testing: Reorganizing IKEv1 and IKEv2 examples
For documentation purposes the new folders ikev1-algs, ikev2-algs, ikev1-multi-ca and ikev2-multi-ca have been created. Most of the test cases have now been converted to the vici interface. The remaining legacy stroke scenarios yet to be converted have been put into the ikev2-stroke-bye folder. For documentation purposes some legacy stroke scenarios will be kept in the ikev1-stroke, ikev2-stroke and ipv6-stroke folders.
This commit is contained in:
Andreas Steffen
@@ -0,0 +1,16 @@
|
||||
The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> set up
|
||||
tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router.
|
||||
Since both roadwarriors possess the same 10.1.0.0/25 subnet, gateway <b>sun</b> uses Source NAT
|
||||
after ESP decryption to map these subnets to PH_IP_CAROL10 and PH_IP_DAVE10, respectively.
|
||||
<p/>
|
||||
In order to differentiate between the tunnels to <b>alice</b> and <b>venus</b>, respectively,
|
||||
<b>XFRM marks</b> are defined for both the inbound and outbound IPsec SAs and policies using
|
||||
the <b>mark</b> parameter in ipsec.conf.
|
||||
<p/>
|
||||
<b>iptables -t mangle</b> rules are then used in the PREROUTING chain to mark the traffic to
|
||||
and from <b>alice</b> and <b>venus</b>, respectively.
|
||||
<p/>
|
||||
The script designated by <b>leftupdown=/etc/mark_updown</b> automatically inserts
|
||||
iptables mangle rules that mark the inbound ESP_IN_UDP packets as well as iptables IPsec-policy rules
|
||||
that let pass the tunneled traffic. In order to test the tunnel, the NAT-ed hosts <b>alice</b>
|
||||
and <b>venus</b> ping the client <b>bob</b> behind the gateway <b>sun</b>.
|
||||
@@ -0,0 +1,18 @@
|
||||
alice::ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*[email protected].*sun.strongswan.org::YES
|
||||
venus::ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*venus.strongswan.org.*sun.strongswan.org::YES
|
||||
alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL.*ESP in UDP::YES
|
||||
venus::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL.*ESP in UDP::YES
|
||||
sun:: ipsec status 2> /dev/null::alice.*ESTABLISHED.*sun.strongswan.org.*[email protected]::YES
|
||||
sun:: ipsec status 2> /dev/null::venus.*ESTABLISHED.*sun.strongswan.org.*venus.strongswan.org::YES
|
||||
sun:: ipsec statusall 2> /dev/null::alice.*10.2.0.0/16 === 10.1.0.0/25::YES
|
||||
sun:: ipsec statusall 2> /dev/null::venus.*10.2.0.0/16 === 10.1.0.0/25::YES
|
||||
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
||||
venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
||||
moon::tcpdump::IP moon.strongswan.org.4510.* > sun.strongswan.org.\(4500\|ipsec-nat-t\): UDP::YES
|
||||
moon::tcpdump::IP moon.strongswan.org.4520.* > sun.strongswan.org.\(4500\|ipsec-nat-t\): UDP::YES
|
||||
moon::tcpdump::IP sun.strongswan.org.\(4500\|ipsec-nat-t\) > moon.strongswan.org.4510.*: UDP::YES
|
||||
moon::tcpdump::IP sun.strongswan.org.\(4500\|ipsec-nat-t\) > moon.strongswan.org.4520.*: UDP::YES
|
||||
bob::tcpdump::PH_IP_CAROL10 > bob.strongswan.org: ICMP echo request::YES
|
||||
bob::tcpdump::PH_IP_DAVE10 > bob.strongswan.org: ICMP echo request::YES
|
||||
bob::tcpdump::bob.strongswan.org > PH_IP_CAROL10: ICMP echo reply::YES
|
||||
bob::tcpdump::bob.strongswan.org > PH_IP_DAVE10: ICMP echo reply::YES
|
||||
@@ -0,0 +1,22 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn nat-t
|
||||
left=%defaultroute
|
||||
leftsubnet=10.1.0.0/25
|
||||
leftcert=aliceCert.pem
|
||||
[email protected]
|
||||
leftfirewall=yes
|
||||
lefthostaccess=yes
|
||||
right=PH_IP_SUN
|
||||
[email protected]
|
||||
rightsubnet=10.2.0.0/16
|
||||
auto=add
|
||||
@@ -0,0 +1,5 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn alice
|
||||
[email protected]
|
||||
mark=10/0xffffffff
|
||||
also=sun
|
||||
auto=add
|
||||
|
||||
conn venus
|
||||
[email protected]
|
||||
mark=20 #0xffffffff is used by default
|
||||
also=sun
|
||||
auto=add
|
||||
|
||||
conn sun
|
||||
left=PH_IP_SUN
|
||||
leftcert=sunCert.pem
|
||||
[email protected]
|
||||
leftsubnet=10.2.0.0/16
|
||||
leftupdown=/etc/mark_updown
|
||||
right=%any
|
||||
rightsubnet=0.0.0.0/0
|
||||
@@ -0,0 +1,24 @@
|
||||
*filter
|
||||
|
||||
# default policy is DROP
|
||||
-P INPUT DROP
|
||||
-P OUTPUT DROP
|
||||
-P FORWARD DROP
|
||||
|
||||
# allow IKE
|
||||
-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
|
||||
|
||||
# allow MobIKE
|
||||
-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
|
||||
|
||||
# allow ssh
|
||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
COMMIT
|
||||
@@ -0,0 +1,417 @@
|
||||
#!/bin/sh
|
||||
# updown script setting inbound marks on ESP traffic in the mangle chain
|
||||
#
|
||||
# Copyright (C) 2003-2004 Nigel Meteringham
|
||||
# Copyright (C) 2003-2004 Tuomo Soini
|
||||
# Copyright (C) 2002-2004 Michael Richardson
|
||||
# Copyright (C) 2005-2010 Andreas Steffen <[email protected]>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License as published by the
|
||||
# Free Software Foundation; either version 2 of the License, or (at your
|
||||
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# for more details.
|
||||
|
||||
# CAUTION: Installing a new version of strongSwan will install a new
|
||||
# copy of this script, wiping out any custom changes you make. If
|
||||
# you need changes, make a copy of this under another name, and customize
|
||||
# that, and use the (left/right)updown parameters in ipsec.conf to make
|
||||
# strongSwan use yours instead of this default one.
|
||||
|
||||
# PLUTO_VERSION
|
||||
# indicates what version of this interface is being
|
||||
# used. This document describes version 1.1. This
|
||||
# is upwardly compatible with version 1.0.
|
||||
#
|
||||
# PLUTO_VERB
|
||||
# specifies the name of the operation to be performed
|
||||
# (prepare-host, prepare-client, up-host, up-client,
|
||||
# down-host, or down-client). If the address family
|
||||
# for security gateway to security gateway communica-
|
||||
# tions is IPv6, then a suffix of -v6 is added to the
|
||||
# verb.
|
||||
#
|
||||
# PLUTO_CONNECTION
|
||||
# is the name of the connection for which we are
|
||||
# routing.
|
||||
#
|
||||
# PLUTO_INTERFACE
|
||||
# is the name of the ipsec interface to be used.
|
||||
#
|
||||
# PLUTO_REQID
|
||||
# is the reqid of the AH|ESP policy
|
||||
#
|
||||
# PLUTO_PROTO
|
||||
# is the negotiated IPsec protocol, ah|esp
|
||||
#
|
||||
# PLUTO_IPCOMP
|
||||
# is not empty if IPComp was negotiated
|
||||
#
|
||||
# PLUTO_UNIQUEID
|
||||
# is the unique identifier of the associated IKE_SA
|
||||
#
|
||||
# PLUTO_ME
|
||||
# is the IP address of our host.
|
||||
#
|
||||
# PLUTO_MY_ID
|
||||
# is the ID of our host.
|
||||
#
|
||||
# PLUTO_MY_CLIENT
|
||||
# is the IP address / count of our client subnet. If
|
||||
# the client is just the host, this will be the
|
||||
# host's own IP address / max (where max is 32 for
|
||||
# IPv4 and 128 for IPv6).
|
||||
#
|
||||
# PLUTO_MY_SOURCEIP
|
||||
# PLUTO_MY_SOURCEIP4_$i
|
||||
# PLUTO_MY_SOURCEIP6_$i
|
||||
# contains IPv4/IPv6 virtual IP received from a responder,
|
||||
# $i enumerates from 1 to the number of IP per address family.
|
||||
# PLUTO_MY_SOURCEIP is a legacy variable and equal to the first
|
||||
# virtual IP, IPv4 or IPv6.
|
||||
#
|
||||
# PLUTO_MY_PROTOCOL
|
||||
# is the IP protocol that will be transported.
|
||||
#
|
||||
# PLUTO_MY_PORT
|
||||
# is the UDP/TCP port to which the IPsec SA is
|
||||
# restricted on our side. For ICMP/ICMPv6 this contains the
|
||||
# message type, and PLUTO_PEER_PORT the message code.
|
||||
#
|
||||
# PLUTO_PEER
|
||||
# is the IP address of our peer.
|
||||
#
|
||||
# PLUTO_PEER_ID
|
||||
# is the ID of our peer.
|
||||
#
|
||||
# PLUTO_PEER_CLIENT
|
||||
# is the IP address / count of the peer's client sub-
|
||||
# net. If the client is just the peer, this will be
|
||||
# the peer's own IP address / max (where max is 32
|
||||
# for IPv4 and 128 for IPv6).
|
||||
#
|
||||
# PLUTO_PEER_SOURCEIP
|
||||
# PLUTO_PEER_SOURCEIP4_$i
|
||||
# PLUTO_PEER_SOURCEIP6_$i
|
||||
# contains IPv4/IPv6 virtual IP sent to an initiator,
|
||||
# $i enumerates from 1 to the number of IP per address family.
|
||||
# PLUTO_PEER_SOURCEIP is a legacy variable and equal to the first
|
||||
# virtual IP, IPv4 or IPv6.
|
||||
#
|
||||
# PLUTO_PEER_PROTOCOL
|
||||
# is the IP protocol that will be transported.
|
||||
#
|
||||
# PLUTO_PEER_PORT
|
||||
# is the UDP/TCP port to which the IPsec SA is
|
||||
# restricted on the peer side. For ICMP/ICMPv6 this contains the
|
||||
# message code, and PLUTO_MY_PORT the message type.
|
||||
#
|
||||
# PLUTO_XAUTH_ID
|
||||
# is an optional user ID employed by the XAUTH protocol
|
||||
#
|
||||
# PLUTO_MARK_IN
|
||||
# is an optional XFRM mark set on the inbound IPsec SA
|
||||
#
|
||||
# PLUTO_MARK_OUT
|
||||
# is an optional XFRM mark set on the outbound IPsec SA
|
||||
#
|
||||
# PLUTO_IF_ID_IN
|
||||
# is an optional XFRM interface ID set on the inbound IPsec SA
|
||||
#
|
||||
# PLUTO_IF_ID_OUT
|
||||
# is an optional XFRM interface ID set on the outbound IPsec SA
|
||||
#
|
||||
# PLUTO_UDP_ENC
|
||||
# contains the remote UDP port in the case of ESP_IN_UDP
|
||||
# encapsulation
|
||||
#
|
||||
# PLUTO_DNS4_$i
|
||||
# PLUTO_DNS6_$i
|
||||
# contains IPv4/IPv6 DNS server attribute received from a
|
||||
# responder, $i enumerates from 1 to the number of servers per
|
||||
# address family.
|
||||
#
|
||||
|
||||
# define a minimum PATH environment in case it is not set
|
||||
PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin:/usr/local/sbin"
|
||||
export PATH
|
||||
|
||||
# comment to disable logging VPN connections to syslog
|
||||
VPN_LOGGING=1
|
||||
#
|
||||
# tag put in front of each log entry:
|
||||
TAG=vpn
|
||||
#
|
||||
# syslog facility and priority used:
|
||||
FAC_PRIO=local0.notice
|
||||
#
|
||||
# to create a special vpn logging file, put the following line into
|
||||
# the syslog configuration file /etc/syslog.conf:
|
||||
#
|
||||
# local0.notice -/var/log/vpn
|
||||
|
||||
# check interface version
|
||||
case "$PLUTO_VERSION" in
|
||||
1.[0|1]) # Older release?!? Play it safe, script may be using new features.
|
||||
echo "$0: obsolete interface version \`$PLUTO_VERSION'," >&2
|
||||
echo "$0: called by obsolete release?" >&2
|
||||
exit 2
|
||||
;;
|
||||
1.*) ;;
|
||||
*) echo "$0: unknown interface version \`$PLUTO_VERSION'" >&2
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
|
||||
# check parameter(s)
|
||||
case "$1:$*" in
|
||||
':') # no parameters
|
||||
;;
|
||||
iptables:iptables) # due to (left/right)firewall; for default script only
|
||||
;;
|
||||
custom:*) # custom parameters (see above CAUTION comment)
|
||||
;;
|
||||
*) echo "$0: unknown parameters \`$*'" >&2
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
|
||||
IPSEC_POLICY="-m policy --pol ipsec --proto $PLUTO_PROTO --reqid $PLUTO_REQID"
|
||||
IPSEC_POLICY_IN="$IPSEC_POLICY --dir in"
|
||||
IPSEC_POLICY_OUT="$IPSEC_POLICY --dir out"
|
||||
|
||||
# use protocol specific options to set ports
|
||||
case "$PLUTO_MY_PROTOCOL" in
|
||||
1) # ICMP
|
||||
ICMP_TYPE_OPTION="--icmp-type"
|
||||
;;
|
||||
58) # ICMPv6
|
||||
ICMP_TYPE_OPTION="--icmpv6-type"
|
||||
;;
|
||||
*)
|
||||
;;
|
||||
esac
|
||||
|
||||
# are there port numbers?
|
||||
if [ "$PLUTO_MY_PORT" != 0 ]
|
||||
then
|
||||
if [ -n "$ICMP_TYPE_OPTION" ]
|
||||
then
|
||||
S_MY_PORT="$ICMP_TYPE_OPTION $PLUTO_MY_PORT"
|
||||
D_MY_PORT="$ICMP_TYPE_OPTION $PLUTO_MY_PORT"
|
||||
else
|
||||
S_MY_PORT="--sport $PLUTO_MY_PORT"
|
||||
D_MY_PORT="--dport $PLUTO_MY_PORT"
|
||||
fi
|
||||
fi
|
||||
if [ "$PLUTO_PEER_PORT" != 0 ]
|
||||
then
|
||||
if [ -n "$ICMP_TYPE_OPTION" ]
|
||||
then
|
||||
# the syntax is --icmp[v6]-type type[/code], so add it to the existing option
|
||||
S_MY_PORT="$S_MY_PORT/$PLUTO_PEER_PORT"
|
||||
D_MY_PORT="$D_MY_PORT/$PLUTO_PEER_PORT"
|
||||
else
|
||||
S_PEER_PORT="--sport $PLUTO_PEER_PORT"
|
||||
D_PEER_PORT="--dport $PLUTO_PEER_PORT"
|
||||
fi
|
||||
fi
|
||||
|
||||
# is there an inbound mark to be set?
|
||||
if [ -n "$PLUTO_MARK_IN" ]
|
||||
then
|
||||
if [ -n "$PLUTO_UDP_ENC" ]
|
||||
then
|
||||
SET_MARK="-p udp --sport $PLUTO_UDP_ENC"
|
||||
else
|
||||
SET_MARK="-p $PLUTO_PROTO"
|
||||
fi
|
||||
SET_MARK="$SET_MARK -s $PLUTO_PEER -j MARK --set-mark $PLUTO_MARK_IN"
|
||||
fi
|
||||
|
||||
# resolve octal escape sequences
|
||||
PLUTO_MY_ID=`printf "$PLUTO_MY_ID"`
|
||||
PLUTO_PEER_ID=`printf "$PLUTO_PEER_ID"`
|
||||
|
||||
case "$PLUTO_VERB:$1" in
|
||||
up-host:)
|
||||
# connection to me coming up
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
if [ -n "$PLUTO_MARK_IN" ]
|
||||
then
|
||||
iptables -t mangle -A PREROUTING $SET_MARK
|
||||
fi
|
||||
iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
|
||||
#
|
||||
# allow IPIP traffic because of the implicit SA created by the kernel if
|
||||
# IPComp is used (for small inbound packets that are not compressed)
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
iptables -I INPUT 1 -i $PLUTO_INTERFACE -p 4 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec host connection setup
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
down-host:)
|
||||
# connection to me going down
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
if [ -n "$PLUTO_MARK_IN" ]
|
||||
then
|
||||
iptables -t mangle -D PREROUTING $SET_MARK
|
||||
fi
|
||||
iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
|
||||
#
|
||||
# IPIP exception teardown
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
iptables -D INPUT -i $PLUTO_INTERFACE -p 4 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec host connection teardown
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
up-client:)
|
||||
# connection to my client subnet coming up
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
if [ -n "$PLUTO_MARK_IN" ]
|
||||
then
|
||||
iptables -t mangle -A PREROUTING $SET_MARK
|
||||
fi
|
||||
if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ]
|
||||
then
|
||||
iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
|
||||
iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# a virtual IP requires an INPUT and OUTPUT rule on the host
|
||||
# or sometimes host access via the internal IP is needed
|
||||
if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
|
||||
then
|
||||
iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# allow IPIP traffic because of the implicit SA created by the kernel if
|
||||
# IPComp is used (for small inbound packets that are not compressed).
|
||||
# INPUT is correct here even for forwarded traffic.
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
iptables -I INPUT 1 -i $PLUTO_INTERFACE -p 4 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec client connection setup
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
down-client:)
|
||||
# connection to my client subnet going down
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
if [ -n "$PLUTO_MARK_IN" ]
|
||||
then
|
||||
iptables -t mangle -D PREROUTING $SET_MARK
|
||||
fi
|
||||
if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ]
|
||||
then
|
||||
iptables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT \
|
||||
$IPSEC_POLICY_OUT -j ACCEPT
|
||||
iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT \
|
||||
$IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# a virtual IP requires an INPUT and OUTPUT rule on the host
|
||||
# or sometimes host access via the internal IP is needed
|
||||
if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
|
||||
then
|
||||
iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT \
|
||||
$IPSEC_POLICY_IN -j ACCEPT
|
||||
iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT \
|
||||
$IPSEC_POLICY_OUT -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# IPIP exception teardown
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
iptables -D INPUT -i $PLUTO_INTERFACE -p 4 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec client connection teardown
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
*) echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
@@ -0,0 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
|
||||
syslog {
|
||||
daemon {
|
||||
knl = 2
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn nat-t
|
||||
left=%defaultroute
|
||||
leftsubnet=10.1.0.0/25
|
||||
leftcert=venusCert.pem
|
||||
[email protected]
|
||||
leftfirewall=yes
|
||||
lefthostaccess=yes
|
||||
right=PH_IP_SUN
|
||||
[email protected]
|
||||
rightsubnet=10.2.0.0/16
|
||||
auto=add
|
||||
@@ -0,0 +1,5 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
sun::iptables -t mangle -v -n -L PREROUTING
|
||||
sun::ipsec stop
|
||||
alice::ipsec stop
|
||||
venus::ipsec stop
|
||||
alice::iptables-restore < /etc/iptables.flush
|
||||
venus::iptables-restore < /etc/iptables.flush
|
||||
sun::iptables-restore < /etc/iptables.flush
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
sun::iptables-restore < /etc/iptables.flush
|
||||
sun::rm /etc/mark_updown
|
||||
@@ -0,0 +1,21 @@
|
||||
sun::iptables-restore < /etc/iptables.rules
|
||||
alice::iptables-restore < /etc/iptables.rules
|
||||
venus::iptables-restore < /etc/iptables.rules
|
||||
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to PH_IP_MOON
|
||||
moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_ALICE -p udp --sport 500 -j SNAT --to PH_IP_MOON:510
|
||||
moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_VENUS -p udp --sport 500 -j SNAT --to PH_IP_MOON:520
|
||||
moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_ALICE -p udp --sport 4500 -j SNAT --to PH_IP_MOON:4510
|
||||
moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_VENUS -p udp --sport 4500 -j SNAT --to PH_IP_MOON:4520
|
||||
sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 10 -j SNAT --to PH_IP_CAROL10
|
||||
sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 20 -j SNAT --to PH_IP_DAVE10
|
||||
sun::iptables -t mangle -A PREROUTING -d PH_IP_CAROL10 -j MARK --set-mark 10
|
||||
sun::iptables -t mangle -A PREROUTING -d PH_IP_DAVE10 -j MARK --set-mark 20
|
||||
sun::ipsec start
|
||||
alice::ipsec start
|
||||
venus::ipsec start
|
||||
sun::expect-connection alice
|
||||
sun::expect-connection venus
|
||||
alice::expect-connection nat-t
|
||||
alice::ipsec up nat-t
|
||||
venus::expect-connection nat-t
|
||||
venus::ipsec up nat-t
|
||||
@@ -0,0 +1,21 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="alice venus moon winnetou sun bob"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="a-v-m-w-s-b.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="moon bob"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="alice venus sun"
|
||||
Reference in New Issue
Block a user