Point-to-Point VPN + Firewall + Router (sorta) - What should I use?

[Bruco]

Here's the scenario:

I've got a number of remote sites that use a point-to-point VPN for WAN connectivity back to the data center. These are consistent tunnels with no restrictions provided by Cisco PIX firewalls (well, a newer one is an ASA).

Now I need another point-to-point VPN - but I can't buy anything. So I thought perhaps I could configure a couple FreeBSD boxes to act, well, pretty much in place of what a PIX would do.

I'll need the VPN between the two boxes, and firewall on at least one (one will be Internet-facing, the other I'm going to try putting in the DMZ of an existing PIX - but if that causes a problem with the VPN passthrough then it, too, will be Internet-facing). Internet traffic would also need to be filtered with firewall rules. And the second NIC on the boxes will need to be able to pass traffic to the inside network, of course. There's a router on the inside of both networks.

Alternatively, if I can establish a P2P VPN from a single FreeBSD box directly to an existing PIX 515, that would work too. But is that really as much fun?

So can I do this with existing ports for FreeBSD? If so, what recommendations do you folks have?

Thanks!

[Bruco]

Oh, I'm sorry, maybe this should be in Ports and Packages. I apologize if that's the case.

[J65nko]

Although on OpenBSD, and not FreeBSD, have you seen http://www.securityfocus.com/infocus/1859?

[phoenix]

OpenVPN is very easy to setup. And once the tunnel is established and the tun device is enabled, you either configure a route to direct all traffic through the VPN interface, or you use IPFW divert rules to send specific data through the VPN link. (If you want examples on that, let me know and I'll post some from our setup at work.)

[Bruco]

Originally Posted by J65nko

Although on OpenBSD, and not FreeBSD, have you seen http://www.securityfocus.com/infocus/1859?

Ah, very slick. Thank you. I haven't used OpenBSD yet, but I think I'll try this out with a couple virtual boxes, see what I can see.

Originally Posted by phoenix

OpenVPN is very easy to setup. And once the tunnel is established and the tun device is enabled, you either configure a route to direct all traffic through the VPN interface, or you use IPFW divert rules to send specific data through the VPN link. (If you want examples on that, let me know and I'll post some from our setup at work.)

I'd definitely be interested in seeing some examples, thank you.

[phoenix]

Install /usr/ports/security/openvpn on the remote server (client) and the local server (server).

If you are going to have only a single remote system, then you can stick with the standard port 1194. If you are going to have multiple remote clients connecting back to a single, central hub system, you'll need a separate UDP port for each remote system.

On the client, edit /usr/local/etc/openvpn/openvpn.conf similar to:

# Device to use for the connection
dev tun0

# IP addresses for the tunnel (local remote)
ifconfig 10.x.x.1 10.x.x.2

# Other options for the tunnel device
tun-mtu 1500

# Remote IP and port to connect to
remote 1.1.1.1 1194

# Pre-shared key file
secret /usr/local/etc/openvpn/openvpn.key

# Run the daemon as a non-privileged user
user nobody
group nobody
daemon

# Keep the tun device open and the key loaded in RAM
persist-tun
persist-key

The ifconfig line configures the tun device, and gives each end of the tunnel a private IP. The remote line tells the OpenVPN daemon where to send the encrypted packets (the public IP of the hub server). The 1194 is the UDP port to be used for this connection.

On the local server, install OpenVPN and configure it similar to:

# Device to use for the connection
dev tun0

# IP addresses for the tunnel (local remote)
ifconfig 10.x.x.2 10.x.x.1

# Other options for the tunnel device
tun-mtu 1500

# Remote IP and port to connect to
remote 2.2.2.2 1194

# Pre-shared key file
secret /usr/local/etc/openvpn/openvpn.key

# Run the daemon as a non-privileged user
user nobody
group nobody
daemon

# Keep the tun device open and the key loaded in RAM
persist-tun
persist-key

Here, the ifconfig line is reversed, and the remote line has the public IP of the remote (client) system.

On one of the systems, run openvpn -genkey to generate a pre-shared key. Copy that to /usr/local/etc/openvpn/openvpn.key on both systems, and chown the file to root:wheel and chmod it to 600.

Add openvpn_enable="YES" to /etc/rc.conf on each system. Then run /usr/local/etc/rc.d/openvpn start to establish the connection.

After that, you can either:

• add static routes that direct traffic through tun0, or
• use IPFW fwd rules to direct specific traffic through the tunnel

You should also be able to use pf rdr rules to do the same, but I have no experience with pf.

You need to allow UDP traffic on port 1194 between the two hosts, so there shouldn't be any problems with passing traffic through the PIX firewall.

And that's about it, for the simple case.

[Bruco]

Awesome, thanks for taking the time to write all that! I'm working on testing this all in a virtual environment right now. I'll post my successes and tear-inducing failures here...