2

For a given list of internet server (example):

S001 - 45.67.89.12
S002 - 67.78.90.34
S...
S999 - 98.76.65.54

I want to talk from each server to any other server to any TCP service using the public IP of the server, but the connection must be encrypted and authenticated with IPSec (PSK or own PKI, non-IPSec requests should be blocked). Instead of manual maintaining a list of hosts and individual IPSec configs for each host, I want to automate this process.

If this requires an explicit list of IP-adresses for which IPSec should be used, my preferred solution would be a reverse DNS lookup. For example, if a connection attempt to 67.78.90.34 is done, it should first resolve the reverse name. If it matches *.srvhosts.example.com, IPSec must be used.

Exists any linux based software solution to realize this?

Another solution - if possible - may enable IPsec globally just for every connection and a blacklist tells the system for which hosts IPSec should not be used (debian update mirror, dns, ntp, ...).

1
  • I think what you need here is some sort of list mapping from IP address to public key. Packets to a listed IP must be routed to the IPSec tunnel and packets from a listed IP that are not IPSec protected need to be dropped. But using reverse DNS for this is dangerous because it could be spoofed. You could of course protect the DNS records with DNSSEC, but even that involves some keys outside your own control around the root of the DNS hierarchy. I would look for a solution that doesn't rely on keys outside your own control.
    – kasperd
    Jan 9, 2016 at 12:23

0

You must log in to answer this question.

Browse other questions tagged .