12,270
edits
FireBrick Road Warrior FireBrick Config: Difference between revisions
FireBrick Road Warrior FireBrick Config (view source)
Revision as of 09:25, 14 December 2018
, 14 December 2018→Configuration
(→Allow IPsec traffic in to the FireBrick: " " == "_" in MW world) |
m (→Configuration) |
||
| (6 intermediate revisions by 2 users not shown) | |||
|
<indicator name="RoadW">[[File:Menu-Road-Warrior.svg|link=:Category:
= FireBrick IPsec config =
Choose an IP range not used anywhere else in your FB config
(and to avoid confusion choose something non-routable
Set the NAT flag on the ipsec roaming pool definition.
'''Think about the NAT'''
A problem arises however when the LAN subnet is non-routable (RFC1918 IPs,
In this case the LAN subnet is usually marked NAT in the FB config,
so LAN devices can communicate externally (obviously for outgoing
on the LAN and destined off-LAN).
This is overcome, either, by using mapping rules, or by disabling NAT on the LAN subnet and instead enabling NAT on the external internet connection,
==Overview==
<syntaxhighlight lang=xml>
<ipsec-ike force-NAT="0.0.0.0/0">
<connection name="server" roaming-pool="roam-pool" auth-method="Certificate" peer-auth-method="EAP" mode="Wait" local-ID="FQDN:server.example.com"/>
<roaming name="roam-pool" ip="[ranges of LAN IPs, inc IPv6]" DNS="[DNS, e.g. 8.8.8.8]"/>
</ipsec-ike>
</syntaxhighlight>
Note: the force-NAT="0.0.0.0/0" forces keep-alives which are needed when NAT is involved between the endpoints but and also helps where stateful firewalls are in the route too. (without this set, you may find that the ipsec tunnel drops every hour or so)
Each roaming user then needs an <tt>eap</tt> user record.▼
▲Each roaming user then needs an <tt>eap</tt> user record. This goes with any user entries near the top of the config.
<syntaxhighlight lang=xml>
Here is how the above three config sections look in the User Interface (UI):
<gallery widths=250px caption="FireBrick
FireBrick-IPsec-IKESettings.png|IKE Settings (UI). (Config - Edit - Tunnels - IPsec - Add, IKE connection)
FireBrick-IPsec-RoamingPool.png|Roaming Pool Settings (UI). (Config - Edit - Tunnels - IPsec - Add, IKE roaming IP pools
*Editing the DNS Service to allow non-local users, we'd recommend using an Allow list that includes the IPsec clients as well as the LAN clients if they are to also use the FireBrick as their DNS resolver. (Setup - General System Services - DNS)
[[Category:
| |||