IPSEC OpenBSD <-> Linux
Environment
- OpenBSD 7.0
- Debian 11.2 with Strongswan
- IPv4 only
- IKE v1
ToDo
- IPv6 and Dualstack
- IKE v2
Debian
ipsec.conf
conn puffy
authby = secret
ike = aes256-sha256-modp2048
keyexchange = ikev1
ikelifetime = 1h
keyingtries = 0
left = %defaultroute
right = 193.xx.xx.xx
leftid = 212.xx.xx.xx
rightid = 193.xx.xx.xx
lifetime = 1200s
leftsubnet = 10.11.1.8/30
rightsubnet = 10.1.6.0/24
esp = aes256-sha256-modp2048
dpddelay = 30
dpdtimeout = 120
dpdaction = restart
auto = start
OpenBSD
/etc/sysctl.conf
net.inet.ip.forwarding=1
net.inet.gre.allow=1
Apply all Settings
for i in $(cat /etc/sysctl.conf); do sysctl $i;done
/etc/ipsec.conf
# Tunnel to Debian
local_gw = "193.xx.xx.xx"
local_net = "10.1.6.0/24"
remote_gw = "212.xx.xx.xx"
remote_net = "10.11.1.8/30"
key = "DAS-SAG-ICH-DIR-NICHT-:)"
ike dynamic esp tunnel from $local_net to $remote_net peer $remote_gw \
main auth $auth1 enc $enc1 group $group1 lifetime $time1 \
quick auth $auth2 enc $enc2 group $group2 lifetime $time2 \
srcid $local_gw \
psk $key
ike dynamic esp tunnel from $remote_net to $local_net peer $local_gw \
main auth $auth1 enc $enc1 group $group1 lifetime $time1 \
quick auth $auth2 enc $enc2 group $group2 lifetime $time2 \
srcid $remote_gw \
psk $key
start/restart services
rcctl enable ipsec isakmpd
rcctl set isakmpd flags -K
rcctl restart ipsec isakmpd
Enc Interfaces
cat /etc/hostname.enc0
up
FW Rules
# Allow UDP Port 500 and 4500
pass in on (egress) proto udp from 193.xx.xx.xx to 212.xx.xx.xx port {isakmp, ipsec-nat-t}
pass out on (egress) proto udp from 212.xx.xx.xx to 193.xx.xx.xx {isakmp, ipsec-nat-t}
# Allow ESP encapsulated IPsec traffic on the external interface
pass in on (egress) proto esp from 193.xx.xx.xx to 212.xx.xx.xx
pass out on (egress) proto esp from 212.xx.xx.xx to 139.xx.xx.xx
# Allow IP in IP Traffic
pass in on enc0 proto ipencap from 193.xx.xx.xx to 212.xx.xx.xx keep state (if-bound)
pass out on enc0 proto ipencap from 212.xx.xx.xx to 193.xx.xx.xx keep state (if-bound)
Start Services & Apply Setting
… or reboot the Box so all Settings gets applied