DaemonForums  

Go Back   DaemonForums > OpenBSD > OpenBSD Security

OpenBSD Security Functionally paranoid!

Reply
 
Thread Tools Display Modes
  #1   (View Single Post)  
Old 9th September 2009
wesley wesley is offline
Real Name: Wesley
Shell Scout
 
Join Date: Aug 2009
Location: Reunion Island
Posts: 92
Default connect to an other site using ipsec-nat

Hello,

We have to connect to a factory using ipsec and nat.
A server(factory) will send backup to us using ftp.

Our ftp server is protected by a firewall with OpenBSD (PF and ftp-proxy)
OpenBSD firewall : 2 interfaces : egress (81.255.XX.XX) and local (10.0.0.3) ; FTP server : 10.0.0.4

The admin of the factory has send me informations to configure vpn ipsec :

our vpn gateway : 81.255.XX.XX
src address :192.168.191.0/24
dst address : 192.168.192.0/24

factory vpn gateway : 210.253.XX.XX
src address : 192.168.192.0/24
dst address : 192.168.191.0/24

Authentication Mode: Preshared Keys
Diffie-Hellman Group 2 (1024 bit)
Encryption Algorithm: AES 256
Hashing Algoritm: SHA-1
Negotiation Mode: Main
Lifetime : 28800 sec

IPSec-Parameter:
Perfect Forward Secrecy: Group 2
Encapsulation : ESP
Encryption Algorithm: AES 256
Authentication Algorithm : SHA-1
Encapsulation Mode: Tunnel
Lifetime : 3600 sec

the preshared key : haiku

i have read man pages of ipsec.conf, ipsecctl, isakampd.
My pf.conf let protocol esp, udp 500 and 4500 from any to any.
I dont see how to realize that. If someone can help me.
Thank you.
Reply With Quote
  #2   (View Single Post)  
Old 9th September 2009
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,975
Default

Step 1. Talk with your factory admin, and change your preshared key, since you have now published it here. It is your only authentication. Do not use "haiku". You hid the gateway addresses, but all it takes is a quick scan of 64 thousand IP addresses to find either gateway and quickly break your only authentication. And such keys should never be short, and never be words.

-----------------

Please clarify your RFC 1918 subnets: each location uses a separate subnet, correct? That is, the systems at the factory use 192.168.192.x IP addresses, and the systems at your site use 192.168.191.x? If these will stay separate subnets, then it makes the use of IPSec much, much easier.

Please confirm if it is your intention that a server or workstation with address 192.168.192.17 at the factory will still be 192.168.192.17 when connected to your local network. If so, then your ipsec.conf configuration will be straightforward.

Translation of subnets should only be necessary when there are IP addressing collisions, and those might only occur when connecting large organizations via VPN gateways. I would avoid it, if at all possible. While such translation can be done, it is complicated: see http://undeadly.org/cgi?action=artic...20090127205841
Reply With Quote
  #3   (View Single Post)  
Old 10th September 2009
wesley wesley is offline
Real Name: Wesley
Shell Scout
 
Join Date: Aug 2009
Location: Reunion Island
Posts: 92
Default for details

First : what i have wrote in the previous message like the preshared key, it is not the true IKE passphrase.

The factory is a large organization.
So i have to implement NAT in VPN.
Reply With Quote
  #4   (View Single Post)  
Old 10th September 2009
wesley wesley is offline
Real Name: Wesley
Shell Scout
 
Join Date: Aug 2009
Location: Reunion Island
Posts: 92
Default first try

I ve read http://undeadly.org/cgi?action=artic...20090127205841
Here what i have done :

my pf.conf, i ve add lines :
binat on enc0 inet from 10.0.0.0/24 to 192.168.192.0/24 -> \
192.168.191.0/24

my ipsec.conf:
ike esp from 192.168.192.0/24 (10.0.0.0/8) to 192.168.191.0/24 peer \
the_gateway_of_factory \
main auth hmac-sha1 enc aes-256 group modp1024 \
quick auth hmac-sha1 enc aes-256 group modp1024 \
psk "haiku"

When i try : ipsecctl -sa, i have :
# ipsecctl –sa j’ai comme résultat :

FLOWS:
flow esp in from 192.168.191.0/24 to 10.0.0.0/8 peer 212.99.117.97 srcid my_gateway dstid the_gateway_factory type use
flow esp out from 10.0.0.0/8 to 192.168.191.0/24 peer 212.99.117.97 srcid my_gateway dstid the_gateway_factory type require

SAD:
esp tunnel from the_gateway_fatory to my_gateway spi 0x5f836c7a auth hmac-sha1 enc aes-256
esp tunnel from my_gateway to the_factory_gateway spi 0x7d51b2f7 auth hmac-sha1 enc aes-256
#

If i type : isakmpd and after, ipsecctl -f /etc/ipsec.conf, i ve the following :
ike_ipsec_establish : open (/var/run/isakmpd.fifo) : no such file or directory
Why ?

I'm not very far from the goal! need help.
Reply With Quote
  #5   (View Single Post)  
Old 10th September 2009
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,975
Default

isakmpd, if used with ipsecctl and ipsec.conf, must be started with "-K".
Reply With Quote
  #6   (View Single Post)  
Old 10th September 2009
wesley wesley is offline
Real Name: Wesley
Shell Scout
 
Join Date: Aug 2009
Location: Reunion Island
Posts: 92
Default isakmpd, ipsec

in my /etc/rc.conf.local, i have added :
ipsec="yes"
isakmpd="-K"

when i restart the machine, i can see the same error :
ike_ipsec_establish : open (/var/run/isakmpd.fifo) : no such file or directory

when i'm login on it and type :
isakmpd -K
ipsecctl -f /etc/ipsec.conf
it's ok, the tunnel is ok. But why i have this error at startup ?
Reply With Quote
  #7   (View Single Post)  
Old 10th September 2009
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,975
Default

Examine /var/log/daemon for errors from isakmpd(8).

During testing, you can use
# isakmpd -Kd &
or
# isakmpd -Kvd &
to see messages from isakmpd on your console.
Reply With Quote
  #8   (View Single Post)  
Old 10th September 2009
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,975
Default

Ah, here's the reason: in rc.conf.local, the correct variable name is isakmpd_flags -- so isakmpd is not being started.
Reply With Quote
  #9   (View Single Post)  
Old 10th September 2009
wesley wesley is offline
Real Name: Wesley
Shell Scout
 
Join Date: Aug 2009
Location: Reunion Island
Posts: 92
Default good job

Thank's !!!
Reply With Quote
Old 10th September 2009
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,975
Default

One thing I recommend you use, based on my small experience -- of course, without using the complications of the (srcnat) option -- is that the tcpdump(8) tool is a great aid.

There's no way to tell if traffic is being tunnelled in esp packets or not, without it.

IPSec SA and Flow definitions will determine what packets get tunnelled and what packets do not, but there is no functional difference to a network application for IPSec-protected traffic or traffic flowing in the clear.

So, an admin might assume that traffic is running inside a VPN just because there is some output from # ipsecctl -sa, but the traffic intended to be secured may not actually be tunneled.

It has always been helpful to me to run tcpdump and examine packets for both the enc0 pseudo-devices, and, for the gateway NICs.
Reply With Quote
Old 11th September 2009
wesley wesley is offline
Real Name: Wesley
Shell Scout
 
Join Date: Aug 2009
Location: Reunion Island
Posts: 92
Default

thank's for your suggestions.
Reply With Quote
Old 17th September 2009
wesley wesley is offline
Real Name: Wesley
Shell Scout
 
Join Date: Aug 2009
Location: Reunion Island
Posts: 92
Default ipsec vpn and nat doesnt work

Hello,

I come back. For over a week, i break my head to run the vpn, it is mounted, but there is no traffic, what is more, i have a problem about phase 2 in ipsec.conf.

To summarize :
My firewall : 10.0.0.113/24 ; FTP SERVER : 10.0.0.11524
My network (A) have 10.0.0.0 /24, same network for site 2(B).

So we need to implement : address translation
Site A will be : 192.168.192.0 /24
Site B will be : 192.168.191.0 /24

Ip address for A : 11.11.11.11
IP address for B : 22.22.22.22


I attach my files : ipsec.conf and pf.conf

I have this error in my /var/log/daemon :
Sep 17 11:00:01 sdsl114 newsyslog[5191]: logfile turned over
Sep 17 11:04:18 sdsl114 savecore: no core dump
Sep 17 11:04:19 sdsl114 isakmpd[19476]: responder_recv_HASH_SA_NONCE: peer proposed invalid phase 2 IDs: initiator id 192.168.191.0/255.255.255.0, responder id 192.168.192.0/255.255.255.0
Sep 17 11:04:19 sdsl114 isakmpd[19476]: dropped message from 22.22.22.22 port 500 due to notification type INVALID_ID_INFORMATION
Sep 17 11:04:19 sdsl114 ftp-proxy[13321]: listening on 11.11.11.11 port 21

When i type ipsecctl -sa, i have :
FLOWS:
flow esp in from 192.168.191.0/24 to 10.0.0.0/24 peer 22.22.22.22 srcid 11.11.11.11/32 dstid 22.22.22.22/32 type use
flow esp out from 10.0.0.0/24 to 192.168.191.0/24 peer 22.22.22.22 srcid 11.11.11.11/32 dstid 22.22.22.22/32 type require
SAD:
esp tunnel from 11.11.11.11 to 22.22.22.22 spi 0x5f3b4329 auth hmac-sha1 enc aes-256
esp tunnel from 22.22.22.22 to 11.11.11.11 spi 0x60ecca8f auth hmac-sha1 enc aes-256

Can you help me please? thank's
Attached Files
File Type: conf ipsec.conf (203 Bytes, 181 views)
File Type: conf pf.conf (979 Bytes, 135 views)
Reply With Quote
Old 17th September 2009
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,975
Default

Phase 1 negotiation is used by the gateway to authenticate with each other and to establish an encrypted channel. Phase 2 negotiation is where IPSec configurations are set. Both are required to complete. The failure to successfully negotiate Phase 2 prevents IPSec from working. If I understand this message:
Code:
responder_recv_HASH_SA_NONCE: peer proposed invalid phase 2 IDs: 
initiator id 192.168.191.0/255.255.255.0, responder id 192.168.192.0/255.255.255.0
it looks like both sides of the gateway are trying to use 192.168.191/24 as the local network. But I may be wrong; I've never used this type of complex configuration and may be misunderstanding the cause of the misconnect between the gateways.

I'd recommended avoiding this level of complexity, if at all possible.

Because I have limited IPSec configuration experience, and no one else has jumped in, I recommend you post your problem to OpenBSD's misc@ mailing list. Rather than only one or two people who may have some experience with IPSec, there will be hundreds.

Some warnings:

No attachments are allowed. Place your configuration files and log messages as text, in-line with your e-mail. Attachments will just be stripped, and no one will see them.

Put more information in your request for assistance than you think may be needed. For example, include a dmesg, even though you don't think it is necessary. (Actually, it is often helpful, because it gives readers your specific release, flavor, and architecture for the OS, among other information.) Because the misc@ mailing list is not newbie-friendly, the more you can provide, the less likely your posting will be ignored, and the less likely you'll get a rude response.

Read the Netiquette section from the OpenBSD website, and follow its guidance:
http://www.openbsd.org/mail.html
Reply With Quote
Old 17th September 2009
wesley wesley is offline
Real Name: Wesley
Shell Scout
 
Join Date: Aug 2009
Location: Reunion Island
Posts: 92
Default

thank's, i have posted it on misc@openbsd.org, how many time it takes to appear ?
Reply With Quote
Old 17th September 2009
Carpetsmoker's Avatar
Carpetsmoker Carpetsmoker is offline
Real Name: Martin
Tcpdump Spy
 
Join Date: Apr 2008
Location: Netherlands
Posts: 2,243
Default

It's already there:
http://www.nabble.com/Ipsec-vpn-and-nat-td25489013.html
__________________
UNIX was not designed to stop you from doing stupid things, because that would also stop you from doing clever things.
Reply With Quote
Old 17th September 2009
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,975
Default

And it's in other archives as well, such as http://marc.info/?l=openbsd-misc&m=125318467307484&w=2

No replies, yet.

If you subscribe to misc@, you will see any replies in your e-mail. If you don't subscribe, you will have to track one of the many public archives manually.
Reply With Quote
Old 17th September 2009
wesley wesley is offline
Real Name: Wesley
Shell Scout
 
Join Date: Aug 2009
Location: Reunion Island
Posts: 92
Red face very good forum

Thank you!
I'm waiting for replies.
Reply With Quote
Old 18th September 2009
gamemaniac gamemaniac is offline
Port Guard
 
Join Date: Aug 2009
Posts: 15
Default

Informative posts indeed although a little complicated to me but easy to understand tips.
Reply With Quote
Old 21st September 2009
wesley wesley is offline
Real Name: Wesley
Shell Scout
 
Join Date: Aug 2009
Location: Reunion Island
Posts: 92
Wink A stupid error

I forgot to modify the file sysctl.conf in order to activate the IP Fowarding!
I ve rebooted it, and now I haven't any more error in my file daemon log.
Reply With Quote
Old 21st September 2009
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,975
Default

Glad you've got it working, Wesley.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
ipsec with client nat sicute OpenBSD General 0 30th October 2008 05:39 PM
Routing between site-to-site tunnels docrice OpenBSD General 5 26th September 2008 09:21 AM
IPsec on openbsd hitete OpenBSD Installation and Upgrading 1 12th July 2008 01:57 AM
Bare Minimum Site-to-Site VPN on OpenBSD ai-danno Guides 0 20th May 2008 12:45 AM
Transferring away from the other site... s2scott Feedback and Suggestions 2 5th May 2008 09:47 AM


All times are GMT. The time now is 08:42 AM.


Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Content copyright © 2007-2010, the authors
Daemon image copyright ©1988, Marshall Kirk McKusick