FireBrick IPsec Tunnel with Manual Keys (Deprecated)
This is now a legacy way to do IPsec, see FireBrick to FireBrick IPsec (Howto) instead!
FireBrick IPsec Information
Information from May 2013:
The IPsec feature provides ESP with ESP-auth and a choice of algorithms to create tunnels with a static config for keys. Blowfish is the fastest, if you have a choice. Triple DES is slowest, as you may expect.
At present the code can be used to create point to point fixed IP tunnels between FireBricks, or FireBrick and linux boxes. Other routers/VPN boxes may be able to handle fixed configs like this too.
Next we will be doing IKE (key exchange) which is more commonly used to establish session keys. We also plan to link in IPsec and L2TP which is commonly used for PCs and mobiles to VPN connect as an endpoint. More on this as we release it.
...this is all in-house code at every level with our own crypto libraries following the RFCs. We control every line of code in the FireBricks and the IPsec code is no exception.
This is an alpha release, and may well have bugs and issues that we need to work on, so we welcome feedback as usual. Please ensure crash logs are emailed as normal so we can pick up any fatal exceptions.
There is lots of information on in the FireBrick Manuals:
FireBrick to FireBrick
Here we will create a tunnel between 2 firebricks, Paul and Andrew. We will then set routing to route each other's LAN blocks though the Tunnel. As the 2 endpoints have IPv6, we'll establish the tunnel over IPv6.
Side A Config
<ipsec name="Andrew-ipsec" mtu="1500" graph="andrew-ipsec" local-ip="2001:8b0:d6:1::1" remote-ip="2001:8b0:1635::1" local-spi="4242" remote-spi="999" auth-algorithm="AES-XCBC" auth-key="1310B855522E8D457B814BD9DD78B6AB" crypt-algorithm="AES-CBC" crypt-key="0BC4DF636566667BEEC9F02117CB57C3" routes="90.155.90.128/27 2001:8b0:1635::/64"/>
| IPsec settings overview | |
|---|---|
| name | Just a name for this Tunnel |
| mtu | |
| graph | Just a name so as to create a CQM graph |
| local-ip | Our FireBrick IP to use as the source |
| remote-ip | Remote FireBrick IP |
| local-spi | |
| remote-spi | |
| auth-algorithm | |
| auth-key | |
| crypt-algorithm | |
| crypt-key | |
| routes | IP blocks to route through the tunnel - i.e. LAN IPs of the other end |
Side B Config
<ipsec name="Paul-ipsec" mtu="1500" graph="paul-ipsec" local-ip="2001:8b0:1635::1" remote-ip="2001:8b0:d6:1::1" local-spi="999" remote-spi="4242" auth-algorithm="AES-XCBC" auth-key="1310B855522E8D457B814BD9DD78B6AB" crypt-algorithm="AES-CBC" crypt-key="0BC4DF636566667BEEC9F02117CB57C3" routes="91.241.56.1 81.2.97.160/27 91.241.56.0/24 2001:8b0:d6::/48"/>
Firewall
IPsec will need to be allowed in (and out) of the FireBricks - allow protocol 50 (ESP) to the FireBrick from the remote IP.
Testing
These 2 FireBricks both happen to be on AAISP FTTC lines, and a normal traceroute would go via the AAISP router, but when the IPsec tunnel is enabled the traceroute goes direct.
Traceroute Before:
$ traceroute 91.241.56.1 traceroute to 91.241.56.1 (91.241.56.1), 30 hops max, 60 byte packets 1 brick.h.hearn.org.uk (90.155.90.129) 0.344 ms 0.321 ms 0.310 ms 2 a.gormless.then.aa.net.uk (90.155.53.51) 11.703 ms 11.712 ms 11.834 ms 3 brick.shibboleet.ltd.uk (91.241.56.1) 24.862 ms 24.871 ms 25.251 ms
Traceroute After:
$ traceroute 91.241.56.1 traceroute to 91.241.56.1 (91.241.56.1), 30 hops max, 60 byte packets 1 brick.h.hearn.org.uk (90.155.90.129) 0.358 ms 0.342 ms 0.329 ms 2 brick.shibboleet.ltd.uk (91.241.56.1) 26.178 ms 26.861 ms 27.123 ms
Linux (CentOS Openswan) Example Using IKE2
yum install openswan
(strongswan is much nicer, but not in yum on centos5. On centos6, use strongswan)
In /etc/ipsec.conf uncomment
include /etc/ipsec.d/*.conf
Put following two files in /etc/ipsec.d/ :
mhbrick.conf:
conn myFireBrick
authby=secret
auto=start
ikev2=insist
left=CentOS.IP.Address
leftid=CentOS.IP.Address
leftsubnet=CentOS.IP.Address/32
right=FireBrick.IP.Address
rightid=FireBrick.IP.Address
rightsubnet=FireBrick.LAN.SUBNET/24
in: myFireBrick.secrets:
CentOS.IP.Address FireBrick.IP.Address : PSK "yourpasswordhere"
chkconfig ipsec on service ipsec start
Put the following in the FB at the other end:
<connection name="IPSec" peer-ips=CentOS.IP.Address" auth-method="Secret" secret="yoursecrethere" internal-ipv4="FireBrick.LAN.IP.Address" routes="CentOS.IP.Address" log="default"/>
FireBrick to Linux
There is information in the FireBrick Manual:
The FireBrick IPsec implementation should be compatible with any IPsec implementation providing manual keying, provided a common set of algorithms can be chosen. As an example, the configuration for a Linux system using the ipsec-tools package will be described.
Consider a tunnel between a FireBrick and a Linux system with the following setup:
- FireBrick has IP address 192.168.1.1, Linux system has IP address 192.168.2.2
- ESP encapsulation using HMAC-SHA1 authentication and AES-CBC encryption
- Authentication key 0123456789012345678901234567890123456789
- Encryption key 00010203040506070809101112131415
- Incoming SPI 1000, Outgoing SPI 2000
- FireBrick is providing connectivity for a local user subnet 10.1.1.0/24
- Linux system is providing connectivity for a local user subnet 10.2.2.0/24
A suitable FireBrick xml config for this would be:
<ipsec local-ip="192.168.1.1" remote-ip="192.168.2.2" local-spi="1000" remote-spi="2000" type="ESP" auth-algorithm="HMAC-SHA1" auth-key="0123456789012345678901234567890123456789" crypt-algorithm="AES-CBC" crypt-key="00010203040506070809101112131415" routes="10.2.2.0/24" />
A corresponding ipsec-tools config file would be:
flush; spdflush; add 192.168.2.2 192.168.1.1 esp 1000 -m tunnel -E rijndael-cbc 0x00010203040506070809101112131415 -A hmac-sha1 0x0123456789012345678901234567890123456789; add 192.168.1.1 192.168.2.2 esp 2000 -m tunnel -E rijndael-cbc 0x00010203040506070809101112131415 -A hmac-sha1 0x0123456789012345678901234567890123456789; spdadd 10.1.1.0/24 10.2.2.0/24 any -P in ipsec esp/tunnel/192.168.1.1-192.168.2.2/require; spdadd 10.2.2.0/24 10.1.1.0/24 any -P out ipsec esp/tunnel/192.168.2.2-192.168.1.1/require;
Note that rijndael is the name used by ipsec-tools for the AES algorithm.