DaemonForums  

Go Back   DaemonForums > OpenBSD > OpenBSD General

OpenBSD General Other questions regarding OpenBSD which do not fit in any of the categories below.

Reply
 
Thread Tools Display Modes
  #1   (View Single Post)  
Old 12th February 2020
22decembre 22decembre is offline
Port Guard
 
Join Date: Dec 2014
Posts: 42
Default ipsec tunnels (ipv4/6)

I am trying to run ipsec tunnels between my home network and my VM.

So I gave the VPN Faq a good look. I have iked running on my router and my VM (both OpenBSD amd64 machines). And I can ping ipv4 private adresses from the VM. So I will assume that part is doing great (the opposite is working too).

Trouble is I cannot get it working on ipv6 eventhough I applied the same logic. And I am not sure the tunnel is used to carry the traffic between the two (there should be log entries from the VM in my main server logs. Nope).

I have (or want to have) backup, mail, dns and logging traffic between the VM and my main server which resides in my home network.

Here is iked.conf on my home router :

Code:
ip_dina= "89.234.141.151"

ikev2 'mirror.22decembre.eu' passive esp \
        from 2a06:4001:c7:e2::/64 to 2a00:5881:8110:2100::/64 \
        from 2a06:4001:c7:e2::/64 to 2a00:5881:8110:2100::2 \
        local 2a06:4000:10::c7 peer 2a00:5881:8110:2100::2 \
        dstid dina.22decembre.eu \
        rsa

ikev2 'mirrorv4' passive esp \
        from 10.0.0.0/16 to 10.2.0.0/16 \
        from 10.0.0.0/16 to $ip_dina \
        local $ip_mirror peer $ip_dina \
        dstid dina.22decembre.eu \
        rsa
And here is iked.conf on the VM :

Code:
ip_dina= "89.234.141.151"
ip_mirror= "212.237.177.102"
ip6_dina="2a00:5881:8110:2100::2"
ip6_mirror="2a06:4000:10::c7"

ikev2 'dina.22decembre.eu' active esp \
        from 2a00:5881:8110:2100::/64 to 2a06:4001:c7:e2::/64 \
        from  $ip6_dina  to 2a06:4001:c7:e2::/64 \
        local $ip6_dina peer $ip6_mirror \
        dstid mirror.22decembre.eu \
        rsa

ikev2 'dinav4' active esp \
        from  10.2.0.0/16  to 10.0.0.0/16 \
        from $ip_dina to 10.0.0.0/16 \
        local $ip_dina peer $ip_mirror \
        dstid mirror.22decembre.eu \
        rsa
And indeed :

Code:
stephane@dina:/home/stephane doas ipsecctl -sa
doas (stephane@dina.22decembre.eu) password:
FLOWS:
flow esp in from 10.0.0.0/16 to 10.2.0.0/16 peer 212.237.177.102 srcid FQDN/dina.22decembre.eu dstid FQDN/mirror.22decembre.eu type require
flow esp in from 10.0.0.0/16 to 89.234.141.151 peer 212.237.177.102 srcid FQDN/dina.22decembre.eu dstid FQDN/mirror.22decembre.eu type require
flow esp out from 10.2.0.0/16 to 10.0.0.0/16 peer 212.237.177.102 srcid FQDN/dina.22decembre.eu dstid FQDN/mirror.22decembre.eu type require
flow esp out from 89.234.141.151 to 10.0.0.0/16 peer 212.237.177.102 srcid FQDN/dina.22decembre.eu dstid FQDN/mirror.22decembre.eu type require

SAD:
esp tunnel from 89.234.141.151 to 212.237.177.102 spi 0xab1351bc auth hmac-sha2-256 enc aes-256
esp tunnel from 212.237.177.102 to 89.234.141.151 spi 0xbce17b24 auth hmac-sha2-256 enc aes-256
stephane@dina:/home/stephane ping 10.0.0.2
PING 10.0.0.2 (10.0.0.2): 56 data bytes
64 bytes from 10.0.0.2: icmp_seq=0 ttl=254 time=27.861 ms
64 bytes from 10.0.0.2: icmp_seq=1 ttl=254 time=27.363 ms
64 bytes from 10.0.0.2: icmp_seq=2 ttl=254 time=29.871 ms
^C
--- 10.0.0.2 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 27.363/28.365/29.871/1.084 ms
But I don't see traffic through it nor can I figure out why ipv6 does not show up.

Thank you for help in advance.
Reply With Quote
  #2   (View Single Post)  
Old 12th February 2020
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,033
Default

I can't help directly, but I noticed a recent change to IPv6 with iked(8) in the Following -current FAQ. As of January 10, automatic blocking of unencrkypted IPv6 was removed. Are you running -current?
Reply With Quote
  #3   (View Single Post)  
Old 12th February 2020
22decembre 22decembre is offline
Port Guard
 
Join Date: Dec 2014
Posts: 42
Default

The VM at least is. Should I migrate the router to current too in order to avoid misconfiguration there too ?
Reply With Quote
  #4   (View Single Post)  
Old 12th February 2020
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,033
Default

This is a change in function for unencrypted packets. I don't know enough about iked() to know if there would be any difference.
Reply With Quote
Reply

Tags
ipsec, vpn, vpn ikev2 openbsd

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
IPSEC,CARP,sasyncd -- IPSEC failover is weird da1 OpenBSD Security 4 24th June 2017 12:09 PM
Managing Individual IPsec Tunnels On A Multi-Tunnel Gateway J65nko News 0 25th November 2013 09:10 PM
Sheffield ISP: You don't need a whole IPv4 address to yourself, right? J65nko News 1 16th January 2013 06:06 PM
ipsec/isakmpd tunnels dropping after upgrade kbeaucha OpenBSD Installation and Upgrading 9 8th May 2012 08:27 PM
Trading IPv4 addresses will end in tears J65nko News 0 30th August 2011 12:43 AM


All times are GMT. The time now is 11:54 PM.


Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2020, Jelsoft Enterprises Ltd.
Content copyright © 2007-2010, the authors
Daemon image copyright ©1988, Marshall Kirk McKusick