Chapter 5. Setting up an IPsec VPN

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   - name: Host to host VPN
     hosts: managed-node-01.example.com, managed-node-02.example.com
     roles:
       - rhel-system-roles.vpn
     vars:
       vpn_connections:
         - hosts:
             managed-node-01.example.com:
             managed-node-02.example.com:
       vpn_manage_firewall: true
       vpn_manage_selinux: true

   This playbook configures the connection managed-node-01.example.com-to-managed-node-02.example.com by using pre-shared key authentication with keys auto-generated by the system role. Because vpn_manage_firewall and vpn_manage_selinux are both set to true, the vpn role uses the firewall and selinux roles to manage the ports used by the vpn role.

   To configure connections from managed hosts to external hosts that are not listed in the inventory file, add the following section to the vpn_connections list of hosts:

       vpn_connections:
         - hosts:
             managed-node-01.example.com:
             <external_node>:
               hostname: <IP_address_or_hostname>

   This configures one additional connection: managed-node-01.example.com-to-<external_node>

   Note

   The connections are configured only on the managed nodes and not on the external node.

2. Optional: You can specify multiple VPN connections for the managed nodes by using additional sections within vpn_connections, for example, a control plane and a data plane:

   - name: Multiple VPN
     hosts: managed-node-01.example.com, managed-node-02.example.com
     roles:
       - rhel-system-roles.vpn
     vars:
       vpn_connections:
         - name: control_plane_vpn
           hosts:
             managed-node-01.example.com:
               hostname: 192.0.2.0 # IP for the control plane
             managed-node-02.example.com:
               hostname: 192.0.2.1
         - name: data_plane_vpn
           hosts:
             managed-node-01.example.com:
               hostname: 10.0.0.1 # IP for the data plane
             managed-node-02.example.com:
               hostname: 10.0.0.2

3. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

4. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. On the managed nodes, confirm that the connection is successfully loaded:

   # ipsec status | grep <connection_name>

   Replace <connection_name> with the name of the connection from this node, for example managed_node1-to-managed_node2.

   Note

   By default, the role generates a descriptive name for each connection it creates from the perspective of each system. For example, when creating a connection between managed_node1 and managed_node2, the descriptive name of this connection on managed_node1 is managed_node1-to-managed_node2 but on managed_node2 the connection is named managed_node2-to-managed_node1.

2. On the managed nodes, confirm that the connection is successfully started:

   # ipsec trafficstatus | grep <connection_name>

3. Optional: If a connection does not successfully load, manually add the connection by entering the following command. This provides more specific information indicating why the connection failed to establish:

   # ipsec auto --add <connection_name>

   Note

   Any errors that may occur during the process of loading and starting the connection are reported in the /var/log/pluto.log file. Because these logs are hard to parse, manually add the connection to obtain log messages from the standard output instead.

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   - name: Mesh VPN
     hosts: managed-node-01.example.com, managed-node-02.example.com, managed-node-03.example.com
     roles:
       - rhel-system-roles.vpn
     vars:
       vpn_connections:
         - opportunistic: true
           auth_method: cert
           policies:
             - policy: private
               cidr: default
             - policy: private-or-clear
               cidr: 198.51.100.0/24
             - policy: private
               cidr: 192.0.2.0/24
             - policy: clear
               cidr: 192.0.2.7/32
       vpn_manage_firewall: true
       vpn_manage_selinux: true

   Authentication with certificates is configured by defining the auth_method: cert parameter in the playbook. By default, the node name is used as the certificate nickname. In this example, this is managed-node-01.example.com. You can define different certificate names by using the cert_name attribute in your inventory.

   In this example procedure, the control node, which is the system from which you will run the Ansible playbook, shares the same classless inter-domain routing (CIDR) number as both of the managed nodes (192.0.2.0/24) and has the IP address 192.0.2.7. Therefore, the control node falls under the private policy which is automatically created for CIDR 192.0.2.0/24.

   To prevent SSH connection loss during the play, a clear policy for the control node is included in the list of policies. Note that there is also an item in the policies list where the CIDR is equal to default. This is because this playbook overrides the rule from the default policy to make it private instead of private-or-clear.

   Because vpn_manage_firewall and vpn_manage_selinux are both set to true, the vpn role uses the firewall and selinux roles to manage the ports used by the vpn role.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Install the required packages:

   # dnf install nmstate libreswan NetworkManager-libreswan

2. Restart the NetworkManager service:

   # systemctl restart NetworkManager

3. As Libreswan was already installed, remove its old database files and re-create them:

   # systemctl stop ipsec
   # rm /etc/ipsec.d/*db
   # ipsec initnss

4. Enable and start the ipsec service:

   # systemctl enable --now ipsec

5. Import the PKCS#12 file:

   # ipsec import node-example.p12

   When importing the PKCS#12 file, enter the password that was used to create the file.

6. Create a YAML file, for example ~/create-pki-authentication.yml, with the following content:

   ---
   interfaces:
   - name: 'example_ipsec_conn1'            1
     type: ipsec
     ipv4:
       enabled: true
       dhcp: true
     libreswan:
       ipsec-interface: 'yes'               2
       left: '192.0.2.250'                  3
       leftid: '%fromcert'                  4
       leftcert: 'local-host.example.com'   5
       right: '192.0.2.150'                 6
       rightid: '%fromcert'                 7
       ikev2: 'insist'                      8
       ikelifetime: '24h'                   9
       salifetime: '24h'                    10

   The YAML file defines the following settings:

   1

   An IPsec connection name

   2

   The value yes means libreswan creates an IPsec xfrm virtual interface ipsec<number> and automatically finds the next available number

   3

   A static IPv4 address of public network interface for a local host

   4

   On a local host, the value of %fromcert sets the ID to a Distinguished Name (DN) that is fetched from a loaded certificate

   5

   A Distinguished Name (DN) of a local host’s public key

   6

   A static IPv4 address of public network interface for a remote host

   7

   On a remote host, the value of %fromcert sets the ID to a Distinguished Name (DN) that is fetched from a loaded certificate.

   8

   insist value accepts and receives only the Internet Key Exchange (IKEv2) protocol

   9

   The duration of IKE protocol

   10

   The duration of IPsec security association (SA)

7. Apply settings to the system:

   # nmstatectl apply ~/create-pki-authentication.yml

Verification

1. Verify IPsec status:

   # ip xfrm status

2. Verify IPsec policies:

   # ip xfrm policy

Procedure

1. Install the required packages:

   # dnf install nmstate libreswan NetworkManager-libreswan

2. Restart the NetworkManager service:

   # systemctl restart NetworkManager

3. If Libreswan was already installed, remove its old database files and re-create them:

   # systemctl stop ipsec
   # rm /etc/ipsec.d/*db
   # ipsec initnss

4. Generate a RSA key pair on each host:

   # ipsec newhostkey --output

5. Display the public keys:

   # ipsec showhostkey --list

6. The previous step returned the generated key ckaid. Use that ckaid with the following command on left, for example:

   # ipsec showhostkey --left --ckaid <0sAwEAAesFfVZqFzRA9F>

7. The output of the previous command generated the leftrsasigkey= line required for the configuration. Do the same on the second host (right):

   # ipsec showhostkey --right --ckaid <0sAwEAAesFfVZqFzRA9E>

8. Enable the ipsec service to automatically start it on boot:

   # systemctl enable --now ipsec

9. Create a YAML file, for example ~/create-rsa-authentication.yml, with the following content:

   ---
   interfaces:
   - name: 'example_ipsec_conn1'               1
     type: ipsec                               2
     ipv4:
       enabled: true
       dhcp: true
     libreswan:
       ipsec-interface: '99'                   3
       leftrsasigkey: '0sAwEAAesFfVZqFzRA9F'   4
       left: '192.0.2.250'                     5
       leftid: 'local-host-rsa.example.com'    6
       right: '192.0.2.150'                    7
       rightrsasigkey: '0sAwEAAesFfVZqFzRA9E'  8
       rightid: 'remote-host-rsa.example.com'  9
       ikev2: 'insist'                         10

   The YAML file defines the following settings:

   1

   An IPsec connection name

   2

   An interface name

   3

   The value 99 means that libreswan creates an IPsec xfrm virtual interface ipsec<number> and automatically finds the next available number

   4

   The RSA public key of a local host

   5

   A static IPv4 address of public network interface of a local host

   6

   A Distinguished Name (DN) for a local host

   7

   The RSA public key of a remote host

   8

   A static IPv4 address of public network interface of a remote host

   9

   A Distinguished Name(DN) for a remote host

   10

   insist value accepts and receives only the Internet Key Exchange (IKEv2) protocol

10. Apply the settings to the system:

    # nmstatectl apply ~/create-rsa-authentication.yml

Verification

1. Display the IP settings of the network interface:

   # ip addr show example_ipsec_conn1

2. Verify IPsec status:

   # ip xfrm status

3. Verify IPsec policies:

   # ip xfrm policy

Procedure

1. Install the required packages:

   # dnf install nmstate libreswan NetworkManager-libreswan

2. Restart the NetworkManager service:

   # systemctl restart NetworkManager

3. If Libreswan was already installed, remove its old database files and re-create them:

   # systemctl stop ipsec
   # rm /etc/ipsec.d/*db
   # ipsec initnss

4. Enable the ipsec service to automatically start it on boot:

   # systemctl enable --now ipsec

5. Create a YAML file, for example ~/create-pks-authentication.yml, with the following content:

   ---
   interfaces:
   - name: 'example_ipsec_conn1'           1
     type: ipsec
     ipv4:
       enabled: true
       dhcp: true
     libreswan:
       ipsec-interface: 'no'               2
       right: '192.0.2.250'                3
       rightid: 'remote-host.example.org'  4
       left: '192.0.2.150'                 5
       leftid: 'local-host.example.org'    6
       psk: "example_password"
       ikev2: 'insist'                     7

   The YAML file defines the following settings:

   1

   An IPsec connection name

   2

   Setting no value indicates that libreswan creates only xfrm policies, and not a virtual xfrm interface

   3

   A static IPv4 address of public network interface of a remote host

   4

   A Distinguished Name (DN) for a remote host

   5

   A static IPv4 address of public network interface of a local host

   6

   A Distinguished Name (DN) for a local host

   7

   insist value accepts and receives only the Internet Key Exchange (IKEv2) protocol

6. Apply the settings to the system:

   # nmstatectl apply ~/create-pks-authentication.yml

Verification

1. Display the IP settings of network interface:

   # ip addr show example_ipsec_conn1

2. Verify IPsec status:

   # ip xfrm status

3. Verify IPsec policies:

   # ip xfrm policy

Procedure

1. Install the required packages:

   # dnf install nmstate libreswan NetworkManager-libreswan

2. Restart the NetworkManager service:

   # systemctl restart NetworkManager

3. As Libreswan was already installed, remove its old database files and re-create them:

   # systemctl stop ipsec
   # rm /etc/ipsec.d/*db
   # ipsec initnss

4. Import the PKCS#12 file:

   # ipsec import node-example.p12

   When importing the PKCS#12 file, enter the password that was used to generate the file.

5. Enable and start the ipsec service:

   # systemctl enable --now ipsec

6. Create a YAML file, for example ~/create-p2p-vpn-authentication.yml, with the following content:

   ---
   interfaces:
   - name: 'example_ipsec_conn1'             1
     type: ipsec
     libreswan:
       left: '192.0.2.250'                   2
       leftid:  'local-host.example.com'     3
       leftcert: 'local-host.example.com'    4
       leftmodecfgclient: 'no'               5
       right: '192.0.2.150'                  6
       rightid: 'remote-host.example.com'    7
       rightsubnet: '192.0.2.150/32'         8
       ikev2: 'insist'                       9

   The YAML file defines the following settings:

   1

   An IPsec connection name

   2

   A static IPv4 address of public network interface for a local host

   3

   A distinguished Name (DN) of a local host

   4

   A certificate name installed on a local host

   5

   The value for not to retrieve client configuration from a remote host

   6

   A static IPv4 address of public network interface for a remote host

   7

   A distinguished Name (DN) of a remote host

   8

   The subnet range of a remote host - 192.0.2.150 with 32 IPv4 addresses

   9

   The value to accept and receive only the Internet Key Exchange (IKEv2) protocol

7. Apply the settings to the system:

   # nmstatectl apply ~/create-p2p-vpn-authentication.yml

Verification

1. Display the created P2P policy:

   # ip xfrm policy

2. Verify IPsec status:

   # ip xfrm status

Procedure

1. Install the required packages:

   # dnf install nmstate libreswan NetworkManager-libreswan

2. Restart the NetworkManager service:

   # systemctl restart NetworkManager

3. As Libreswan was already installed, remove its old database files and re-create them:

   # systemctl stop ipsec
   # rm /etc/ipsec.d/*db
   # ipsec initnss

4. Import the PKCS#12 file:

   # ipsec import node-example.p12

   When importing the PKCS#12 file, enter the password that was used to create the file.

5. Enable and start the ipsec service:

   # systemctl enable --now ipsec

6. Create a YAML file, for example ~/create-p2p-transport-authentication.yml, with the following content:

   ---
   interfaces:
   - name: 'example_ipsec_conn1'           1
     type: ipsec
     libreswan:
       type: 'transport'                   2
       ipsec-interface: '99'               3
       left: '192.0.2.250'                 4
       leftid: '%fromcert'                 5
       leftcert: 'local-host.example.org'  6
       right: '192.0.2.150'                7
       prefix-length: '32'                 8
       rightid: '%fromcert'                9
       ikev2: 'insist'                     10
       ikelifetime: '24h'                  11
       salifetime: '24h'                   12

   The YAML file defines the following settings:

   1

   An IPsec connection name

   2

   An IPsec mode

   3

   The value 99 means that libreswan creates an IPsec xfrm virtual interface ipsec<number> and automatically finds the next available number

   4

   A static IPv4 address of public network interface for a local host

   5

   On a local host, the value of %fromcert sets the ID to a Distinguished Name (DN) which is fetched from a loaded certificate

   6

   A Distinguished Name (DN) of a local host’s public key

   7

   A static IPv4 address of public network interface for a remote host

   8

   The subnet mask of a static IPv4 address of a local host

   9

   On a remote host, the value of %fromcert sets the ID to a Distinguished Name (DN) which is fetched from a loaded certificate

   10

   The value to accept and receive only the Internet Key Exchange (IKEv2) protocol

   11

   The duration of IKE protocol

   12

   The duration of IPsec security association (SA)

7. Apply the settings to the system:

   # nmstatectl apply ~/create-p2p-transport-authentication.yml

Verification

1. Verify IPsec status:

   # ip xfrm status

2. Verify IPsec policies:

   # ip xfrm policy