Creating a VPN between two networks, separated by the Internet, using FreeBSD gateways.
This section will guide you through the process of setting up IPsec. In order to set up IPsec, it is necessary that you are familiar with the concepts of building a custom kernel (see Chapter 9, Configuring the FreeBSD Kernel).
IPsec is a protocol which sits on top of the Internet Protocol (IP) layer. It allows two or more hosts to communicate in a secure manner (hence the name). The FreeBSD IPsec “network stack” is based on the KAME implementation, which has support for both protocol families, IPv4 and IPv6.
IPsec consists of two sub-protocols:
Encapsulated Security Payload ESP), protects the IP packet data from third party interference, by encrypting the contents using symmetric cryptography algorithms (like Blowfish, 3DES).
Authentication Header (AH), protects the IP packet header from third party interference and spoofing, by computing a cryptographic checksum and hashing the IP packet header fields with a secure hashing function. This is then followed by an additional header that contains the hash, to allow the information in the packet to be authenticated.
ESP and AH can either be used together or separately, depending on the environment.
IPsec can either be used to directly encrypt the traffic between two hosts (known as Transport Mode); or to build “virtual tunnels” between two subnets, which could be used for secure communication between two corporate networks (known as Tunnel Mode). The latter is more commonly known as a Virtual Private Network (VPN). The ipsec(4) manual page should be consulted for detailed information on the IPsec subsystem in FreeBSD.
To add IPsec support to your kernel, add the following options to your kernel configuration file:
If IPsec debugging support is desired, the following kernel option should also be added:
There is no standard for what constitutes a VPN. VPNs can be implemented using a number of different technologies, each of which have their own strengths and weaknesses. This section presents a scenario, and the strategies used for implementing a VPN for this scenario.
The premise is as follows:
You have at least two sites
Both sites are using IP internally
Both sites are connected to the Internet, through a gateway that is running FreeBSD.
The gateway on each network has at least one public IP address.
The internal addresses of the two networks can be
public or private IP addresses, it does not matter.
They just may not collide; e.g.: may not both use
192.168.1.x.
To begin, the
security/ipsec-tools
must be installed from the Ports Collection. This third
party software package provides a number of applications
which will help support the configuration.
The next requirement is to create two gif(4)
pseudo-devices which will be used to tunnel packets and
allow both networks to communicate properly. As
root, run the following commands,
replacing the internal and
external items with the real
internal and external gateways:
# ifconfig gif0 create# ifconfig gif0 internal1 internal2# ifconfig gif0 tunnel external1 external2For example, the corporate LAN's
public IP is
172.16.5.4 having a private
IP of
10.246.38.1. The home
LAN's public IP is
192.168.1.12 with an internal
private IP of
10.0.0.5.
This may seem confusing, so review the following example output from the ifconfig(8) command:
Once complete, both private IPs should be reachable using the ping(8) command like the following output suggests:
As expected, both sides have the ability to send and receive ICMP packets from the privately configured addresses. Next, both gateways must be told how to route packets in order to correctly send traffic from either network. The following command will achieve this goal:
# corp-net# route add 10.0.0.0 10.0.0.5 255.255.255.0# corp-net# route add net 10.0.0.0: gateway 10.0.0.5# priv-net# route add 10.246.38.0 10.246.38.1 255.255.255.0# priv-net# route add host 10.246.38.0: gateway 10.246.38.1At this point, internal machines should be reachable from each gateway as well as from machines behind the gateways. This is easily determined from the following example:
Setting up the tunnels is the easy part. Configuring
a secure link is a much more in depth process. The
following configuration uses pre-shared
(PSK) RSA keys. Aside
from the IP addresses, both
/usr/local/etc/racoon/racoon.conf files
will be identical and look similar to
Explaining every available option, along with those listed in these examples is beyond the scope of this document. There is plenty of relevant information in the racoon configuration manual page.
The SPD policies need to be configured so FreeBSD and racoon is able to encrypt and decrypt network traffic between hosts.
This task may be undertaken with a simple shell script
similar to the following which is on the corporate gateway.
This file will be used during system initialization and
should be saved as
/usr/local/etc/racoon/setkey.conf.
Once in place, racoon may be started on both gateways using the following command:
# /usr/local/sbin/racoon -F -f /usr/local/etc/racoon/racoon.conf -l /var/log/racoon.logThe output should be similar to the following:
To ensure the tunnel is working properly, switch to
another console and use tcpdump(1) to view network
traffic using the following command. Replace
em0 with the network interface card as
required.
# tcpdump -i em0 host 172.16.5.4 and dst 192.168.1.12Data similar to the following should appear on the console. If not, there is an issue, and debugging the returned data will be required.
At this point, both networks should be available and seem to be part of the same network. Most likely both networks are protected by a firewall, as they should be. To allow traffic to flow between them, rules need to be added to pass packets back and forth. For the ipfw(8) firewall, add the following lines to the firewall configuration file:
The rule numbers may need to be altered depending on the current host configuration.
For users of pf(4) or ipf(8), the following rules should do the trick:
Finally, to allow the machine to start support for the
VPN during system initialization, add the
following lines to /etc/rc.conf:
This, and other documents, can be downloaded from ftp://ftp.FreeBSD.org/pub/FreeBSD/doc/
For questions about FreeBSD, read the
documentation before
contacting <questions@FreeBSD.org>.
For questions about this documentation, e-mail <doc@FreeBSD.org>.