsec vpn sample ==
 
== A site to site ipsec vpn sample ==
Line 68: Line 65:
 
* Setup the IPSec tunnel
 
* Setup the IPSec tunnel
 
[[File:ipsec_client01.png|800px]]
 
[[File:ipsec_client01.png|800px]]
−
* Add a routing rule to branch C
 
−
Set branch C's LAN subnet to "Destination", set headquarter A's public IP to "Gateway". Without this routing rule, branch B can not access branch C.
 
−
 
−
[[File:ipsec_client02.png|600px]]
 
  
 
=== Branch C ===
 
=== Branch C ===
 
* Setup the IPSec tunnel
 
* Setup the IPSec tunnel
 
[[File:ipsec_client03.png|800px]]
 
[[File:ipsec_client03.png|800px]]
−
* Add a routing rule to branch B
+
 
−
Set branch B's LAN subnet to "Destination", set headquarter A's public IP to "Gateway". Without this routing rule, branch C can not access branch B.
+
By above steps, AB and AC are now connected. If you also want B and C to communicate with each other, you need to add B&C subnets in headquartor's local subnet.
  
 
[[File:ipsec_client04.png|800px]]
 
[[File:ipsec_client04.png|800px]]
  
−
By above steps, A,B,C are now in a virtual private network. If you don't want access between B and C, there is no need to add the firewall and routing rules.
+
== One-armed Deployment of IPSecVPN ==
 +
As below network diagram, WFilter NGF is deployed as a network bridge. For IPSec VPN, this is called "one-armed deployment".
 +
 
 +
[[File:passby_ipsec.png|600px]]
 +
=== Setup the IPSec tunnel ===
 +
 
 +
Choose "bridge" as the interface, you might need to setup customize local subnets.
 +
 
 +
[[File:passby_ipsec02.png|600px]]
 +
 
 +
=== Setup port forwarding in gateway ===
 +
Gateway device needs to map the IPSec ports(UDP 500 and UDP 4500) to WFilter NGF.
 +
 
 +
[[File:passby_ipsec03.png|800px]]
 +
 
 +
=== Setup routing in gateway ===
 +
 
 +
You also need to setup static routing in gateway to point nexthop of remote subnet to WFilter NGF.
 +
 
 +
[[File:passby_ipsec04.png|800px]]
 +
 
 +
IPSec tunnels are available now.
 +
 
 +
[[File:passby_ipsec05.png|800px]]
  
  
 
[[Category:VPN]]
 
[[Category:VPN]]

Latest revision as of 17:41, 28 November 2019

Contents

[edit] 1 IPSec Tunnels

This modules can build IPSec tunnels between multiple WFilter NGF networks, and make a secure site-to-site VPN. The number of IPSec Tunnels depends on your hardware performance, there is no software limit on the tunnels number.

[edit] 2 IPSec Tunnel Settings

Before you setup a IPSec tunnel, you need to design your tunnels. For example:

  • Suppose you have 3 network: A, B, C.
  • A has a static public IP, B and C ip addresses are dynamic.

The solution will be:

  • A, B, C shall have differenct subnets. For example: 192.168.10.x, 192.168.20.x, 172.16.1.x.
  • Create a tunnel in A network, set "Remote IP" to "Any".
  • Create tunnels in B and C networks, set "Remote IP" to A's public ip address.
  • Now the tunnels are ready. A, B, C now are in a VPN network. The tunnels are between AB and AC.
  • To enable access between B and C, you need to enable FORWARD in A.

Description of tunnel settings:

  • Name: tunnel name.
  • Interface: WAN interface to setup the tunnel.
  • Local Subnet: local subnet to be connected with the tunnel.
  • Remote Site: another side of the tunnel, "Any" to allow any others to connect. The remote site can be an IP address or domain.
  • Remote Subnet: remote LAN subnets which will be forwarded to the tunnel.
  • PreShared Key: tunnel secret key. With a correct key, the tunnel can not be established.
  • Mode: Server -- Waiting for clients to connect, Client -- Initiate connection to a server.
  • Firewall: Automatic -- automatic allow clients to access local subnets, Manual -- block VPN clients in default.
  • IKE, ESP: algorithm for authentication and transfer. Both sides of the tunnel shall have the same version and algorithm.

Ipsec01.png

Notice:

  • In "manual" mode, tunnel clients are blocked to local subnets. You need to set the firewall rules by yourself in "Config"->"Firewall".(Interface: WAN, type: forward.）
  • If you enable DMZ or "Static NAT", please add IPSec port "500,4500" to "port exception". Otherwise, IPSec connections can not be established.
  • If the WAN interface has multiple static ip addresses, IPSec only listens in the first IP address.

[edit] 3 Tunnel Status

Move your mouse into the "state" icon, you will see the tunnel status and connected clients. You also can click the "view log" icon to check more log details.

Ipseclog 01.png

Ipseclog 02.png

[edit] 4 A site to site ipsec vpn sample

Suppose you have 3 networks:

  • Headquarter A, static public ip address, LAN subnet is 192.168.10.0/24.
  • Branch B, PPPoE internet access, LAN subnet is 192.168.30.0/24.
  • Branch C, PPPoE internet access, LAN subnet is 172.16.1.0/24.

Now let me guide you to build a virtual private network(VPN) for these three locations.

[edit] 4.1 Settings for Headquarter A

  • Setup the IPSec tunnel

Ipsec center01.png

Ipsec center02.png

  • Enable forwarding of branches

Without this setting, branches can access headquarter, but no access between branches.

Ipsec center03.png

[edit] 4.2 Branch B

  • Setup the IPSec tunnel

Ipsec client01.png

[edit] 4.3 Branch C

  • Setup the IPSec tunnel

Ipsec client03.png

By above steps, AB and AC are now connected. If you also want B and C to communicate with each other, you need to add B&C subnets in headquartor's local subnet.

Ipsec client04.png

[edit] 5 One-armed Deployment of IPSecVPN

As below network diagram, WFilter NGF is deployed as a network bridge. For IPSec VPN, this is called "one-armed deployment".

Passby ipsec.png

[edit] 5.1 Setup the IPSec tunnel

Choose "bridge" as the interface, you might need to setup customize local subnets.

Passby ipsec02.png

[edit] 5.2 Setup port forwarding in gateway

Gateway device needs to map the IPSec ports(UDP 500 and UDP 4500) to WFilter NGF.

Passby ipsec03.png

[edit] 5.3 Setup routing in gateway

You also need to setup static routing in gateway to point nexthop of remote subnet to WFilter NGF.

Passby ipsec04.png

IPSec tunnels are available now.

Passby ipsec05.png

Retrieved from "http://wiki.wfilterngf.com/index.php?title=Ipsecvpn&oldid=1026"
Personal tools
Namespaces

Variants
Actions
Navigation
Tools