testing: Migrated p2pnat/behind-same-nat scenario to vici
This commit is contained in:
Andreas Steffen
@@ -1,11 +1,9 @@
|
||||
alice::ipsec status 2> /dev/null::medsrv.*ESTABLISHED.*[email protected].*[email protected]::YES
|
||||
venus::ipsec status 2> /dev/null::medsrv.*ESTABLISHED.*[email protected].*[email protected]::YES
|
||||
carol::ipsec status 2> /dev/null::medsrv.*ESTABLISHED.*PH_IP_MOON.*[email protected]::YES
|
||||
carol::ipsec status 2> /dev/null::medsrv.*ESTABLISHED.*PH_IP_MOON.*[email protected]::YES
|
||||
alice::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::medsrv.*version=2 state=ESTABLISHED local-host=10.1.0.10 local-port=4500 [email protected] remote-host=192.168.0.100 remote-port=4500 [email protected].*nat-local=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519::YES
|
||||
venus::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::medsrv.*version=2 state=ESTABLISHED local-host=10.1.0.20 local-port=4500 [email protected] remote-host=192.168.0.100 remote-port=4500 [email protected].*nat-local=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519::YES
|
||||
carol::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::medsrv.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=.*[email protected].*nat-remote=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519::YES
|
||||
carol::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::medsrv.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=.*[email protected].*nat-remote=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519::YES
|
||||
alice::cat /var/log/daemon.log::received ME_CALLBACK::YES
|
||||
alice::ipsec status 2> /dev/null::peer.*ESTABLISHED.*[email protected].*venus.strongswan.org::YES
|
||||
venus::ipsec status 2> /dev/null::peer.*ESTABLISHED.*venus.strongswan.org.*[email protected]::YES
|
||||
alice::ipsec status 2> /dev/null::peer.*INSTALLED, TUNNEL::YES
|
||||
venus::ipsec status 2> /dev/null::peer.*INSTALLED, TUNNEL::YES
|
||||
alice::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::peer.*version=2 state=ESTABLISHED local-host=10.1.0.10 local-port=4500 [email protected] remote-host=10.1.0.20 remote-port=4500 remote-id=venus.strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*peer.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.10/32] remote-ts=\[10.1.0.20/32]::YES
|
||||
venus::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::peer.*version=2 state=ESTABLISHED local-host=10.1.0.20 local-port=4500 local-id=venus.strongswan.org remote-host=10.1.0.10 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*peer.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.20/32] remote-ts=\[10.1.0.10/32]::YES
|
||||
alice::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::YES
|
||||
venus::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
|
||||
@@ -1,34 +0,0 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
mobike=no
|
||||
dpdaction=restart
|
||||
dpddelay=60s
|
||||
left=%defaultroute
|
||||
leftfirewall=yes
|
||||
|
||||
conn medsrv
|
||||
[email protected]
|
||||
leftauth=psk
|
||||
right=PH_IP_CAROL
|
||||
[email protected]
|
||||
rightauth=pubkey
|
||||
mediation=yes
|
||||
auto=add
|
||||
|
||||
conn peer
|
||||
leftcert=aliceCert.pem
|
||||
[email protected]
|
||||
right=%any
|
||||
[email protected]
|
||||
rightsubnet=PH_IP_VENUS/32
|
||||
mediated_by=medsrv
|
||||
[email protected]
|
||||
auto=start
|
||||
@@ -1,7 +0,0 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
: RSA aliceKey.pem
|
||||
|
||||
# secret used for mediation connection
|
||||
|
||||
[email protected] : PSK "BAXz/6cSITttd0CzF9799p859Pi4LPnP"
|
||||
@@ -1,5 +1,5 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
|
||||
}
|
||||
|
||||
@@ -0,0 +1,54 @@
|
||||
connections {
|
||||
|
||||
medsrv {
|
||||
remote_addrs = 192.168.0.100
|
||||
|
||||
local {
|
||||
auth = psk
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = [email protected]
|
||||
}
|
||||
|
||||
version = 2
|
||||
mobike = no
|
||||
mediation = yes
|
||||
proposals = aes128-sha256-x25519
|
||||
}
|
||||
|
||||
peer {
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = aliceCert.pem
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = venus.strongswan.org
|
||||
}
|
||||
children {
|
||||
peer {
|
||||
remote_ts = 10.1.0.20
|
||||
|
||||
start_action = start
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm128-x25519
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
mobike = no
|
||||
mediated_by = medsrv
|
||||
mediation_peer = [email protected]
|
||||
proposals = aes128-sha256-x25519
|
||||
}
|
||||
}
|
||||
|
||||
secrets {
|
||||
|
||||
ike-medsrv {
|
||||
id = [email protected]
|
||||
secret = 0sBAXz/6cSITttd0CzF9799p859Pi4LPnP
|
||||
}
|
||||
}
|
||||
@@ -1,24 +0,0 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
mobike=no
|
||||
dpdaction=clear
|
||||
dpddelay=60s
|
||||
|
||||
conn medsrv
|
||||
left=PH_IP_CAROL
|
||||
leftcert=carolCert.pem
|
||||
[email protected]
|
||||
leftauth=pubkey
|
||||
leftfirewall=yes
|
||||
right=%any
|
||||
rightauth=psk
|
||||
mediation=yes
|
||||
auto=add
|
||||
@@ -1,11 +0,0 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
: RSA carolKey.pem "nH5ZQEWtku0RJEZ6"
|
||||
|
||||
# Mediation clients with random IDs
|
||||
|
||||
[email protected] : PSK "BAXz/6cSITttd0CzF9799p859Pi4LPnP"
|
||||
|
||||
[email protected] : PSK "9tb3wiUGqUwCSRIRAwLFWfkdA8u6hHA8"
|
||||
|
||||
[email protected] : PSK "ZVm3FLOiweS1ywUDpR/L9FvpwNYp9svt"
|
||||
@@ -1,5 +1,5 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
|
||||
}
|
||||
|
||||
@@ -0,0 +1,36 @@
|
||||
connections {
|
||||
|
||||
medsrv {
|
||||
local_addrs = 192.168.0.100
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = carolCert.pem
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = psk
|
||||
}
|
||||
|
||||
version = 2
|
||||
mobike = no
|
||||
mediation = yes
|
||||
proposals = aes128-sha256-x25519
|
||||
}
|
||||
}
|
||||
|
||||
secrets {
|
||||
|
||||
ike-1 {
|
||||
id = [email protected]
|
||||
secret = 0sBAXz/6cSITttd0CzF9799p859Pi4LPnP
|
||||
}
|
||||
ike-2 {
|
||||
id = [email protected]
|
||||
secret = 0s9tb3wiUGqUwCSRIRAwLFWfkdA8u6hHA8
|
||||
}
|
||||
ike-3 {
|
||||
id = [email protected]
|
||||
secret = 0sZVm3FLOiweS1ywUDpR/L9FvpwNYp9svt
|
||||
}
|
||||
}
|
||||
@@ -1,34 +0,0 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
mobike=no
|
||||
dpdaction=restart
|
||||
dpddelay=60s
|
||||
left=%defaultroute
|
||||
leftfirewall=yes
|
||||
|
||||
conn medsrv
|
||||
[email protected]
|
||||
leftauth=psk
|
||||
right=PH_IP_CAROL
|
||||
[email protected]
|
||||
rightauth=pubkey
|
||||
mediation=yes
|
||||
auto=start
|
||||
|
||||
conn peer
|
||||
leftcert=venusCert.pem
|
||||
[email protected]
|
||||
right=%any
|
||||
[email protected]
|
||||
rightsubnet=PH_IP_ALICE/32
|
||||
mediated_by=medsrv
|
||||
[email protected]
|
||||
auto=add
|
||||
@@ -1,7 +0,0 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
: RSA venusKey.pem
|
||||
|
||||
# secret used for mediation connection
|
||||
|
||||
[email protected] : PSK "9tb3wiUGqUwCSRIRAwLFWfkdA8u6hHA8"
|
||||
@@ -1,5 +1,5 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
|
||||
}
|
||||
|
||||
@@ -0,0 +1,57 @@
|
||||
connections {
|
||||
|
||||
medsrv {
|
||||
remote_addrs = 192.168.0.100
|
||||
|
||||
local {
|
||||
auth = psk
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = [email protected]
|
||||
}
|
||||
children {
|
||||
medserv {
|
||||
start_action = start
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
mobike = no
|
||||
mediation = yes
|
||||
proposals = aes128-sha256-x25519
|
||||
}
|
||||
|
||||
peer {
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = venusCert.pem
|
||||
id = venus.strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = [email protected]
|
||||
}
|
||||
children {
|
||||
peer {
|
||||
remote_ts = 10.1.0.10
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm128-x25519
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
mobike = no
|
||||
mediated_by = medsrv
|
||||
mediation_peer = [email protected]
|
||||
proposals = aes128-sha256-x25519
|
||||
}
|
||||
}
|
||||
|
||||
secrets {
|
||||
|
||||
ike-medsrv {
|
||||
id = [email protected]
|
||||
secret = 0s9tb3wiUGqUwCSRIRAwLFWfkdA8u6hHA8
|
||||
}
|
||||
}
|
||||
@@ -1,6 +1,6 @@
|
||||
venus::ipsec stop
|
||||
alice::ipsec stop
|
||||
carol::ipsec stop
|
||||
venus::systemctl stop strongswan
|
||||
alice::systemctl stop strongswan
|
||||
carol::systemctl stop strongswan
|
||||
alice::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
venus::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -6,9 +6,9 @@ moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-
|
||||
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
|
||||
moon::iptables -A FORWARD -i eth1 -o eth0 -s 10.1.0.0/16 -j ACCEPT
|
||||
moon::iptables -A FORWARD -i eth0 -o eth1 -d 10.1.0.0/16 -j ACCEPT
|
||||
carol::ipsec start
|
||||
carol::systemctl start strongswan
|
||||
carol::expect-connection medsrv
|
||||
alice::ipsec start
|
||||
alice::systemctl start strongswan
|
||||
alice::sleep 1
|
||||
venus::ipsec start
|
||||
venus::systemctl start strongswan
|
||||
venus::sleep 2
|
||||
|
||||
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="moon"
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="alice venus carol"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
|
||||
Reference in New Issue
Block a user