0

I am beginner with strongswan so I apologize for this beginner’s query. I have created Debian server with strongswan. To this server are connected three networks network_1: 192.168.10.0/24, network_2: 192.168.20.0/24 and network_3 192.168.30.0/24 via Mikrotik LTE routers and IKEv2-PSK protocol. Together with these network to this server can be connected windows, iOS, OSX and Android clients via IKEv2 protocol and MSCHAP-EAP authentication. All is working without problems and for every connected client are accessible all IPs in all these three networks.

At this moment I would like assign some of the following access rights for MSCHAP-EAP clients – for example:

Client Bob/password1 should be able to access only IPs in network2 and no other IPs Client Alice/password2 should be able to access only IP address range 192.168.20.100 – 150 in second network and no other IPs Client John/password3 should be able to acces only IP address ranges 192.168.30.10 – 50 and 192.168.10.150 -200 and IP address 192.168.20.44

Could anybody be so kind and help me solve it? Ideally with reference to any example of solution…

Thank you in advance

Petr

2

A possible way to do this is using EAP-RADIUS. The radius server can return Class attributes that can be matched against configs (rightgroups in ipsec.conf, or groups in swanctl.conf). Then you can define different local traffic selectors for each of these groups. The ikev2/rw-eap-md5-class-radius strongSwan test scenario illustrates this.

If you don't want to or can't use EAP-RADIUS there is a way to match individual EAP identities but it's a bit tricky because strongSwan does not fully support connection switching based on such identities. To do this a dummy connection with a fake group has to be used. This is how it could look like in ipsec.conf:

conn eap-shared
   # options shared by all clients e.g.
   leftcert=...
   # or
   rightsourceip=...
   # or
   rightauth=eap-mschapv2

conn eap-init
   also=eap-shared
   # this config is used to do the EAP-Identity exchange and the
   # authentication of client and server
   eap_identity=%identity
   # the following is used to force a connection switch after
   # the authentication completed
   rightgroups=<any string that is not used as group/class>
   auto=add

conn eap-bob
   also=eap-shared
   eap_identity=bob@strongswan.org
   # any options that only apply to this user follow here e.g.
   leftsubnet=192.168.20.0/24
   auto=add

conn eap-alice
   also=eap-shared
   eap_identity=alice@strongswan.org
   # any options that only apply to this user follow here e.g.
   # (note that ipsec.conf does not support ranges, and most kernel
   #  interfaces do neither, so a range might be converted to a larger
   #  subnet when installing IPsec policies, so deaggregating the range
   #  is the most accurate way to do this currently)
   leftsubnet=192.168.20.100/30,192.168.20.104/29,192.168.20.112/28,192.168.20.128/28,192.168.20.144/30,192.168.20.148/31,192.168.20.150/32
   auto=add

conn eap-john
   also=eap-shared
   eap_identity=john@strongswan.org
   # any options that only apply to this user follow here e.g.
   # (see above)
   leftsubnet=192.168.30.10/31,192.168.30.12/30,192.168.30.16/28,192.168.30.32/28,192.168.30.48/31,192.168.30.50/32,192.168.10.150/31,192.168.10.152/29,192.168.10.160/27,192.168.10.192/29,192.168.10.200/32,192.168.20.44/32
   auto=add

With EAP-RADIUS the config would look quite similarly but you wouldn't need the eap-init connection (instead you'd add eap_identity=%identity to eap-shared) and instead of defining eap_identity in each individual connection you'd set rightgroups to the groups (i.e. EAP-RADIUS Class attribute values) for which that connection should be used (i.e. this allows using the same conn section for multiple users).

| improve this answer | |
0

Thank you very much for your answer. I will test it. My first idea was change the mschap-eap authentication to eap-tls and use different client's certificates and conn section for each group but I don't know if it would be the right way.

| improve this answer | |
  • Sorry, didn't see this before. Did you mean to add this as a comment to my answer? Anyway, EAP-TLS wouldn't make much of a difference as there again is the problem that switching based on EAP identities isn't fully supported (and different client implementations may use different forms of EAP identities when using certificates). Using plain certificate authentication may be an alternative as that allows matching configs via subject DN (even with wildcards), however, the identities sent might still depend on the client (some send the full subject DN, others the CN, or a SAN). – ecdsa Apr 20 '18 at 11:31
  • Hm, my idea with certificates was not good. I'll have to solve it with RADIUS server. – Petr W. Apr 23 '18 at 14:27
  • ecdsa, thank you very much for your help once more. Strongswan server is now working together with FreeRADIUS + MySQL without problems and a lot of users in usergroups that have access rights via EAP-MSCHAP to the appropriate ranges in appropriate networks:-) – Petr W. May 5 '18 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.