0

Server ipsec.conf

config setup
    charondebug="ike 1, knl 1, cfg 0"
    uniqueids=never

conn ikev2
    auto=add
    compress=no
    type=tunnel
    keyexchange=ikev2
    fragmentation=yes
    forceencaps=yes
    ike=aes256gcm16-sha384-modp3072!
    esp=aes256gcm16-sha384-modp3072!
    dpdaction=clear
    dpddelay=300s
    rekey=no
    left=%any
    leftid=my-vpn.com
    leftcert=vpn-server.crt
    leftsendcert=always
    leftsubnet=0.0.0.0/0
    right=%any
    rightid=%any
    rightauth=eap-tls
    rightdns=1.1.1.1,1.0.0.1
    rightsourceip=10.0.2.0/24
    rightsendcert=never
    eap_identity=%identity

Server iptables -S

-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW -m limit --limit 60/sec --limit-burst 20 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW -m limit --limit 60/sec --limit-burst 20 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A FORWARD -s 10.0.2.0/24 -m policy --dir in --pol ipsec --proto esp -j ACCEPT
-A FORWARD -d 10.0.2.0/24 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

Client ipsec.conf

conn ikev2
    auto=start
    leftid=client@my-vpn.com
    leftsourceip=%config
    leftauth=eap-tls
    leftcert=vpn-client.crt
    right=my-vpn.com
    rightid=my-vpn.com
    rightauth=pubkey

Client iptables -S

-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --dport 500 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --dport 4500 -m state --state NEW -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

The connection is established but when I run curl https://checkip.amazonaws.com, the returned IP is the client public IP vs the server public IP (expected). How can I route all traffic through the VPN?

Also, can’t SSH to client from server. Why?

Thanks!

1

You want to configure rightsubet=0.0.0.0/0 on the client. The default is %dynamic, which resolves to the VPN server's IP address, so only traffic to that will then be tunneled.

Regarding SSH, you need to check the traffic counters (IPsec SAs, firewall rules) to see in which direction that traffic does or doesn't flow.

  • Tried rightsubnet=0.0.0.0/0, but still getting public IP of client. Also, about SSH, I can SSH out to the server’s using public IP but not using its DHCP IP on same subnet as client 10.0.2.0/24. Ideas? Thanks! – sunknudsen May 24 at 11:01
  • I guess iOS does all the magic behind the scene to route all traffic through the VPN when a provisioning profile is configured. Having a hard time achieving the same on Linux. Trying to achieve the same as medium.com/@sunknudsen/…. – sunknudsen May 24 at 11:04
  • It’s working! I had missed a NO_PROPOSAL_CHOSEN error in the logs. Had to add ike=aes256gcm16-sha384-modp3072! and esp=aes256gcm16-sha384-modp3072! to the client ipsec.conf as the server is enforcing strong crypto. Still having issues with SSH. Will report back here once I figure it out. Thanks @ecdsa! – sunknudsen May 24 at 11:12
  • SSH is working. Once above NO_PROPOSAL_CHOSEN error was mitigated, had to add the server’s SSH pub key to the client to fix Permission denied (publickey). error. Also had to allow outbound SSH requests on the server using iptables -A OUTPUT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT. The whole setup is hardened so very little is allowed by default. – sunknudsen May 24 at 11:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.