2

I've been able to setup IPSEC successfully between two Hetzner machine, both of which had only public IP addresses. However, I've been unsuccessful in configuring IPSEC between an EC2 instance and a Hetzner machine, because the EC2 instance has a private IP which goes through some form of NAT-ing to get a public IP.

I'm using ipsec-tools + racoon and trying to follow these docs:

To make things simpler, I've tried taking racoon out of the picture and hard-coded the encryption keys.

How do I get this to work? And probably, more importantly, how do I peek under the hood and see what's going on? Where exactly is the "connection breaking"?

/etc/ipsec-tools.conf on EC2 instance

flush;
spdflush;

# ec2 -> het
spdadd Ec2PvtIP HetznerIP any -P out ipsec  esp/tunnel/Ec2PubIP-HetznerIP/require;
# het -> ec2
spdadd HetznerIP Ec2PvtIP any -P in  ipsec  esp/tunnel/HetznerIP-Ec2PubIP/require;


## Using EC2 Public IP

add Ec2PubIP HetznerIP esp 0x74fce30b -E aes-cbc 0xf46c3187e253e5b25b8f8525da056080 -A hmac-sha256 0x9e7c6f6c7a1ccdd7634bb0a9eeaea5a8ed7bdfed89fd3f7dc86b2e8a522ae6e8 ;
add HetznerIP Ec2PubIP esp 0x74fce30b -E aes-cbc 0xf46c3187e253e5b25b8f8525da056080 -A hmac-sha256 0x9e7c6f6c7a1ccdd7634bb0a9eeaea5a8ed7bdfed89fd3f7dc86b2e8a522ae6e8 ;

## Using EC2 Private IP

# ec2 -> het
add Ec2PvtIP HetznerIP esp 0x74fce30b -E aes-cbc 0xf46c3187e253e5b25b8f8525da056080 -A hmac-sha256 0x9e7c6f6c7a1ccdd7634bb0a9eeaea5a8ed7bdfed89fd3f7dc86b2e8a522ae6e8 ;
# het -> ec2
add HetznerIP Ec2PvtIP esp 0x74fce30b -E aes-cbc 0xf46c3187e253e5b25b8f8525da056080 -A hmac-sha256 0x9e7c6f6c7a1ccdd7634bb0a9eeaea5a8ed7bdfed89fd3f7dc86b2e8a522ae6e8 ;

/etc/ipsec-tools.conf on Hetzner machine

flush;
spdflush;

# het -> ec2
spdadd HetznerIP Ec2PvtIP any -P out ipsec  esp/tunnel/HetznerIP-Ec2PubIP/require;
# ec2 -> het
spdadd Ec2PvtIP HetznerIP any -P in  ipsec  esp/transport/Ec2PubIP-HetznerIP/require;

### Using EC2 Public IP

add HetznerIP Ec2PubIP esp 0x74fce30b -E aes-cbc 0xf46c3187e253e5b25b8f8525da056080 -A hmac-sha256 0x9e7c6f6c7a1ccdd7634bb0a9eeaea5a8ed7bdfed89fd3f7dc86b2e8a522ae6e8 ;
add Ec2PubIP HetznerIP esp 0x74fce30b -E aes-cbc 0xf46c3187e253e5b25b8f8525da056080 -A hmac-sha256 0x9e7c6f6c7a1ccdd7634bb0a9eeaea5a8ed7bdfed89fd3f7dc86b2e8a522ae6e8 ;

### Using EC2 Private IP
# het -> ec2
add HetznerIP Ec2PvtIP esp 0x74fce30b -E aes-cbc 0xf46c3187e253e5b25b8f8525da056080 -A hmac-sha256 0x9e7c6f6c7a1ccdd7634bb0a9eeaea5a8ed7bdfed89fd3f7dc86b2e8a522ae6e8 ;
# ec2 -> het
add Ec2PvtIP HetznerIP esp 0x74fce30b -E aes-cbc 0xf46c3187e253e5b25b8f8525da056080 -A hmac-sha256 0x9e7c6f6c7a1ccdd7634bb0a9eeaea5a8ed7bdfed89fd3f7dc86b2e8a522ae6e8 ;

More information

  • To reduce the number of moving parts for now, I have enabled ALL traffic for my EC2 instance, both, at the iptables-level and Amazon Security Group level.
  • Hetzner does NOT have a private IP at all. It only has a public IP.
  • My intention is NOT to establish a private network (with private IPs) amongst all servers, given the assumption that once all traffic between servers is encrypted via IPSEC, they may as well communicate via public IPs. However, EC2 is sticking out like a sore-thumb in my multi-cloud setup because it forces public/private IPs on you.
1
  • Is there any reason you're not using an AWS Virtual Private Gateway? That connects your whole AWS network to the VPN. If your AWS instance is behind a NAT with no public IP then you can't connect to it, NAT is for outgoing connections. In AWS you can use VPC Flow Logs to try to diagnose network issues. – Tim Mar 4 '19 at 22:25
1

As long as your Security Group and the local firewall on your Linux machine permit access for protocol ESP it should work.

Security Group - ESP

One problem I see in your setup is with the SPDs. The EC2 doesn't know about its Public IP and Hetzner doesn't know about its private IP. Also you've got transport in the second SPD on Hetzner. You'll have to get the mix right.

On EC2

# EC2 only knows its private IP - the tunnel must reflect that
spdadd Ec2PvtIP HetznerIP any -P out ipsec  esp/tunnel/Ec2PvtIP-HetznerIP/require;
spdadd HetznerIP Ec2PvtIP any -P in  ipsec  esp/tunnel/HetznerIP-Ec2PvtIP/require;

On Hetzner

# ESP is between the Public IPs, SPD uses the EC2 Private IP
spdadd HetznerIP Ec2PvtIP any -P out ipsec  esp/tunnel/HetznerIP-Ec2PubIP/require;
# This must be tunnel too, not transport
spdadd Ec2PvtIP HetznerIP any -P in  ipsec  esp/tunnel/Ec2PubIP-HetznerIP/require;

On Hetzner you'll then have to add a route to Ec2PvtIP via Ec2PubIP.


Also I find it easier and less confusing if the the tunnel internal addresses are completely independent from the endpoint addresses. E.g. I would create dummy0 = 10.0.1.1/32 on EC2 and dummy0 = 10.0.1.2/32 on Hetzner and configure the tunnels appropriately:

spdadd 10.0.1.1 10.0.1.2 esp/tunnel/Ec2PvtIP-HetznerIP/require;
...

Routing is then more explicit too:

root@ec2 ~ # ip route add 10.0.1.2 via HetznerIP src 10.0.1.1

Alternatively use LibreSwan / OpenSwan rather than ipsec-tools where a simple config like this should work on an EC2 instance with a public IP, including key exchange and route management:

# On EC2
conn hetzner
    left=%defaultroute
    leftsubnet=10.0.1.1/32
    right=HetznetIP
    rightsubnet=10.0.1.2/32
    authby=secret
    auto=start

After years of using ipsec-tools I have now switched to LibreSwan and found it much easier to work with.


Update: Base on your update "My intention is NOT to establish a private network (with private IPs) amongst all servers, given the assumption that once all traffic between servers is encrypted via IPSEC, they may as well communicate via public IPs." you should try with transport more: esp/transport/.../require. In any case be consistent - you can't mix tunnel and transport between the SPDs.

Hope that helps :)

5
  • Have edited the question to add more details/context: (a) have disabled all firewalls, for now (b) Hetzner doesn't have a private IP, (c) what I'm trying to do. – Saurabh Nanda Mar 5 '19 at 3:55
  • Is your advice about setting up SPDs different from what is given at mad-hacking.net/documentation/linux/networking/ipsec/… or am I misreading that document? My takeaway from that document was that you need to inform ipsec-tools about the IP doing the tunneling via esp/tunnel/ip1-ip2/require -- hence I had put Ec2PublicIP there. – Saurabh Nanda Mar 5 '19 at 3:58
  • @SaurabhNanda Your EC2 doesn't know about its public IP hence you can't use it in the EC2 SPDs. Try transport instead of tunnel though, I have updated the answer. – MLu Mar 5 '19 at 4:18
  • I'm trying to do the following -- On Hetzner you'll then have to add a route to Ec2PvtIP via Ec2PubIP -- by issuing the following command: ip route add Ec2PvtIP via Ec2PubIP dev eth0, but get this error: Error: Nexthop has invalid gateway. I also tried: route add Ec2PvtIP gw Ec2PubIP dev eth0, but get the following error: SIOCADDRT: Network is unreachable – Saurabh Nanda Mar 6 '19 at 7:56
  • I tried using tcpdump on Hetzner to debug this: tcpdump src host Ec2PubIP or src host Ec2PvtIP or dst host Ec2PubIP or dst host Ec2PvtIP and I can see multiple ESP packets reaching Hetzner, before the connection times out -- 08:57:42.610433 IP Ec2PubIp > HetznerIP: ESP(spi=0x39ea2d88,seq=0x26), length 84 – Saurabh Nanda Mar 6 '19 at 7:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.