Chapter 6. Setting up an IPsec VPN

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Configuring VPN
     hosts: managed-node-01.example.com, managed-node-02.example.com
     tasks:
       - name: IPsec VPN with PSK authentication
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.vpn
         vars:
           vpn_connections:
             - hosts:
                 managed-node-01.example.com:
                 managed-node-02.example.com:
               auth_method: psk
               auto: start
           vpn_manage_firewall: true
           vpn_manage_selinux: true

   Copy to Clipboard

   The settings specified in the example playbook include the following:

   hosts: <list>

   Defines a YAML dictionary with the hosts between which you want to configure a VPN. If an entry is not an Ansible managed node, you must specify its fully-qualified domain name (FQDN) or IP address in the hostname parameter, for example:

             ...
             - hosts:
                 ...
                 external-host.example.com:
                   hostname: 192.0.2.1

   Copy to Clipboard

   The role configures the VPN connection on each managed node. The connections are named <host_A>-to-<host_B>, for example, managed-node-01.example.com-to-managed-node-02.example.com. Note that the role can not configure Libreswan on external (unmanaged) nodes. You must manually create the configuration on these hosts.

   auth_method: psk

   Enables PSK authentication between the hosts. The role uses openssl on the control node to create the PSK.

   auto: <start-up_method>

   Specifies the start-up method of the connection. Valid values are add, ondemand, start, and ignore. For details, see the ipsec.conf(5) man page on a system with Libreswan installed. The default value of this variable is null, which means no automatic startup operation.

   vpn_manage_firewall: true

   Defines that the role opens the required ports in the firewalld service on the managed nodes.

   vpn_manage_selinux: true

   Defines that the role sets the required SELinux port type on the IPsec ports.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.vpn/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Copy to Clipboard

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

   Copy to Clipboard

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Configuring VPN
     hosts: managed-node-01.example.com, managed-node-02.example.com
     tasks:
       - name: IPsec VPN with PSK authentication
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.vpn
         vars:
           vpn_connections:
             - name: control_plane_vpn
               hosts:
                 managed-node-01.example.com:
                   hostname: 203.0.113.1  # IP address for the control plane
                 managed-node-02.example.com:
                   hostname: 198.51.100.2 # IP address for the control plane
               auth_method: psk
               auto: start
             - name: data_plane_vpn
               hosts:
                 managed-node-01.example.com:
                   hostname: 10.0.0.1   # IP address for the data plane
                 managed-node-02.example.com:
                   hostname: 172.16.0.2 # IP address for the data plane
               auth_method: psk
               auto: start
           vpn_manage_firewall: true
           vpn_manage_selinux: true

   Copy to Clipboard

   The settings specified in the example playbook include the following:

   hosts: <list>

   Defines a YAML dictionary with the hosts between which you want to configure a VPN. The connections are named <name>-<IP_address_A>-to-<IP_address_B>, for example control_plane_vpn-203.0.113.1-to-198.51.100.2.

   The role configures the VPN connection on each managed node. Note that the role can not configure Libreswan on external (unmanaged) nodes. You must manually create the configuration on these hosts.

   auth_method: psk

   Enables PSK authentication between the hosts. The role uses openssl on the control node to create the pre-shared key.

   auto: <start-up_method>

   Specifies the start-up method of the connection. Valid values are add, ondemand, start, and ignore. For details, see the ipsec.conf(5) man page on a system with Libreswan installed. The default value of this variable is null, which means no automatic startup operation.

   vpn_manage_firewall: true

   Defines that the role opens the required ports in the firewalld service on the managed nodes.

   vpn_manage_selinux: true

   Defines that the role sets the required SELinux port type on the IPsec ports.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.vpn/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Copy to Clipboard

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

   Copy to Clipboard

Procedure

1. Edit the ~/inventory file, and append the cert_name variable:

   managed-node-01.example.com cert_name=managed-node-01.example.com
   managed-node-02.example.com cert_name=managed-node-02.example.com
   managed-node-03.example.com cert_name=managed-node-03.example.com

   Copy to Clipboard

   Set the cert_name variable to the value of the common name (CN) field used in the certificate for each host. Typically, the CN field is set to the fully-qualified domain name (FQDN).

2. Store your sensitive variables in an encrypted file:

   1. Create the vault:

      $ ansible-vault create ~/vault.yml
      New Vault password: <vault_password>
      Confirm New Vault password: <vault_password>

      Copy to Clipboard

   2. After the ansible-vault create command opens an editor, enter the sensitive data in the <key>: <value> format:

      pkcs12_pwd: <password>

      Copy to Clipboard
   3. Save the changes, and close the editor. Ansible encrypts the data in the vault.

3. Create a playbook file, for example ~/playbook.yml, with the following content:

   - name: Configuring VPN
     hosts: managed-node-01.example.com, managed-node-02.example.com, managed-node-03.example.com
     vars_files:
       - ~/vault.yml
     tasks:
       - name: Install LibreSwan
         ansible.builtin.package:
           name: libreswan
           state: present
   
       - name: Identify the path to IPsec NSS database
         ansible.builtin.set_fact:
           nss_db_dir: "{{ '/etc/ipsec.d/' if
             ansible_distribution in ['CentOS', 'RedHat']
             and ansible_distribution_major_version is version('8', '=')
             else '/var/lib/ipsec/nss/' }}"
   
       - name: Locate IPsec NSS database files
         ansible.builtin.find:
           paths: "{{ nss_db_dir }}"
           patterns: "*.db"
         register: db_files
   
       - name: Remove IPsec NSS database files
         ansible.builtin.file:
           path: "{{ item.path }}"
           state: absent
         loop: "{{ db_files.files }}"
         when: db_files.matched > 0
   
       - name: Initialize IPsec NSS database
         ansible.builtin.command:
           cmd: ipsec initnss
   
       - name: Copy PKCS #12 file to the managed node
         ansible.builtin.copy:
           src: "~/{{ inventory_hostname }}.p12"
           dest: "/etc/ipsec.d/{{ inventory_hostname }}.p12"
           mode: 0600
   
       - name: Import PKCS #12 file in IPsec NSS database
         ansible.builtin.shell:
           cmd: 'pk12util -d {{ nss_db_dir }} -i /etc/ipsec.d/{{ inventory_hostname }}.p12 -W "{{ pkcs12_pwd }}"'
   
       - name: Remove PKCS #12 file
         ansible.builtin.file:
           path: "/etc/ipsec.d/{{ inventory_hostname }}.p12"
           state: absent
   
       - name: Opportunistic mesh IPsec VPN with certificate-based authentication
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.vpn
         vars:
           vpn_connections:
             - opportunistic: true
               auth_method: cert
               policies:
                 - policy: private
                   cidr: default
                 - policy: private
                   cidr: 192.0.2.0/24
                 - policy: clear
                   cidr: 192.0.2.1/32
           vpn_manage_firewall: true
           vpn_manage_selinux: true

   Copy to Clipboard

   The settings specified in the example playbook include the following:

   opportunistic: true

   Enables an opportunistic mesh among multiple hosts. The policies variable defines for which subnets and hosts traffic must or or can be encrypted and which of them should continue using clear text connections.

   auth_method: cert

   Enables certificate-based authentication. This requires that you specified the nickname of each managed node’s certificate in the inventory.

   policies: <list_of_policies>

   Defines the Libreswan policies in YAML list format.

   The default policy is private-or-clear. To change it to private, the above playbook contains an according policy for the default cidr entry.

   To prevent a loss of the SSH connection during the execution of the playbook if the Ansible control node is in the same IP subnet as the managed nodes, add a clear policy for the control node’s IP address. For example, if the mesh should be configured for the 192.0.2.0/24 subnet and the control node uses the IP address 192.0.2.1, you require a clear policy for 192.0.2.1/32 as shown in the playbook.

   For details about policies, see the ipsec.conf(5) man page on a system with Libreswan installed.

   vpn_manage_firewall: true

   Defines that the role opens the required ports in the firewalld service on the managed nodes.

   vpn_manage_selinux: true

   Defines that the role sets the required SELinux port type on the IPsec ports.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.vpn/README.md file on the control node.

4. Validate the playbook syntax:

   $ ansible-playbook --ask-vault-pass --syntax-check ~/playbook.yml

   Copy to Clipboard

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

5. Run the playbook:

   $ ansible-playbook --ask-vault-pass ~/playbook.yml

   Copy to Clipboard

Verification

1. On a node in the mesh, ping another node to activate the connection:

   [root@managed-node-01]# ping managed-node-02.example.com

   Copy to Clipboard

2. Confirm that the connections is active:

   [root@managed-node-01]# ipsec trafficstatus
   006 #2: "private#192.0.2.0/24"[1] ...192.0.2.2, type=ESP, add_time=1741938929, inBytes=372408, outBytes=545728, maxBytes=2^63B, id='CN=managed-node-02.example.com'

   Copy to Clipboard

Procedure

1. Install the required packages:

   # dnf install nmstate libreswan NetworkManager-libreswan

   Copy to Clipboard

2. Restart the NetworkManager service:

   # systemctl restart NetworkManager

   Copy to Clipboard

3. As Libreswan was already installed, remove its old database files and re-create them:

   # systemctl stop ipsec
   # rm /var/lib/ipsec/nss/*db
   # ipsec initnss

   Copy to Clipboard

4. Enable and start the ipsec service:

   # systemctl enable --now ipsec

   Copy to Clipboard

5. Import the PKCS#12 file:

   # ipsec import node-example.p12

   Copy to Clipboard

   When importing the PKCS#12 file, enter the password that was used to create the file.

6. Create a YAML file, for example ~/create-pki-authentication.yml, with the following content:

   ---
   interfaces:
   - name: 'example_ipsec_conn1'            

   1

   
     type: ipsec
     ipv4:
       enabled: true
       dhcp: true
     libreswan:
       ipsec-interface: 'yes'               

   2

   
       left: '192.0.2.150'                  

   3

   
       leftid: '%fromcert'                  

   4

   
       leftcert: 'local-host.example.com'   

   5

   
       right: '192.0.2.250'                 

   6

   
       rightid: '%fromcert'                 

   7

   
       ikev2: 'insist'                      

   8

   
       ikelifetime: '24h'                   

   9

   
       salifetime: '24h'                    

   10

   Copy to Clipboard

   The YAML file defines the following settings:

   1

   An IPsec connection name

   2

   The value yes means libreswan creates an IPsec xfrm virtual interface ipsec<number> and automatically finds the next available number

   3

   A static IPv4 address of public network interface for a local host

   4

   On a local host, the value of %fromcert sets the ID to a Distinguished Name (DN) that is fetched from a loaded certificate

   5

   A Distinguished Name (DN) of a local host’s public key

   6

   A static IPv4 address of public network interface for a remote host

   7

   On a remote host, the value of %fromcert sets the ID to a Distinguished Name (DN) that is fetched from a loaded certificate.

   8

   insist value accepts and receives only the Internet Key Exchange (IKEv2) protocol

   9

   The duration of IKE protocol

   10

   The duration of IPsec security association (SA)

7. Apply settings to the system:

   # nmstatectl apply ~/create-pki-authentication.yml

   Copy to Clipboard
8. If you use this host in a network with DHCP or Stateless Address Autoconfiguration (SLAAC), the connection can be vulnerable to being redirected. For details and mitigation steps, see Assigning a VPN connection to a dedicated routing table to prevent the connection from bypassing the tunnel.

Verification

1. Verify IPsec status:

   # ip xfrm state

   Copy to Clipboard

2. Verify IPsec policies:

   # ip xfrm policy

   Copy to Clipboard

Procedure

1. Install the required packages:

   # dnf install nmstate libreswan NetworkManager-libreswan

   Copy to Clipboard

2. Restart the NetworkManager service:

   # systemctl restart NetworkManager

   Copy to Clipboard

3. If Libreswan was already installed, remove its old database files and re-create them:

   # systemctl stop ipsec
   # rm /var/lib/ipsec/nss/*db
   # ipsec initnss

   Copy to Clipboard

4. Generate a RSA key pair on each host:

   # ipsec newhostkey

   Copy to Clipboard

5. The previous step returned the generated key ckaid. Use that ckaid with the following command on left, for example:

   # ipsec showhostkey --left --ckaid <0sAwEAAesFfVZqFzRA9F>

   Copy to Clipboard

6. The output of the previous command generated the leftrsasigkey= line required for the configuration. Do the same on the second host (right):

   # ipsec showhostkey --right --ckaid <0sAwEAAesFfVZqFzRA9E>

   Copy to Clipboard

7. Enable the ipsec service to automatically start it on boot:

   # systemctl enable --now ipsec

   Copy to Clipboard

8. Create a YAML file, for example ~/create-rsa-authentication.yml, with the following content:

   ---
   interfaces:
   - name: 'example_ipsec_conn1'               

   1

   
     type: ipsec                               

   2

   
     ipv4:
       enabled: true
       dhcp: true
     libreswan:
       ipsec-interface: '99'                   

   3

   
       leftrsasigkey: '0sAwEAAesFfVZqFzRA9F'   

   4

   
       left: '192.0.2.150'                     

   5

   
       leftid: 'local-host-rsa.example.com'    

   6

   
       right: '192.0.2.250'                    

   7

   
       rightrsasigkey: '0sAwEAAesFfVZqFzRA9E'  

   8

   
       rightid: 'remote-host-rsa.example.com'  

   9

   
       ikev2: 'insist'                         

   10

   Copy to Clipboard

   The YAML file defines the following settings:

   1

   An IPsec connection name

   2

   An interface name

   3

   The value 99 means that libreswan creates an IPsec xfrm virtual interface ipsec<number> and automatically finds the next available number

   4

   The RSA public key of a local host

   5

   A static IPv4 address of public network interface of a local host

   6

   A Distinguished Name (DN) for a local host

   7

   The RSA public key of a remote host

   8

   A static IPv4 address of public network interface of a remote host

   9

   A Distinguished Name(DN) for a remote host

   10

   insist value accepts and receives only the Internet Key Exchange (IKEv2) protocol

9. Apply the settings to the system:

   # nmstatectl apply ~/create-rsa-authentication.yml

   Copy to Clipboard
10. If you use this host in a network with DHCP or Stateless Address Autoconfiguration (SLAAC), the connection can be vulnerable to being redirected. For details and mitigation steps, see Assigning a VPN connection to a dedicated routing table to prevent the connection from bypassing the tunnel.

Verification

1. Display the IP settings of the network interface:

   # ip addr show <device_name>

   Copy to Clipboard

2. Verify IPsec status:

   # ip xfrm state

   Copy to Clipboard

3. Verify IPsec policies:

   # ip xfrm policy

   Copy to Clipboard

Procedure

1. Install the required packages:

   # dnf install nmstate libreswan NetworkManager-libreswan

   Copy to Clipboard

2. Restart the NetworkManager service:

   # systemctl restart NetworkManager

   Copy to Clipboard

3. If Libreswan was already installed, remove its old database files and re-create them:

   # systemctl stop ipsec
   # rm /var/lib/ipsec/nss/*db
   # ipsec initnss

   Copy to Clipboard

4. Enable the ipsec service to automatically start it on boot:

   # systemctl enable --now ipsec

   Copy to Clipboard

5. Create a YAML file, for example ~/create-pks-authentication.yml, with the following content:

   ---
   interfaces:
   - name: 'example_ipsec_conn1'           

   1

   
     type: ipsec
     ipv4:
       enabled: true
       dhcp: true
     libreswan:
       ipsec-interface: 'no'               

   2

   
       right: '192.0.2.150'                

   3

   
       rightid: 'remote-host.example.org'  

   4

   
       left: '192.0.2.250'                 

   5

   
       leftid: 'local-host.example.org'    

   6

   
       psk: "example_password"
       ikev2: 'insist'                     

   7

   Copy to Clipboard

   The YAML file defines the following settings:

   1

   An IPsec connection name

   2

   Setting no value indicates that libreswan creates only xfrm policies, and not a virtual xfrm interface

   3

   A static IPv4 address of public network interface of a remote host

   4

   A Distinguished Name (DN) for a remote host

   5

   A static IPv4 address of public network interface of a local host

   6

   A Distinguished Name (DN) for a local host

   7

   insist value accepts and receives only the Internet Key Exchange (IKEv2) protocol

6. Apply the settings to the system:

   # nmstatectl apply ~/create-pks-authentication.yml

   Copy to Clipboard
7. If you use this host in a network with DHCP or Stateless Address Autoconfiguration (SLAAC), the connection can be vulnerable to being redirected. For details and mitigation steps, see Assigning a VPN connection to a dedicated routing table to prevent the connection from bypassing the tunnel.

Verification

1. Display the IP settings of network interface:

   # ip addr show <device_name>

   Copy to Clipboard

2. Verify IPsec status:

   # ip xfrm state

   Copy to Clipboard

3. Verify IPsec policies:

   # ip xfrm policy

   Copy to Clipboard

Procedure

1. Install the required packages:

   # dnf install nmstate libreswan NetworkManager-libreswan

   Copy to Clipboard

2. Restart the NetworkManager service:

   # systemctl restart NetworkManager

   Copy to Clipboard

3. As Libreswan was already installed, remove its old database files and re-create them:

   # systemctl stop ipsec
   # rm /var/lib/ipsec/nss/*db
   # ipsec initnss

   Copy to Clipboard

4. Import the PKCS#12 file:

   # ipsec import node-example.p12

   Copy to Clipboard

   When importing the PKCS#12 file, enter the password that was used to generate the file.

5. Enable and start the ipsec service:

   # systemctl enable --now ipsec

   Copy to Clipboard

6. Create a YAML file, for example ~/create-p2p-vpn-authentication.yml, with the following content:

   ---
   interfaces:
   - name: 'example_ipsec_conn1'             

   1

   
     type: ipsec
     libreswan:
       left: '192.0.2.150'                   

   2

   
       leftid:  'local-host.example.com'     

   3

   
       leftcert: 'local-host.example.com'    

   4

   
       leftmodecfgclient: no                 

   5

   
       right: '192.0.2.250'                  

   6

   
       rightid: 'remote-host.example.com'    

   7

   
       rightsubnet: '192.0.2.150/32'         

   8

   
       ikev2: 'insist'                       

   9

   Copy to Clipboard

   The YAML file defines the following settings:

   1

   An IPsec connection name

   2

   A static IPv4 address of public network interface for a local host

   3

   A distinguished Name (DN) of a local host

   4

   A certificate name installed on a local host

   5

   The value for not to retrieve client configuration from a remote host

   6

   A static IPv4 address of public network interface for a remote host

   7

   A distinguished Name (DN) of a remote host

   8

   The subnet range of a remote host - 192.0.2.150 with 32 IPv4 addresses

   9

   The value to accept and receive only the Internet Key Exchange (IKEv2) protocol

7. Apply the settings to the system:

   # nmstatectl apply ~/create-p2p-vpn-authentication.yml

   Copy to Clipboard
8. If you use this host in a network with DHCP or Stateless Address Autoconfiguration (SLAAC), the connection can be vulnerable to being redirected. For details and mitigation steps, see Assigning a VPN connection to a dedicated routing table to prevent the connection from bypassing the tunnel.

Verification

1. Display the created P2P policy:

   # ip xfrm policy

   Copy to Clipboard

2. Verify IPsec status:

   # ip xfrm state

   Copy to Clipboard

Procedure

1. Install the required packages:

   # dnf install nmstate libreswan NetworkManager-libreswan

   Copy to Clipboard

2. Restart the NetworkManager service:

   # systemctl restart NetworkManager

   Copy to Clipboard

3. As Libreswan was already installed, remove its old database files and re-create them:

   # systemctl stop ipsec
   # rm /var/lib/ipsec/nss/*db
   # ipsec initnss

   Copy to Clipboard

4. Import the PKCS#12 file:

   # ipsec import node-example.p12

   Copy to Clipboard

   When importing the PKCS#12 file, enter the password that was used to create the file.

5. Enable and start the ipsec service:

   # systemctl enable --now ipsec

   Copy to Clipboard

6. Create a YAML file, for example ~/create-p2p-transport-authentication.yml, with the following content:

   ---
   interfaces:
   - name: 'example_ipsec_conn1'           

   1

   
     type: ipsec
     libreswan:
       type: 'transport'                   

   2

   
       ipsec-interface: '99'               

   3

   
       left: '192.0.2.150'                 

   4

   
       leftid: '%fromcert'                 

   5

   
       leftcert: 'local-host.example.org'  

   6

   
       right: '192.0.2.250'                

   7

   
       prefix-length: '32'                 

   8

   
       rightid: '%fromcert'                

   9

   
       ikev2: 'insist'                     

   10

   
       ikelifetime: '24h'                  

   11

   
       salifetime: '24h'                   

   12

   Copy to Clipboard

   The YAML file defines the following settings:

   1

   An IPsec connection name

   2

   An IPsec mode

   3

   The value 99 means that libreswan creates an IPsec xfrm virtual interface ipsec<number> and automatically finds the next available number

   4

   A static IPv4 address of public network interface for a local host

   5

   On a local host, the value of %fromcert sets the ID to a Distinguished Name (DN) which is fetched from a loaded certificate

   6

   A Distinguished Name (DN) of a local host’s public key

   7

   A static IPv4 address of public network interface for a remote host

   8

   The subnet mask of a static IPv4 address of a local host

   9

   On a remote host, the value of %fromcert sets the ID to a Distinguished Name (DN) which is fetched from a loaded certificate

   10

   The value to accept and receive only the Internet Key Exchange (IKEv2) protocol

   11

   The duration of IKE protocol

   12

   The duration of IPsec security association (SA)

7. Apply the settings to the system:

   # nmstatectl apply ~/create-p2p-transport-authentication.yml

   Copy to Clipboard
8. If you use this host in a network with DHCP or Stateless Address Autoconfiguration (SLAAC), the connection can be vulnerable to being redirected. For details and mitigation steps, see Assigning a VPN connection to a dedicated routing table to prevent the connection from bypassing the tunnel.

Verification

1. Verify IPsec status:

   # ip xfrm state

   Copy to Clipboard

2. Verify IPsec policies:

   # ip xfrm policy

   Copy to Clipboard