Re: [Devil-linux-develop] IPSec in 1.4RC2

[Andrzej O. <an...@ma...>]

Hi Frank,

You wrote:
> when the tunnel is up, do you see a special route on the 1.4RC2? With 
> DL-1.2.x, there is an ipsec0 device, and all remote networks that are 
> tunneled get routed through that device. I don't see anything like it in 
> DL-1.4. Even stranger ping works from the remote side, (ie icmp reply's 
> find their way through the tunnel), but I can't ping to the remote side.

There are no routes to remote IPsec-ed networks. There are only routes to 
locally connected and routed networks.  I use DL from 1.3, so I'm not sure, 
how it works in 1.2, but I suppose, in 1.2 was used 2.4 kernel and StrongSwan. 
This implementation of IPsec gives for tunnel pseudointerface (i.e. ipsec0). 
And naturally, IP stack need records in routing table for properly forwarding 
packets.

But in 2.6 kernels is builtin native IPsec stack. Because IPsec tunelling 
protocol is on 3rd level of OSI (network, not transport), in this native 
implementation there is no pseudointerfaces. Using ipsec-tools you need inject 
into kernel, using setkey, tunelling policies, containig info about source 
(your) CIDR address, destination (other side) CIDR address and via which 
tunnell (source and destination interface IP) this traffic will be routed. 
Racoon daemon is used to negotiate tunnels according to load needs.

Suppose, you have private network 192.168.0.0/24 and on other (remote) side is 
private network 172.16.0.0/24. Your internet interface has address 1.2.3.4 and 
on other side internet interface has address 5.6.7.8.

Then you define in /etc/ipsec-tools/setkey.cfg script, using spadd command, 
speeking that trafic from 192.168.0.0/24 to 172.16.0.0/24 should be encrypted 
as load into IPsec tunnel from 1.2.3.4 to 5.6.7.8. In racoon.conf You specify 
how to negotiate and establish tunnels.

When in IP stack will born traffic from 192.168.0.1 to 172.16.0.1, it will be 
compared to IPsec this policy and then encrypted into IPsec packet from 
1.2.3.4 to 5.6.7.8. If there is no negotiated tunnel between this addresses, 
IPsec stack will call racoon daemon for this tunnel to be negotiated and 
keyed. And now (!) is used routing table to properly forward this encrypted 
packet.

So in routing table there is no records for 192.168.0.0/24 and 172.16.0.0/24 
aggregates.

> Can you do site2site with OpenVPN? I use it for Point-of-Sales that 
> connect to a central DB, and am quite fond of it, but I have always 
> thought that it's more of a client-server thing, no?

Yes and no. OpenVPN is 4th OSI level tunnel, so it uses pseudointerfaces and 
routing table directioning. OpenVPN goes through all NAT translations and 
gives all possibilities. I use site2site (point-to-point) tunnels between my 
central in Warsaw and divisions in other cities on dedicated ports. So all 
corporation communicates on internal addresses. Additionally in central and in 
divisions I have OpenVPN servers for road-warriors (on 1194 port), so if one 
is working home, he establish from his notebook personal OpenVPN tunnel to 
central (or his own division) and now he has access to all hosts on private 
addresses in connected division directly and in other divisions via above 
point-to-point inter-division tunnels.

As routers I use DL in central and bigger divisions and ASUS WL-500W with 
Oleg's firmware in other places.

The one division is using old Cisco router. Cisco have not implemented 
OpenVPN, so in this direction IPsec is MHB.

After one year, 200 people get OpenVPN keys/certificates, learned how to 
install OpenVPN clients, installed it on his mobile computers and now are 
working on corporate resources from home, customer companies etc. Now I closed 
near all open ports. Additionally central WLAN segment has no acces to LAN in 
central site, but only to OpenVPN server. Our APs are near open (for guests 
use), but our workers after establishing OpenVPN tunnel have access to all 
corporate resources on this same table, where guest have access only to DMZ 
and Internet.

I think, this all is relatively simple. If You have specific question, you can 
ask on private.

Best regards

-- 
Andrzej Odyniec