268
edits
VPN: Difference between revisions
Jump to navigation
Jump to search
no edit summary
(Added Persistent SSH Tunnels) |
No edit summary |
||
| (6 intermediate revisions by the same user not shown) | |||
| Line 7: | Line 7: | ||
== IPSEC == | == IPSEC == | ||
Information on how to setup IPSEC tunnels. | Information on how to setup IPSEC tunnels. | ||
=== strongSwan to strongSwan === | |||
Use the following config for a strongSwan<ref>strongSwan Official Site [https://www.strongswan.org/]</ref> to strongSwan configuration. Make sure the left and right IP addresses are updated to match each system. You can use the same ipsec.secrets file on both systems without changing the IP address order, although I recommend changing it to having the local IP on the left and the remote on the right as shown below. | |||
====ipsec.conf==== | |||
/sec/ipsec/conf: | |||
conn <name> | |||
authby=secret | |||
auto=route # can also be start | |||
keyexchange=ike | |||
left=<your local IP> | |||
right=<remote IP of Mikrotik system> | |||
leftikeport=500 | |||
rightikeport=500 | |||
type=transport | |||
esp=aes128gcm16! | |||
dpddelay=5 | |||
dpdtimeout=20 | |||
dpdaction=clear # can also be restart | |||
====ipsec.secrets==== | |||
/etc/ipsec.secrets: | |||
<your local IP> <remote IP of Mikrotik system> : PSK "<Put your preshared key here>" | |||
=== strongSwan to MikroTik === | === strongSwan to MikroTik === | ||
Use the following configurations to connect a system running | Use the following configurations to connect a system running strongSwan to a MikroTik<ref>MikroTik Official Site [https://mikrotik.com/]</ref> device using IPSEC. | ||
==== strongSwan config ==== | ==== strongSwan config ==== | ||
The following configuration will work on FreeBSD or Linux systems with strongSwan installed. | The following configuration will work on FreeBSD or Linux systems with strongSwan installed. | ||
=====ipsec.conf===== | =====ipsec.conf===== | ||
| Line 203: | Line 226: | ||
{{go to top}} | {{go to top}} | ||
== Persistent SSH Tunnels == | ==Persistent SSH Tunnels== | ||
The following is how to create a persistent SSH Tunnel between two systems. This is handy if you want to secure data flowing across networks, or even setup a tunnel without messing with VPN configuration. | The following is how to create a persistent SSH Tunnel between two systems. This is handy if you want to secure data flowing across networks, or even setup a tunnel without messing with VPN configuration. | ||
| Line 216: | Line 238: | ||
Now switch to the user and generate an SSH key: | Now switch to the user and generate an SSH key: | ||
<pre> | <pre> | ||
su -s /bin/bash | su -s /bin/bash autossh | ||
cd ~ | cd ~ | ||
ssh-keygen -b 4096 | ssh-keygen -b 4096 | ||
| Line 228: | Line 250: | ||
===Copy public key to target system=== | ===Copy public key to target system=== | ||
You will need to copy '''''id_rsa.pub''''' file from '''''/home/ | You will need to copy '''''id_rsa.pub''''' file from '''''/home/autossh/.ssh/''''' to the '''''authorized_keys''''' file on the remote system you want to connect to for the tunnel. | ||
''Note: It is recommended that you also create a normal user on the remote system and not use root.'' | ''Note: It is recommended that you also create a normal user on the remote system and not use root.'' | ||
| Line 239: | Line 261: | ||
===Setup script=== | ===Setup script=== | ||
Copy the following script, making the necessary changes as specified between the <> and place on the system that will initiate the tunnel ( | Copy the following script, making the necessary changes as specified between the <> and place on the system that will initiate the tunnel (here we will save it as /opt/ssh-tunnel.sh): | ||
<pre> | <pre> | ||
#!/bin/sh | #!/bin/sh | ||
# | # | ||
su -s /bin/sh autossh -c 'autossh -M 0 -N -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -o "ExitOnForwardFailure=yes" -f -T -R localhost:<target port>:<local IP or localhost>:<local port> <user>@<domain>' | su -s /bin/sh autossh -c 'autossh -M 0 -N -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -o "ExitOnForwardFailure=yes" -f -T -R localhost:<target port>:<local IP or localhost>:<local port> <user>@<domain>' | ||
</pre> | </pre> | ||
{| class="wikitable" | {| class="wikitable" | ||
| Line 278: | Line 298: | ||
<pre> | <pre> | ||
chmod +x | chmod +x /opt/ssh-tunnel.sh | ||
</pre> | </pre> | ||
===Tunnel at startup=== | ===Tunnel at startup=== | ||
To have | To have the tunnel up when the system restarts, choose one of the following methods | ||
====rc.local==== | |||
Add a line to /etc/rc.local that calls the script. | |||
<pre> | <pre> | ||
/opt/ | # Start AutoSSH tunnel at boot | ||
/opt/ssh-tunnel.sh | |||
</pre> | </pre> | ||
''Note: You may have to enable rc.local on Ubuntu and Debian based systems via systemd. Refer to your distributions documentation for information on how to enable it.'' | ''Note: You may have to enable rc.local on Ubuntu and Debian based systems via systemd. Refer to your distributions documentation for information on how to enable it.'' | ||
====systemd==== | |||
To have the script start at boot with systemd, create the following file and add it to /etc/systemd/system/ssh-tunnel.service | |||
=====ssh-tunnel.service===== | |||
<pre> | |||
[Unit] | |||
Description=AutoSSH Tunnel at boot | |||
[Service] | |||
Type=oneshot | |||
ExecStart=/opt/ssh-tunnel.sh | |||
[Install] | |||
WantedBy=multi-user.target | |||
</pre> | |||
=====Enable service===== | |||
To enable the service to run via systemd run: | |||
<pre> | |||
systemctl enable ssh-tunnel.service | |||
</pre> | |||
== GRE Tunnel == | == GRE Tunnel == | ||