StrongSwan (Linux IPsec gateway)

Níže popsané nastavení pokrývá většinu současných zařízení a jejich implementaci IPsec. Konkrétně Android, Blackberry, a samozřejmě plnohodnotnější implementace v BSD nebo Linuxu.

#!/bin/bash

#
# $1 = Egothor
# $2 = ipsec-gtw.egothor.org
# $3 = 7.7.7.7 (veřejně dostupná IP adresa brány)
# $4 = 8.8.8.8 (rozhodně použijte vlastní DNS)
#

echo ": RSA vpnHostKey.der" > /etc/strongswan/ipsec.secrets

cat >/etc/strongswan/ipsec.conf <<EOF
config setup
    charondebug="ike 2, knl 2, cfg 2, net 2, esp 2, dmn 2,  mgr 2"

conn %default
    keyexchange=ikev2
    ike=aes128-sha256-ecp256,aes256-sha384-ecp384,aes128-sha256-modp2048,aes128-sha1-modp2048,aes256-sha384-modp4096,aes256-sha256-modp4096,aes256-sha1-modp4096,aes128-sha256-modp1536,aes128-sha1-modp1536,aes256-sha384-modp2048,aes256-sha256-modp2048,aes256-sha1-modp2048,aes128-sha256-modp1024,aes128-sha1-modp1024,aes256-sha384-modp1536,aes256-sha256-modp1536,aes256-sha1-modp1536,aes256-sha384-modp1024,aes256-sha256-modp1024,aes256-sha1-modp1024!
    esp=aes128gcm16-ecp256,aes256gcm16-ecp384,aes128-sha256-ecp256,aes256-sha384-ecp384,aes128-sha256-modp2048,aes128-sha1-modp2048,aes256-sha384-modp4096,aes256-sha256-modp4096,aes256-sha1-modp4096,aes128-sha256-modp1536,aes128-sha1-modp1536,aes256-sha384-modp2048,aes256-sha256-modp2048,aes256-sha1-modp2048,aes128-sha256-modp1024,aes128-sha1-modp1024,aes256-sha384-modp1536,aes256-sha256-modp1536,aes256-sha1-modp1536,aes256-sha384-modp1024,aes256-sha256-modp1024,aes256-sha1-modp1024,aes128gcm16,aes256gcm16,aes128-sha256,aes128-sha1,aes256-sha384,aes256-sha256,aes256-sha1!
    dpdaction=clear
    dpddelay=300s
    rekey=no
    left=%any
    leftsubnet=0.0.0.0/0
    leftcert=vpnHostCert.der
    right=%any
    rightdns=$4
    rightsourceip=10.250.0.0/16

conn IPSec-IKEv2
    keyexchange=ikev2
    auto=add

conn IPSec-IKEv2-EAP
    also="IPSec-IKEv2"
    rightauth=eap-mschapv2
    rightauth2=pubkey
    rightsendcert=never
    eap_identity=%any

conn CiscoIPSec
    keyexchange=ikev1
    forceencaps=yes
    authby=xauthrsasig
    xauth=server
    auto=add
EOF

yum install haveged
systemctl enable haveged
systemctl start haveged
cd /etc/strongswan
strongswan pki --gen --type rsa --size 4096 --outform der > ipsec.d/private/strongswanKey.der
chmod 600 ipsec.d/private/strongswanKey.der
strongswan pki --self --ca --lifetime 3650 --in ipsec.d/private/strongswanKey.der --type rsa --dn "C=CZ, O=$1, CN=VPN CA" -- outform der > ipsec.d/cacerts/strongswanCert.der
strongswan  pki --print --in ipsec.d/cacerts/strongswanCert.der
strongswan pki --gen --type rsa --size 2048 --outform der > ipsec.d/private/vpnHostKey.der
chmod 600 ipsec.d/private/vpnHostKey.der
strongswan pki --pub --in ipsec.d/private/vpnHostKey.der --type rsa | strongswan pki --issue --lifetime 730 --cacert ipsec.d/cacerts/strongswanCert.der --cakey ipsec.d/private/strongswanKey.der --dn "C=CZ, O=$1, CN=$2" --san $3 --san @$3 --flag serverAuth --flag ikeIntermediate --outform der > ipsec.d/certs/vpnHostCert.der
strongswan pki --print --in ipsec.d/certs/vpnHostCert.der
openssl x509 -inform DER -in ipsec.d/certs/vpnHostCert.der -noout -text

#
# $1 = LeoGalambos (id uživatele)
# $2 = test@hq.egothor.org (email uživatele)
# $3 = Egothor (musí odpovídat parametru $1 ze skriptu pro nastavení démona)
#

cd /etc/strongswan/
strongswan pki --gen --type rsa --size 2048 --outform der > ipsec.d/private/$1.der
chmod 600 ipsec.d/private/$1.der 
strongswan pki --pub --in ipsec.d/private/$1.der --type rsa | strongswan pki --issue --lifetime 730 --cacert ipsec.d/cacerts/strongswanCert.der --cakey ipsec.d/private/strongswanKey.der --dn "C=CZ, O=$3, CN=$2" --san $2 --outform der > ipsec.d/certs/$1.der
openssl rsa -inform DER -in ipsec.d/private/$1.der -out ipsec.d/private/$1.pem -outform PEM
openssl x509 -inform DER -in ipsec.d/certs/$1.der -out ipsec.d/certs/$1.pem -outform PEM
openssl x509 -inform DER -in ipsec.d/cacerts/strongswanCert.der -out ipsec.d/cacerts/strongswanCert.pem -outform PEM
openssl pkcs12 -export  -inkey ipsec.d/private/$1.pem -in ipsec.d/certs/$1.pem -name "$1 VPN certificate" -certfile ipsec.d/cacerts/strongswanCert.pem -caname "$3 VPN Root CA" -out $1.p12

strongswan: 13[TLS] processing buffered TLS Handshake record (1424 bytes)
strongswan: 13[TLS] received TLS Certificate handshake (1088 bytes)
strongswan: 13[TLS] received TLS peer certificate 'C=.., O=...., CN=atributCNcertifikátu'
strongswan: 13[TLS] received TLS ClientKeyExchange handshake (66 bytes)
strongswan: 13[TLS] received TLS CertificateVerify handshake (258 bytes)
strongswan: 13[TLS] no trusted certificate found for 'atributCNcertifikátu' to verify TLS peer
strongswan: 13[TLS] processing TLS ChangeCipherSpec record (1 bytes)
strongswan: 13[TLS] processing TLS Handshake record (48 bytes)
strongswan: 13[TLS] sending fatal TLS alert 'certificate unknown'
strongswan: 13[TLS] sending TLS Alert record (2 bytes)
strongswan: 13[TLS] sending EAP_TLS packet (17 bytes)

IPtables

*filter
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p esp -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -i eth0 -p ah -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 500 -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 4500 -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.250.0.0/16 -m policy --dir in --pol ipsec --mode tunnel --tunnel-dst 7.7.7.7 -j ACCEPT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.250.0.0/16 -m policy --dir in --pol ipsec --mode tunnel --tunnel-dst 7.7.7.7 -j ACCEPT
-A FORWARD -d 10.250.0.0/16 -m policy --dir out --pol ipsec --mode tunnel --tunnel-src 7.7.7.7 -j ACCEPT
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p esp -m conntrack --ctstate NEW -j ACCEPT
-A OUTPUT -o eth0 -p ah -m conntrack --ctstate NEW -j ACCEPT
-A OUTPUT -d 10.250.0.0/16 -m policy --dir out --pol ipsec --mode tunnel --tunnel-src 7.7.7.7 -j ACCEPT
-A OUTPUT -d 10.0.0.0/8 -o eth0 -j DROP
-A OUTPUT -d 172.16.0.0/12 -o eth0 -j DROP
-A OUTPUT -d 192.168.0.0/16 -o eth0 -j DROP
-A OUTPUT -s 7.7.7.7/32 -o eth0 -j ACCEPT

Samozřejmě vše ostatní by mělo skončit s DROP. Pro přístup klientů ven do internetu je samozřejmě možné přidat ještě:

*nat
-A POSTROUTING -o eth0 -j MASQUERADE