User Tools

Site Tools


documentation:examples:gre_ipsec_and_openvpn

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision
Previous revision
documentation:examples:gre_ipsec_and_openvpn [2022/10/04 15:10] – [VM2: OpenVPN server] olivierdocumentation:examples:gre_ipsec_and_openvpn [2023/07/10 12:40] (current) – [Router 4] olivier
Line 1062: Line 1062:
 </code> </code>
  
-==== VM2: OpenVPN server ====+==== Standard userland mode (slow) ==== 
 + 
 +=== VM2: OpenVPN server ===
  
 Create the openvpn configuration file for server mode as /usr/local/etc/openvpn/openvpn.conf: Create the openvpn configuration file for server mode as /usr/local/etc/openvpn/openvpn.conf:
Line 1125: Line 1127:
 echo '</key>' >> /usr/local/etc/openvpn/VM4-openvpn.conf echo '</key>' >> /usr/local/etc/openvpn/VM4-openvpn.conf
 </code> </code>
-==== VM4: OpenVPN client ====+ 
 +=== VM4: OpenVPN client ===
  
 As OpenVPN client, VM4 should get its openvpn configuration file (that embedded certificate and key) from VM2 and put them in /usr/local/etc/openvpn. As OpenVPN client, VM4 should get its openvpn configuration file (that embedded certificate and key) from VM2 and put them in /usr/local/etc/openvpn.
Line 1132: Line 1135:
 <code> <code>
 mkdir /usr/local/etc/openvpn mkdir /usr/local/etc/openvpn
-scp 10.0.23.2:/usr/local/etc/openvpn/vm4-openvpn.conf /usr/local/etc/openvpn/openvpn.conf+scp 10.0.23.2:/usr/local/etc/openvpn/VM4-openvpn.conf /usr/local/etc/openvpn/openvpn.conf
 </code> </code>
- 
  
 Enable and start openvpn: Enable and start openvpn:
Line 1141: Line 1143:
 service openvpn start service openvpn start
 </code> </code>
-==== Testing ====+ 
 +=== Testing ===
  
 Pinging VM5 from VM1: Pinging VM5 from VM1:
Line 1214: Line 1217:
 16:52:40.744771 IP 10.0.34.4.1194 > 10.0.23.2.1194: UDP, length 114 16:52:40.744771 IP 10.0.34.4.1194 > 10.0.23.2.1194: UDP, length 114
 16:52:40.744786 IP 10.0.34.4.1194 > 10.0.23.2.1194: UDP, length 22 16:52:40.744786 IP 10.0.34.4.1194 > 10.0.23.2.1194: UDP, length 22
 +</code>
 +
 +==== Data Channel Offload (DCO), kernel mode (fast) ====
 +
 +Start with a working userland configuration, then modify existing configuration files like that:
 +  * Need to load if_ovpn module on both side
 +  * Need to enable subnet topology on the server side
 +
 +=== VM2: OpenVPN server ===
 +
 +<code>
 +service openvpn stop
 +sysrc kld_list="if_ovpn"
 +kldload if_ovpn
 +echo "topology subnet" >> /usr/local/etc/openvpn/openvpn.conf
 +service openvpn start
 +</code>
 +
 +=== VM4: OpenVPN client ===
 +
 +<code>
 +service openvpn stop
 +sysrc kld_list="if_ovpn"
 +kldload if_ovpn
 +service openvpn start
 +</code>
 +
 +=== Testing ===
 +
 +Pinging VM5 from VM1:
 +<code>
 +root@VM1:~ # ping -c 2 10.0.45.5
 +PING 10.0.45.5 (10.0.45.5): 56 data bytes
 +64 bytes from 10.0.45.5: icmp_seq=0 ttl=62 time=1.700 ms
 +64 bytes from 10.0.45.5: icmp_seq=1 ttl=62 time=1.629 ms
 +
 +--- 10.0.45.5 ping statistics ---
 +2 packets transmitted, 2 packets received, 0.0% packet loss
 +round-trip min/avg/max/stddev = 1.629/1.665/1.700/0.035 ms
 +root@VM1:~ # ping -c 2 2001:db8:45::5
 +PING6(56=40+8+8 bytes) 2001:db8:12::1 --> 2001:db8:45::5
 +16 bytes from 2001:db8:45::5, icmp_seq=0 hlim=62 time=2.699 ms
 +16 bytes from 2001:db8:45::5, icmp_seq=1 hlim=62 time=1.618 ms
 +
 +--- 2001:db8:45::5 ping6 statistics ---
 +2 packets transmitted, 2 packets received, 0.0% packet loss
 +round-trip min/avg/max/std-dev = 1.618/2.158/2.699/0.541 ms
 +
 +</code>
 +
 +OpenVPN log file on VM2 (error installing route are due to DCO restriction):
 +<code>
 +Oct  4 18:29:40 VM2 openvpn[89399]: OpenVPN 2.6_git [git:734de8f9aa2df56bcb45ebab7cfa799a23f36403] amd64-portbld-freebsd14.0 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] [DCO] built on Oct  4 2022
 +Oct  4 18:29:40 VM2 openvpn[89399]: library versions: OpenSSL 1.1.1q-freebsd  5 Jul 2022, LZO 2.10
 +Oct  4 18:29:40 VM2 openvpn[89399]: WARNING: --keepalive option is missing from server config
 +Oct  4 18:29:40 VM2 openvpn[89399]: DCO device tun0 opened
 +Oct  4 18:29:40 VM2 openvpn[89399]: /sbin/ifconfig tun0 10.0.24.1 10.0.24.2 mtu 1500 netmask 255.255.255.0 up
 +Oct  4 18:29:40 VM2 openvpn[89399]: /sbin/ifconfig tun0 inet6 2001:db8:24::1/64 mtu 1500 up
 +Oct  4 18:29:41 VM2 openvpn[89399]: /sbin/ifconfig tun0 inet6 -ifdisabled
 +Oct  4 18:29:41 VM2 openvpn[89399]: add_route_ipv6(2001:db8:45::/64 -> 2001:db8:24::2 metric 200) dev tun0
 +Oct  4 18:29:41 VM2 openvpn[89399]: Could not determine IPv4/IPv6 protocol. Using AF_INET6
 +Oct  4 18:29:41 VM2 openvpn[89399]: setsockopt(IPV6_V6ONLY=0)
 +Oct  4 18:29:41 VM2 openvpn[89399]: UDPv6 link local (bound): [AF_INET6][undef]:1194
 +Oct  4 18:29:41 VM2 openvpn[89399]: UDPv6 link remote: [AF_UNSPEC]
 +Oct  4 18:29:41 VM2 openvpn[89399]: NOTE: IPv4 pool size is 253, IPv6 pool size is 65536. IPv4 pool size limits the number of clients that can be served from the pool
 +Oct  4 18:29:41 VM2 openvpn[89399]: ifconfig_pool_read(), in='VM4,10.0.24.4,2001:db8:24::1002'
 +Oct  4 18:29:41 VM2 openvpn[89399]: succeeded -> ifconfig_pool_set(hand=2)
 +Oct  4 18:29:41 VM2 openvpn[89399]: Initialization Sequence Completed
 +Oct  4 18:30:11 VM2 openvpn[89399]: 10.0.34.4:10468 peer info: IV_VER=2.6_git
 +Oct  4 18:30:11 VM2 openvpn[89399]: 10.0.34.4:10468 peer info: IV_PLAT=freebsd
 +Oct  4 18:30:11 VM2 openvpn[89399]: 10.0.34.4:10468 peer info: IV_TCPNL=1
 +Oct  4 18:30:11 VM2 openvpn[89399]: 10.0.34.4:10468 peer info: IV_NCP=2
 +Oct  4 18:30:11 VM2 openvpn[89399]: 10.0.34.4:10468 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
 +Oct  4 18:30:11 VM2 openvpn[89399]: 10.0.34.4:10468 peer info: IV_PROTO=94
 +Oct  4 18:30:11 VM2 openvpn[89399]: 10.0.34.4:10468 peer info: IV_LZO_STUB=1
 +Oct  4 18:30:11 VM2 openvpn[89399]: 10.0.34.4:10468 peer info: IV_COMP_STUB=1
 +Oct  4 18:30:11 VM2 openvpn[89399]: 10.0.34.4:10468 peer info: IV_COMP_STUBv2=1
 +Oct  4 18:30:11 VM2 openvpn[89399]: 10.0.34.4:10468 [VM4] Peer Connection Initiated with [AF_INET6]::ffff:10.0.34.4:10468
 +Oct  4 18:30:11 VM2 openvpn[89399]: VM4/10.0.34.4:10468 MULTI_sva: pool returned IPv4=10.0.24.4, IPv6=2001:db8:24::1002
 +Oct  4 18:30:11 VM2 openvpn[89399]: VM4/10.0.34.4:10468 /sbin/route add -net 10.0.45.0/24 10.0.24.4 -fib 0
 +Oct  4 18:30:11 VM2 openvpn[89399]: VM4/10.0.34.4:10468 ERROR: FreeBSD route add command failed: external program exited with error status: 1
 +Oct  4 18:30:11 VM2 openvpn[89399]: VM4/10.0.34.4:10468 /sbin/route -6 add -net 2001:db8:45::/64 2001:db8:24::1002 -fib 0
 +Oct  4 18:30:11 VM2 openvpn[89399]: VM4/10.0.34.4:10468 ERROR: FreeBSD route add command failed: external program exited with error status: 1
 +</code>
 +
 +OpenVPN log file on VM4:
 +<code>
 +Oct  4 18:30:11 VM4 openvpn[86737]: OpenVPN 2.6_git [git:734de8f9aa2df56bcb45ebab7cfa799a23f36403] amd64-portbld-freebsd14.0 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] [DCO] built on Oct  4 2022
 +Oct  4 18:30:11 VM4 openvpn[86737]: library versions: OpenSSL 1.1.1q-freebsd  5 Jul 2022, LZO 2.10
 +Oct  4 18:30:11 VM4 openvpn[86737]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
 +Oct  4 18:30:11 VM4 openvpn[86737]: TCP/UDP: Preserving recently used remote address: [AF_INET]10.0.23.2:1194
 +Oct  4 18:30:11 VM4 openvpn[86737]: UDPv4 link local: (not bound)
 +Oct  4 18:30:11 VM4 openvpn[86737]: UDPv4 link remote: [AF_INET]10.0.23.2:1194
 +Oct  4 18:30:11 VM4 openvpn[86737]: [VM2] Peer Connection Initiated with [AF_INET]10.0.23.2:1194
 +Oct  4 18:30:11 VM4 openvpn[86737]: DCO device tun0 opened
 +Oct  4 18:30:11 VM4 openvpn[86737]: /sbin/ifconfig tun0 10.0.24.4 10.0.24.1 mtu 1500 netmask 255.255.255.0 up
 +Oct  4 18:30:11 VM4 openvpn[86737]: /sbin/ifconfig tun0 inet6 2001:db8:24::1002/64 mtu 1500 up
 +Oct  4 18:30:12 VM4 openvpn[86737]: /sbin/ifconfig tun0 inet6 -ifdisabled
 +Oct  4 18:30:12 VM4 openvpn[86737]: add_route_ipv6(2001:db8:12::/64 -> 2001:db8:24::1 metric 200) dev tun0
 +Oct  4 18:30:12 VM4 openvpn[86737]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
 +Oct  4 18:30:12 VM4 openvpn[86737]: Initialization Sequence Completed
 </code> </code>
  
 ===== Wireguard ===== ===== Wireguard =====
  
-==== Key pairs generation ====+On current (14.0) needs only wireguard-tools (kernel module included), on older (12 or 13) needs wireguard-kmod. 
 +==== Key pairs generation on VM2 and VM4 ====
  
 The first step is to generate a couple of private and public keys on each wireguard endpoint. The first step is to generate a couple of private and public keys on each wireguard endpoint.
  
-On VM2 and on VM4, generate the keys:+The standard way of generating keys is using this command:
  
 <code> <code>
Line 1231: Line 1336:
 </code> </code>
  
 +But on this example, we will use static keys as example.
 ==== Router 2 ==== ==== Router 2 ====
  
-Display router 2 private key, and router 4 public key.+Write example-only static and public key, on real-life, used the one generated by wg.
  
 <code> <code>
 +echo "oFsqDWpgtlma4Dy3YkPd918d3Nw9xdV9MBVn4YT1N38=" > /usr/local/etc/wireguard/private
 +echo "z9wBhxr/K405uQeYnCoGRi6VGWu/QAhym7JgH1BguxE=" > /usr/local/etc/wireguard/public
 cat > /usr/local/etc/wireguard/wg0.conf <<EOF cat > /usr/local/etc/wireguard/wg0.conf <<EOF
 [Interface] [Interface]
-PrivateKey = 8Og1cCmvirK+zcGus/EyaA8aiFdzjjtS9GbuBa/bqFQ=+PrivateKey = oFsqDWpgtlma4Dy3YkPd918d3Nw9xdV9MBVn4YT1N38=
 ListenPort = 51820 ListenPort = 51820
  
 [Peer] [Peer]
-PublicKey = FSvVqj2s1FZqsSIvPLrE1RRTgbaPLbfG87P36F21M1g+PublicKey = o267Qf43WlVTawLq/8nrET4GQKijrjWFKiux9iNLv04
-AllowedIPs = 10.0.45.0/24,2001:db8:45::2/64+AllowedIPs = 10.0.45.0/24,2001:db8:45::/64
 Endpoint = 10.0.34.4:51820 Endpoint = 10.0.34.4:51820
 EOF EOF
Line 1254: Line 1362:
 ==== Router 4 ==== ==== Router 4 ====
  
-Display router 4 private key, and router 2 public key.+Generate example-only router 4 wg keys, and declare 2 public key.
  
 <code> <code>
 +echo "4HRXmxN77CVb5VykdNX6mqkzCh2ycu4hfWfYHTvkLGE=" > /usr/local/etc/wireguard/private
 +echo "o267Qf43WlVTawLq/8nrET4GQKijrjWFKiux9iNLv04=" > /usr/local/etc/wireguard/public
 cat > /usr/local/etc/wireguard/wg0.conf <<EOF cat > /usr/local/etc/wireguard/wg0.conf <<EOF
 [Interface] [Interface]
-PrivateKey = ADfm6+sXZnoyDAkG/MXXy062pjSgh2GgfAIKwX+ewGg=+PrivateKey = 4HRXmxN77CVb5VykdNX6mqkzCh2ycu4hfWfYHTvkLGE=
 ListenPort = 51820 ListenPort = 51820
  
 [Peer] [Peer]
-PublicKey = gaQij176wrz3g+2RTJ/S1oEnc7rx2reU1Z0Thrv4oXc+PublicKey = z9wBhxr/K405uQeYnCoGRi6VGWu/QAhym7JgH1BguxE
-AllowedIPs = 10.0.12.0/24,2001:db8:12::2/64+AllowedIPs = 10.0.12.0/24,2001:db8:12::/64
 Endpoint = 10.0.23.2:51820 Endpoint = 10.0.23.2:51820
 EOF EOF
Line 1295: Line 1405:
 2 packets transmitted, 2 packets received, 0.0% packet loss 2 packets transmitted, 2 packets received, 0.0% packet loss
 round-trip min/avg/max/std-dev = 0.764/1.272/1.779/0.507 ms round-trip min/avg/max/std-dev = 0.764/1.272/1.779/0.507 ms
 +</code>
 +
 +Are we using the kernel module?
 +<code>
 +root@VM2:~ # kldstat -v -n if_wg.ko
 +Id Refs Address                Size Name
 +    1 0xffffffff82b17000    2e550 if_wg.ko (/boot/kernel/if_wg.ko)
 +        Contains modules:
 +                 Id Name
 +                473 wg
 +</code>
 +
 +Displaying wg status on VM2:
 +<code>
 +root@VM2:~ # ifconfig wg0
 +wg0: flags=80c1<UP,RUNNING,NOARP,MULTICAST> metric 0 mtu 1420
 +        options=80000<LINKSTATE>
 +        groups: wg
 +        nd6 options=101<PERFORMNUD,NO_DAD>
 +root@VM2:~ # netstat -rn | grep "Dest\|wg0"
 +Destination        Gateway            Flags     Netif Expire
 +10.0.45.0/24       link#            US          wg0
 +Destination                       Gateway                       Flags     Netif Expire
 +2001:db8:45::/64                  link#                       US          wg0
 +root@VM2:~ # wg show
 +interface: wg0
 +  public key: z9wBhxr/K405uQeYnCoGRi6VGWu/QAhym7JgH1BguxE=
 +  private key: (hidden)
 +  listening port: 51820
 +
 +peer: o267Qf43WlVTawLq/8nrET4GQKijrjWFKiux9iNLv04=
 +  endpoint: 10.0.34.4:51820
 +  allowed ips: 2001:db8:45::/64, 10.0.45.0/24
 +  latest handshake: 32 seconds ago
 +  transfer: 356 B received, 436 B sent
 </code> </code>
documentation/examples/gre_ipsec_and_openvpn.1664889049.txt.gz · Last modified: 2022/10/04 15:10 by olivier

Except where otherwise noted, content on this wiki is licensed under the following license: BSD 2-Clause
Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki