openswan & strongswan

 

IPSec是虛擬私密網絡的一種實現,在server & client間建立加密隧道傳輸數據,分兩個階段

1. Phrase1
   交換密鑰建立隧道,使用IKE協議(Internet Key Exchange)
   IKE分兩個版本(IKE1/IKE2)
   IKE1有兩種模式,主力模式(main mode),積極模式(野蠻模式,aggressive mode),不同開源/閉源軟件實現版本不同,不同網絡設備實現版本也不同
   
   
2. Phrase2
   對隧道中的數據加密傳輸,使用ESP協議(Encapsulate Security Payload)

 

Phrase1 & Phrase2可以使用不同的加密算法(cipher suites)

 

IKE1:

1. main mode:
   6個ISAKMP包
2. aggressive mode:
   3個ISAKMP包
   

 

 

 

 

OpenSwan:

Prerequisite:

 

1. 開啟轉發
   

   echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf sysctl --system

2. iptables -t nat -A POSTROUTING -s 172.16.0.0/12 -o eth0 -j MASQUERADE

1. yum install  openswan

   默認安裝的是libreswan,配置文件
   

    

    

2. 修改內核參數,允許IP轉發,永久性禁止redicret,關閉反向路徑校驗(reverse path filtering)
   

   net.ipv4.ip_forward=1 net.ipv4.conf.all.rp_filter=0 net.ipv4.conf.default.rp_filter=0 net.ipv4.conf.eth0.rp_filter=0 sysctl -a 2> /dev/null|egrep '(.*)(accept_redirects|send_redirects)'|awk '{print $1" = "0}' >> /etc/sysctl.conf sysctl --system

    

   
   
   
3. ipsec.conf
   

   config setup protostack=netkey # IPSec stack logfile=/var/log/pluto.log virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10 dumpdir=/var/run/pluto conn site-to-site type=tunnel #transport authby=secret # 定義認證方式PSK auto=start # 可選擇add,route,start ikev2=never # 關閉IKEv2 rekey=no #aggrmode=yes # aggressive mode ## phase 1 ## keyexchange=ike # ike密鑰交換方式 ike=aes128-sha1;modp1536 # 按照對端配置定義ike階段算法和group #ike=3des-sha1;modp1024 ikelifetime=86400s # ike階段生命周期 ## phase 2 ## phase2=esp # 二階段傳輸格式 phase2alg=aes128-sha1;modp1536 # 按照對端配置定義ipsec階段算法和group compress=yes pfs=no # 開啟PFS type=tunnel # 開啟隧道模式 ## left ## #left=%defaultroute left=192.168.1.10 # 本地IP,nat場景選擇真實的主機地址 leftid=116.236.134.26 # 本地標識ID leftsourceip=116.236.134.26 # 存在nat源地址,選擇nat后的公網ip leftsubnet=192.168.0.0/16 # 本地子網 leftnexthop=%defaultroute # nat場景下一跳選擇nat后的網關ip ## right ## right=47.101.219.24 # 遠端VPN網關ip rightid=47.101.219.24 # 遠端表示ID rightsourceip=47.101.219.24 # 遠端源地址,選擇VPN網關ip rightsubnet=172.16.0.0/12 # 遠端子網 rightnexthop=%defaultroute # 遠端路由按缺省配置 

    

   
   

    

4. ipsec --status ipsec auto --up connctionname    

    

5. ip xfrm policy

   查看tunnel信息

 

 

StrongSwan:

 

prerequisite:

1. RSA認證(PSK跳過)
   

   cp cacert.pem /etc/strongswan/ipsec.d/cacerts/ cp server.crt /etc/strongswan/ipsec.d/certs/ cp server.key /etc/strongswan/ipsec.d/private/ cp client.crt /etc/strongswan/ipsec.d/certs/ cp client.key /etc/strongswan/ipsec.d/private/

    

 

1. /etc/strongswan/ipsec.conf
   

   config setup uniqueids=never # 允許單賬號多終端同時登錄 conn %default type=tunnel # tunnel模式 type=transport ikelifetime=60m keylife=5m dpddelay=10s rekeymargin=3m keyingtries=3 conn ios_cert_authentication # 證書認證 fragmentation=yes auto=add ## phase 1 ## keyexchange=ikev1 ## left ## left=%defaultroute leftauth=pubkey leftsubnet=0.0.0.0/0 leftcert=server.crt ## right ## right=%any rightauth=pubkey rightauth2=xauth rightsourceip=10.31.2.0/24 rightcert=client.crt conn android_xauth_psk # 預共享密鑰認證 auth=add ## phase 1 ## keyexchange=ikev1 ## left ## left=%defaultroute leftauth=psk leftsubnet=0.0.0.0/0 ## right ## right=%any rightauth=psk rightauth2=xauth rightsourceip=10.31.2.0/24 conn networkmanager-strongswan auto=add ## phase 1 ## keyexchange=ikev2 ## left ## left=%defaultroute leftauth=pubkey leftsubnet=0.0.0.0/0 leftcert=server.cert ## right ## right=%any rightauth=pubkey rightsourceip=10.31.2.0/24 rightcert=client.crt conn site-to-site # 定義連接名稱 site-to-site auto=start # 啟動strongswan時自動觸發,可選add,route,start type=tunnel # 開啟隧道模式 compress=yes authby=secret # 協商認證方式,key leftauth=psk rightauth=psk ## phase 1 ## keyexchange=ikev1 # ike密鑰交換方式 ike=aes128-sha1-modp1536! # 按照對端配置定義ike階段算法和group esp=aes128-sha1-modp1536! # 按照對端配置定義ipsec階段算法和group ikelifetime=86400s # ike階段生命周期 lifetime=3600s # 二階段生命周期 ## left ## left=192.168.1.10 # 本端ip,nat場景選擇真實的主機地址 leftid=116.236.134.26 # 本端發起協商的公網IP,即local-id leftsubnet=192.168.0.0/16 # 本端內網地址段 ## right ## right=47.101.219.24 # 遠端VPN網關ip rightid=47.101.219.24 # 遠端標識ID rightsubnet=172.16.0.0/12 # 遠端子網

    

2. /etc/strongswan/ipsec.secrets
   

    : RSA server.key : PSK "YourPSK"
   UserName1 %any : XAUTH "Password1"
   UserName2 %any : XAUTH "Password2" 
   UserName1 %any : EAP "Password1"
   UserName2 %any : EAP "Password2"
   47.101.219.25 116.236.134.26 : PSK 'perpetual'  # site-to-site : PSK "YourPSK" <=> %any %any : PSK "YourPSK"
   Host Peer : METHOD <server.key|PSK|Password> <password_of_server.key>

    

3. /etc/strongswan/strongswan.conf
   

   charon { filelog { /var/log/strongswanlog { append = no default = 1 flush_line = yes ike_name = yes time_format = %b %e %T } } load_modular = yes compress=yes plugins { include strongswan.d/charon/*.conf } dns1=8.8.8.8 dns2=8.8.4.4 } include strongswan.d/*.conf