Native IPsec tunnel - Revision history

Saruman!: IPsec software installation added

2008-05-18T20:54:02Z

IPsec software installation added

← Older revision		Revision as of 20:54, 18 May 2008
Line 3:		Line 3:
	==Preparations==		==Preparations==

	To set up a site-to-site tunnel using IPsec, we start with a [[Debian Etch base server]]. Use ''[[APT and aptitude \| aptitude]]'' to update all packages on the server to the latest version. Then check that your kernel [[Roll your own kernel \| is compiled]] with the right options for IPsec. These options can be found under ''networking > networking options'' and include at least (but may not be limited to):		To set up a site-to-site tunnel using IPsec, we start with a [[Debian Etch base server]]. Use ''[[APT and aptitude \| aptitude]]'' to update all packages on the server to the latest version. Then check that your kernel is at least version 2.6, and [[Roll your own kernel \| is compiled]] with the right options for IPsec. These options can be found under ''networking > networking options'' and include at least (but may not be limited to):
	<pre>		<pre>
	(*) PF_KEY sockets (NET_KEY)		(*) PF_KEY sockets (NET_KEY)
Line 10:		Line 10:
	</pre>		</pre>
	Of course, in newer versions of the kernel than the 2.6.25 from which we lifted these terms, these options could be named differently.		Of course, in newer versions of the kernel than the 2.6.25 from which we lifted these terms, these options could be named differently.
			Furthermore, your kernel must have <u>all</u> the cryptographic options enabled for the compression/encryprion that your tunnels are supposed to use, e.g. AES, Blowfish et cetera.

	Next off, it's time to install the necessary Debian packages. The two packages needed are:		Next off, it's time to install the necessary Debian packages. The two packages needed are:
	* racoon: this is a		* racoon: this is a tool for handling IKE (Internet Key Exchange)
	* ipsec-tools:		* ipsec-tools: this is a set of IPsec utilities.
	Now, we have to ~~decide whether~~ we want		Now, since we run Debian, things are slightly different from any other distribution. The [http://packages.qa.debian.org/ipsec-tools Debian maintainer for racoon] has created a little "macro preprocessor" named ''racoon-tool'' which can make configuring racoon a little easier. However, since we a) like to have full control of a configuration, and b) don't like to veer too much off the well-trodden paths that collegue sysadmins might have taken and documented, we currentle do NOT use racoon-tool as the configuration means for racoon.
			So, when the APT package installation will ask, we will respond that we do NOT want to use racoon-tool.

			So, use [[APT and aptitude \| aptitude]] to install both packages ''racoon'' and ''ipsec-tools''; in Etch both at version 0.6.6. Then, when aptitude starts installing racoon, it'll ask you if you want to configure racoon using "racoon-tool" or "direct"; choose "direct".

			If installation of the software has succeeded correctly, you can run the following commands:
			setkey -help
			racoon -help

			== Configuring the software ==

			Now it's time to create a PSK, a Pre-shared key. This is a string of characters, preferably long and strong, e.g. an MD5 hash, something like ''84f1c066b584dc5871c930f73c5029c9''. Such a PSK can be generated with
			dd if=/dev/random count=16 bs=1 \| xxd -ps
			(If you don't have the ''xxd'' package, install ''[[vim]]''; we consider that part of our [[essential system software \| essential software]], and xxd comes with it.)
			This PSK must be stored somewhere on your system, as well as on the system on the other side of the tunnel (that's what the '''shared''' part of PSK stands for, anyway). To this end, create a file named ''psk.txt'' in directory ''/etc/racoon''. Into this file, write the PSK like
			# key for route to odeon.lan
			82.1.2.32 0x84f1c066b584dc5871c930f73c5029c9
			And, on the other side,
			# key for route to amber.lan
			212.238.1.17 0x84f1c066b584dc5871c930f73c5029c9
			Note that we precede the generated hex string with ''0x'' to signify to racoon that it's a hexadecimal key. If we don't do that, racoon will treat the string as a passphrase. Not a problem either, but at any rate, both sides must do the same.

Saruman!: Preparations added

2008-05-18T20:13:58Z

Preparations added

← Older revision		Revision as of 20:13, 18 May 2008
Line 1:		Line 1:
	To set up a site-to-site tunnel using IPsec, we start with a [[Debian Etch base server]]. Use ''[[APT and aptitude \| aptitude]]'' to update all packages on the server to the latest version.		First off: what subject are we going to cover? Well, this page will cover how to set up a tunnel between two (Debian) Linux servers that both are connected to the Internet, so as to form a VPN tunnel between the two (private) networks that these two servers are ''also'' connected to. The tunnel will be set up using a Pre-Shared Key (PSK) and will transport all traffic. This scenario is not uncommon, in fact it's the scenario for which most material on the Internet can be found. And a very complete explanation of the basics of IPsec tunneling can be found [http://ipsec-howto.org/ here]. Still, here's ''our'' view of this material.

			==Preparations==

			To set up a site-to-site tunnel using IPsec, we start with a [[Debian Etch base server]]. Use ''[[APT and aptitude \| aptitude]]'' to update all packages on the server to the latest version. Then check that your kernel [[Roll your own kernel \| is compiled]] with the right options for IPsec. These options can be found under ''networking > networking options'' and include at least (but may not be limited to):
			<pre>
			(*) PF_KEY sockets (NET_KEY)
			(*) IP: ESP transformation (INET_ESP)
			(*) IP: IPsec tunnel mode (INET_XFRM_MODE_TUNNEL)
			</pre>
			Of course, in newer versions of the kernel than the 2.6.25 from which we lifted these terms, these options could be named differently.

			Next off, it's time to install the necessary Debian packages. The two packages needed are:
			* racoon: this is a
			* ipsec-tools:
			Now, we have to decide whether we want

Saruman!: Page started

2008-05-18T19:32:39Z

Page started

New page

To set up a site-to-site tunnel using IPsec, we start with a [[Debian Etch base server]]. Use ''[[APT and aptitude | aptitude]]'' to update all packages on the server to the latest version.