Setting up an IPSec VPN between dedicated web server and remote server

Question

I'm currently developing an e-commerce website, and I need to setup a VPN between the dedicated web server and a remote server that control the stocks, the product list, etc, and that is located in my client infrastructure.

Their technical constraints are that the VPN has to be an IPSec, network-to-network, using a shared secret (and not a certificate based authentification). They have given me their public gateway ip, and the local private ip of the stock/product server.

As any developpers, I've notions on this kind of subject, and I looked around, searching for tutorials, but I think I'm overwhelmed.

Most tutorials I found pointed that I needed to configure the web server's gateway, in oder to generate certificate. However, as the web server is a dedicated one, I don't know how to access the gateway.

Truly, I'm a bit lost, like a tiny developper in the sea of network/server management. So please, help !

So, can someone explain me how to setup this kind of VPN, and what I'll need to give to my client's network admins, thus saving my life.

Thanks !

Answer 1

I would strongly recommend you start by reading An Illustrated Guide to IPSec. It's easily the best introduction to IPSec I've found. You'll want to understand at least the basics, or you'll never get this working.

Now, secondly, you need to provide a lot more information here. Specifically, we need to know what platform or OS you're using and what version before anyone can do anything. Secondly, it'll help a lot to know what platform/os/version the other endpoint has, too.

Setting up IPSec can be pretty complicated. Complexity is easily the biggest problem with IPSec. Trying to get two different platforms to talk can increase that complexity.

If you're using Linux for one or both of the VPN endpoints, I would also recommend reading:

• The Official Linux IPSec Howto
• Red Hat Enterprise Linux Deployment Guide - VPN and IPSec

For any other platform, research your vendor provided documentation. If you don't have a a dedicated System/Network Administrator, you may want to investigate bringing in a contractor or consultant to assist you with this.