0

I would like to connect our office with an Amazon AWS VPC for administering RDS and EC2 instances, which reside inside a non-public subnet. I am pretty new to this, but my idea was to testdrive the setup with a software instance of fpsense, as this is a supported platform and we would like to buy a fpsense compatible router for our office.

I would like to establish a secure IPsec VPN connection from fpsense to AWS VPC and make the instances inside the VPC accessible from our office, where currently the fpsense firewall runs inside a VirtualBox VM on my developer machine.

Network Setup

External office IP: 88.77.66.55
Office LAN Subnet: 192.168.56.0/24 via VirtualBox
fpsense router IP: 192.168.0.100
Amazon VPC Subnet: 10.0.0.0/16
AWS VPN Connection Tunnel: 111.222.333.444

AWS Setup

1) Create VPC with the CIDR 10.0.0.0/16

2) Create a subnet inside VPC with same CIDR 10.0.0.0/16

3) Create customer gateway pointing to the external office IP (88.77.66.55) with static routing of 192.168.56.0/24 (the Vbox Network)

4) Create Virtual Private Gateway and associate it with the VPC

5) Create a VPN connection and link it with the customer gateway and the virtual private gateway

6) Download fpsense configuration

VirtualBox Setup

1) Add two network cards. One bridged network and one host only connection

2) Install fpsense image

fpsense setup

1) Start fpsense

2) Assign WAN to IP from bridged network (becomes 192.168.0.100)

3) Assign LAN to host only network (192.168.56.1)

4) Setup IPsec Tunnel as provided by the downloaded fpsense config file

5) Pinging the VPN Tunnel from fpsense works

6) Enable all traffic for IPv4 on WAN and LAN interfaces

Office Router

Port 500 and 4500 forwarded to fpsense IP 192.168.0.100

Network Diagram

+--------------------+  +-----------------+  +-------------------+
|  VPN Connection    +--> Virtual Private +-->    Amazon VPC     |
|      Tunnel 1      |  |     Gateway     |  |                   |
|  111.222.333.444   <--+                 <--+  10.0.0.0/16      |
+------+------^------+  +-----------------+  +-------------------+
       |      |
       |      |
       |      |
       |      |                                   +---------------------+
+------v------+------+   +----------------+       |  VirtualBox fpSense |
|  Customer Gateway  +--->Office Router   +------->  WAN 192.168.0.100  |
|                    <---+ 88.77.66.55    <-------+  LAN 192.168.0.56   |
+--------------------+   +----------------+       +---------------------+

Configuration Screenshots

Phase 1

Phase 2

FW IPsec

FW LAN

FW WLAN

Tunnles

Example logs

Nov 23 09:55:12 pfSense ipsec_starter[58921]: Starting strongSwan 5.6.0 IPsec [starter]...
Nov 23 09:55:12 pfSense ipsec_starter[58921]: no netkey IPsec stack detected
Nov 23 09:55:12 pfSense ipsec_starter[58921]: no KLIPS IPsec stack detected
Nov 23 09:55:12 pfSense ipsec_starter[58921]: no known IPsec stack detected, ignoring!
Nov 23 09:55:12 pfSense charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.6.0, FreeBSD 11.1-RELEASE-p4, amd64)
Nov 23 09:55:12 pfSense charon: 00[KNL] unable to set UDP_ENCAP: Invalid argument
Nov 23 09:55:12 pfSense charon: 00[NET] enabling UDP decapsulation for IPv6 on port 4500 failed
Nov 23 09:55:12 pfSense charon: 00[CFG] loading unbound resolver config from '/etc/resolv.conf'
Nov 23 09:55:12 pfSense charon: 00[CFG] loading unbound trust anchors from '/usr/local/etc/ipsec.d/dnssec.keys'
Nov 23 09:55:12 pfSense charon: 00[CFG] ipseckey plugin is disabled
Nov 23 09:55:12 pfSense charon: 00[CFG] loading ca certificates from '/usr/local/etc/ipsec.d/cacerts'
Nov 23 09:55:12 pfSense charon: 00[CFG] loading aa certificates from '/usr/local/etc/ipsec.d/aacerts'
Nov 23 09:55:12 pfSense charon: 00[CFG] loading ocsp signer certificates from '/usr/local/etc/ipsec.d/ocspcerts'
Nov 23 09:55:12 pfSense charon: 00[CFG] loading attribute certificates from '/usr/local/etc/ipsec.d/acerts'
Nov 23 09:55:12 pfSense charon: 00[CFG] loading crls from '/usr/local/etc/ipsec.d/crls'
Nov 23 09:55:12 pfSense charon: 00[CFG] loading secrets from '/var/etc/ipsec/ipsec.secrets'
Nov 23 09:55:12 pfSense charon: 00[CFG]   loaded IKE secret for %any 111.222.333.444
Nov 23 09:55:12 pfSense charon: 00[CFG] opening triplet file /usr/local/etc/ipsec.d/triplets.dat failed: No such file or directory
Nov 23 09:55:12 pfSense charon: 00[CFG] loaded 0 RADIUS server configurations
Nov 23 09:55:12 pfSense charon: 00[LIB] loaded plugins: charon unbound aes des blowfish rc2 sha2 sha1 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey ipseckey pem openssl fips-prf curve25519 xcbc cmac hmac curl attr kernel-pfkey kernel-pfroute resolve socket-default stroke vici updown eap-identity eap-sim eap-md5 eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap xauth-generic xauth-eap whitelist addrblock
Nov 23 09:55:12 pfSense charon: 00[JOB] spawning 16 worker threads
Nov 23 09:55:12 pfSense ipsec_starter[59608]: charon (59869) started after 40 ms
Nov 23 09:55:12 pfSense charon: 15[CFG] received stroke: add connection 'con1000'
Nov 23 09:55:12 pfSense charon: 15[CFG] conn con1000
Nov 23 09:55:12 pfSense charon: 15[CFG]   left=192.168.0.100
Nov 23 09:55:12 pfSense charon: 15[CFG]   leftsubnet=192.168.56.0/24
Nov 23 09:55:12 pfSense charon: 15[CFG]   leftauth=psk
Nov 23 09:55:12 pfSense charon: 15[CFG]   leftid=192.168.0.100
Nov 23 09:55:12 pfSense charon: 15[CFG]   right=111.222.333.444
Nov 23 09:55:12 pfSense charon: 15[CFG]   rightsubnet=10.0.0.0/16
Nov 23 09:55:12 pfSense charon: 15[CFG]   rightauth=psk
Nov 23 09:55:12 pfSense charon: 15[CFG]   rightid=111.222.333.444
Nov 23 09:55:12 pfSense charon: 15[CFG]   ike=aes128-sha1-modp1024!
Nov 23 09:55:12 pfSense charon: 15[CFG]   esp=aes128-sha1-modp1024!
Nov 23 09:55:12 pfSense charon: 15[CFG]   dpddelay=10
Nov 23 09:55:12 pfSense charon: 15[CFG]   dpdtimeout=60
Nov 23 09:55:12 pfSense charon: 15[CFG]   dpdaction=3
Nov 23 09:55:12 pfSense charon: 15[CFG]   sha256_96=no
Nov 23 09:55:12 pfSense charon: 15[CFG]   mediation=no
Nov 23 09:55:12 pfSense charon: 15[CFG]   keyexchange=ikev1
Nov 23 09:55:12 pfSense charon: 15[CFG] added configuration 'con1000'
Nov 23 09:55:12 pfSense charon: 14[CFG] received stroke: route 'con1000'
Nov 23 09:55:12 pfSense charon: 14[CFG] proposing traffic selectors for us:
Nov 23 09:55:12 pfSense charon: 14[CFG]  192.168.56.0/24|/0
Nov 23 09:55:12 pfSense charon: 14[CFG] proposing traffic selectors for other:
Nov 23 09:55:12 pfSense charon: 14[CFG]  10.0.0.0/16|/0
Nov 23 09:55:12 pfSense charon: 14[CFG] configured proposals: ESP:AES_CBC_128/HMAC_SHA1_96/NO_EXT_SEQ
Nov 23 09:55:12 pfSense charon: 14[CHD] CHILD_SA con1000{1} state change: CREATED => ROUTED
Nov 23 09:55:12 pfSense ipsec_starter[59608]: 'con1000' routed
Nov 23 09:55:12 pfSense ipsec_starter[59608]: 
Nov 23 09:55:14 pfSense charon: 14[CFG] vici client 1 connected
Nov 23 09:55:14 pfSense charon: 14[CFG] vici client 1 registered for: list-sa
Nov 23 09:55:14 pfSense charon: 14[CFG] vici client 1 requests: list-sas
Nov 23 09:55:14 pfSense charon: 15[CFG] vici client 1 disconnected
Nov 23 09:55:17 pfSense charon: 15[CFG] received stroke: terminate 'con1000'
Nov 23 09:55:17 pfSense charon: 15[CFG] no IKE_SA named 'con1000' found
Nov 23 09:55:17 pfSense charon: 15[CFG] received stroke: initiate 'con1000'
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1> queueing ISAKMP_VENDOR task
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1> queueing ISAKMP_CERT_PRE task
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1> queueing MAIN_MODE task
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1> queueing ISAKMP_CERT_POST task
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1> queueing ISAKMP_NATD task
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1> queueing QUICK_MODE task
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1> activating new tasks
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1>   activating ISAKMP_VENDOR task
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1>   activating ISAKMP_CERT_PRE task
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1>   activating MAIN_MODE task
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1>   activating ISAKMP_CERT_POST task
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1>   activating ISAKMP_NATD task
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1> sending XAuth vendor ID
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1> sending DPD vendor ID
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1> sending FRAGMENTATION vendor ID
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1> sending NAT-T (RFC 3947) vendor ID
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1> sending draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1> initiating Main Mode IKE_SA con1000[1] to 111.222.333.444
Nov 23 09:55:17 pfSense charon: 13[IKE] <con1000|1> IKE_SA con1000[1] state change: CREATED => CONNECTING
Nov 23 09:55:17 pfSense charon: 13[CFG] <con1000|1> configured proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Nov 23 09:55:17 pfSense charon: 13[ENC] <con1000|1> generating ID_PROT request 0 [ SA V V V V V ]
Nov 23 09:55:17 pfSense charon: 13[NET] <con1000|1> sending packet: from 192.168.0.100[500] to 111.222.333.444[500] (180 bytes)
Nov 23 09:55:17 pfSense charon: 13[CFG] vici client 2 connected
Nov 23 09:55:17 pfSense charon: 13[CFG] vici client 2 registered for: list-sa
Nov 23 09:55:17 pfSense charon: 12[CFG] vici client 2 requests: list-sas
Nov 23 09:55:17 pfSense charon: 12[CFG] vici client 2 disconnected
Nov 23 09:55:21 pfSense charon: 06[IKE] <con1000|1> sending retransmit 1 of request message ID 0, seq 1
Nov 23 09:55:21 pfSense charon: 06[NET] <con1000|1> sending packet: from 192.168.0.100[500] to 111.222.333.444[500] (180 bytes)
Nov 23 09:55:23 pfSense charon: 06[CFG] vici client 3 connected
Nov 23 09:55:23 pfSense charon: 06[CFG] vici client 3 registered for: list-sa
Nov 23 09:55:23 pfSense charon: 06[CFG] vici client 3 requests: list-sas
Nov 23 09:55:23 pfSense charon: 06[CFG] vici client 3 disconnected
Nov 23 09:55:28 pfSense charon: 08[CFG] vici client 4 connected
Nov 23 09:55:28 pfSense charon: 06[CFG] vici client 4 registered for: list-sa
Nov 23 09:55:28 pfSense charon: 10[CFG] vici client 4 requests: list-sas
Nov 23 09:55:28 pfSense charon: 10[CFG] vici client 4 disconnected
Nov 23 09:55:29 pfSense charon: 10[IKE] <con1000|1> sending retransmit 2 of request message ID 0, seq 1
Nov 23 09:55:29 pfSense charon: 10[NET] <con1000|1> sending packet: from 192.168.0.100[500] to 111.222.333.444[500] (180 bytes)

Problem

The client disconnects immediately and I do not see a very clear error message. I suppose the problem is because fpsense is behind NAT. Should the left IP address also be the VM subnet IP, e.g. 192.168.56.2?

0

The leftsubnet and rightsubnet is the same in the log file. The leftsubnet should be the VPC CIDR. The rightsubnet should be the office CIDR. Also left and right do not look correct.

Where did you get the configuration (ipsec.conf) for the connection? Download from Amazon or hand created?

  • Why would you think that the right and left subnets are the same?Nov 8 09:00:59 charon: 08[CFG] rightsubnet=10.0.0.0/16 Nov 8 09:00:59 charon: 08[CFG] leftsubnet=192.168.56.0/24 The information is downloaded from Amazon and added manually into fpsense via its menu. The remote network is the AWS CIDR (10.0.0.0) and the local network is read from the system automatically. – Stefan Nov 14 '17 at 8:25
  • In your logfile rightsubnet=192.168.56.0/24 rightsubnet=192.168.56.0/24. Lines 7 and 9 from the bottom of the logfile. – John Hanley Nov 14 '17 at 18:42
  • First I thought that posted the same line twice. When you read the log file from the top, you can see in line 26 from the top that the rightsubnet=10.0.0.0/16 and in line 30 that leftsubnet=192.168.56.0/24. Thats weird. – Stefan Nov 22 '17 at 8:20
  • Is your ipsec.con configuring two tunnels? – John Hanley Nov 22 '17 at 19:44
  • No, just one tunnle. I edited my question and added screenshots from my configuration of pfsense. – Stefan Nov 23 '17 at 9:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.