It is possible.
You would need:
- Ports opened to pass VPN traffic through to the Debian boxes
- IPSEC configuration on each machine
- IPSEC userspace tools installed (ipsec-tools (and a kernel with it supported, so > 2.5.7))
- A guide like http://lartc.org/howto/lartc.ipsec.html
- Lots of fiddling with config files
Then, on your router/default gateway, add static routes for the remote subnets pointing to the Debian boxes.
The configuration isn't that bad, but if you've never dealt with IPSEC VPNs before it may be a confusing mess (but then, it is Linux, so everything is ;) )
On the last (and only) server I got it working on, there were six files involved, which I include below, in a censored fashion. Where I've put local_ip was the ip address of the local server, and where I've put remote_ip was the ip address of the remote server, and this config was for secure communication between two machines on the same network, so the config isn't going to be right for you with NAT and multiple machines involved.
You will need to mirror the config on either side (so, swapping the local_ip and remote_ip bits on one server), and also find where you need to put public IPs to get it working over the internet.
Anyway, if you want to get it working, be prepared to spend some hours faffing with it, because it might well take that. VPNs are not really click and drag, unless you buy expensive firewall kit.
/etc/sysconfig/network-scripts/ifcfg-ipsec0
DST=remote_ip
TYPE=IPSEC
ONBOOT=yes
IKE_METHOD=PSK
/etc/sysconfig/network-scripts/keys-ipsec0
IKE_PSK="passphrase"
/etc/racoon/psk
remote_ip passphrase
/etc/racoon/racoon.conf
path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk";
path certificate "/etc/racoon/certs";
# log debug2;
listen
{
isakmp local_ip;
}
include "/etc/racoon/remote_ip.conf";
/etc/racoon/setkey.conf
#!/sbin/setkey -f
flush;
spdflush;
#Add the policy
#This policy applies to inbound traffic from remote
spdadd remote_ip/32 local_ip/32 any -P in ipsec esp/transport//require;
spdadd remote_ip/32 local_ip/32 any -P in ipsec ah/transport//require;
#This policy applies to outbound traffic to remote
spdadd local_ip/32 remote_ip/32 any -P out ipsec esp/transport//require;
spdadd local_ip/32 remote_ip/32 any -P out ipsec ah/transport//require;
/etc/racoon/remote_ip.conf
remote remote_ip
{
exchange_mode main;
my_identifier address local_ip;
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 2;
lifetime time 8 hours;
}
}
sainfo address local_ip any address remote_ip any
{
authentication_algorithm hmac_sha1;
encryption_algorithm 3des;
compression_algorithm deflate;
}
sainfo address remote_ip any address local_ip any
{
authentication_algorithm hmac_sha1;
encryption_algorithm 3des;
compression_algorithm deflate;
}