Chapter 31. Configuring VPN connections by using RHEL system roles

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Configuring VPN
     hosts: managed-node-01.example.com, managed-node-02.example.com
     tasks:
       - name: IPsec VPN with PSK authentication
         ansible.builtin.include_role:
           name: rhel-system-roles.vpn
         vars:
           vpn_connections:
             - hosts:
                 managed-node-01.example.com:
                 managed-node-02.example.com:
               auth_method: psk
               auto: start
           vpn_manage_firewall: true
           vpn_manage_selinux: true

   The settings specified in the example playbook include the following:

   hosts: <list>

   Defines a YAML dictionary with the hosts between which you want to configure a VPN. If an entry is not an Ansible managed node, you must specify its fully-qualified domain name (FQDN) or IP address in the hostname parameter, for example:

             ...
             - hosts:
                 ...
                 external-host.example.com:
                   hostname: 192.0.2.1

   The role configures the VPN connection on each managed node. The connections are named <host_A>-to-<host_B>, for example, managed-node-01.example.com-to-managed-node-02.example.com. Note that the role can not configure Libreswan on external (unmanaged) nodes. You must manually create the configuration on these hosts.

   auth_method: psk

   Enables PSK authentication between the hosts. The role uses openssl on the control node to create the PSK.

   auto: <start-up_method>

   Specifies the start-up method of the connection. Valid values are add, ondemand, start, and ignore. For details, see the ipsec.conf(5) man page on a system with Libreswan installed. The default value of this variable is null, which means no automatic startup operation.

   vpn_manage_firewall: true

   Defines that the role opens the required ports in the firewalld service on the managed nodes.

   vpn_manage_selinux: true

   Defines that the role sets the required SELinux port type on the IPsec ports.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.vpn/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Configuring VPN
     hosts: managed-node-01.example.com, managed-node-02.example.com
     tasks:
       - name: IPsec VPN with PSK authentication
         ansible.builtin.include_role:
           name: rhel-system-roles.vpn
         vars:
           vpn_connections:
             - name: control_plane_vpn
               hosts:
                 managed-node-01.example.com:
   	        hostname: 203.0.113.1  # IP address for the control plane
                 managed-node-02.example.com:
   	        hostname: 198.51.100.2 # IP address for the control plane
               auth_method: psk
               auto: start
             - name: data_plane_vpn
               hosts:
                 managed-node-01.example.com:
   	        hostname: 10.0.0.1   # IP address for the data plane
                 managed-node-02.example.com:
   	        hostname: 172.16.0.2 # IP address for the data plane
               auth_method: psk
               auto: start
           vpn_manage_firewall: true
           vpn_manage_selinux: true

   The settings specified in the example playbook include the following:

   hosts: <list>

   Defines a YAML dictionary with the hosts between which you want to configure a VPN. The connections are named <name>-<IP_address_A>-to-<IP_address_B>, for example control_plane_vpn-203.0.113.1-to-198.51.100.2.

   The role configures the VPN connection on each managed node. Note that the role can not configure Libreswan on external (unmanaged) nodes. You must manually create the configuration on these hosts.

   auth_method: psk

   Enables PSK authentication between the hosts. The role uses openssl on the control node to create the pre-shared key.

   auto: <start-up_method>

   Specifies the start-up method of the connection. Valid values are add, ondemand, start, and ignore. For details, see the ipsec.conf(5) man page on a system with Libreswan installed. The default value of this variable is null, which means no automatic startup operation.

   vpn_manage_firewall: true

   Defines that the role opens the required ports in the firewalld service on the managed nodes.

   vpn_manage_selinux: true

   Defines that the role sets the required SELinux port type on the IPsec ports.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.vpn/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Edit the ~/inventory file, and append the cert_name variable:

   managed-node-01.example.com cert_name=managed-node-01.example.com
   managed-node-02.example.com cert_name=managed-node-02.example.com
   managed-node-03.example.com cert_name=managed-node-03.example.com

   Set the cert_name variable to the value of the common name (CN) field used in the certificate for each host. Typically, the CN field is set to the fully-qualified domain name (FQDN).

2. Store your sensitive variables in an encrypted file:

   1. Create the vault:

      $ ansible-vault create vault.yml
      New Vault password: <vault_password>
      Confirm New Vault password: <vault_password>

   2. After the ansible-vault create command opens an editor, enter the sensitive data in the <key>: <value> format:

      pkcs12_pwd: <password>

   3. Save the changes, and close the editor. Ansible encrypts the data in the vault.

3. Create a playbook file, for example ~/playbook.yml, with the following content:

   - name: Configuring VPN
     hosts: managed-node-01.example.com, managed-node-02.example.com, managed-node-03.example.com
     vars_files:
       - vault.yml
     tasks:
       - name: Install LibreSwan
         ansible.builtin.package:
           name: libreswan
           state: present
   
       - name: Identify the path to IPsec NSS database
         ansible.builtin.set_fact:
           nss_db_dir: "{{ '/etc/ipsec.d/' if
             ansible_distribution in ['CentOS', 'RedHat']
             and ansible_distribution_major_version is version('8', '=')
             else '/var/lib/ipsec/nss/' }}"
   
       - name: Locate IPsec NSS database files
         ansible.builtin.find:
           paths: "{{ nss_db_dir }}"
           patterns: "*.db"
         register: db_files
   
       - name: Remove IPsec NSS database files
         ansible.builtin.file:
           path: "{{ item.path }}"
           state: absent
         loop: "{{ db_files.files }}"
         when: db_files.matched > 0
   
       - name: Initialize IPsec NSS database
         ansible.builtin.command:
           cmd: ipsec initnss
   
       - name: Copy PKCS #12 file to the managed node
         ansible.builtin.copy:
           src: "~/{{ inventory_hostname }}.p12"
           dest: "/etc/ipsec.d/{{ inventory_hostname }}.p12"
           mode: 0600
   
       - name: Import PKCS #12 file in IPsec NSS database
         ansible.builtin.shell:
           cmd: 'pk12util -d {{ nss_db_dir }} -i /etc/ipsec.d/{{ inventory_hostname }}.p12 -W "{{ pkcs12_pwd }}"'
   
       - name: Remove PKCS #12 file
         ansible.builtin.file:
           path: "/etc/ipsec.d/{{ inventory_hostname }}.p12"
           state: absent
   
       - name: Opportunistic mesh IPsec VPN with certificate-based authentication
         ansible.builtin.include_role:
           name: rhel-system-roles.vpn
         vars:
           vpn_connections:
             - opportunistic: true
               auth_method: cert
               policies:
                 - policy: private
                   cidr: default
                 - policy: private
                   cidr: 192.0.2.0/24
                 - policy: clear
                   cidr: 192.0.2.1/32
           vpn_manage_firewall: true
           vpn_manage_selinux: true

   The settings specified in the example playbook include the following:

   opportunistic: true

   Enables an opportunistic mesh among multiple hosts. The policies variable defines for which subnets and hosts traffic must or or can be encrypted and which of them should continue using clear text connections.

   auth_method: cert

   Enables certificate-based authentication. This requires that you specified the nickname of each managed node’s certificate in the inventory.

   policies: <list_of_policies>

   Defines the Libreswan policies in YAML list format.

   The default policy is private-or-clear. To change it to private, the above playbook contains an according policy for the default cidr entry.

   To prevent a loss of the SSH connection during the execution of the playbook if the Ansible control node is in the same IP subnet as the managed nodes, add a clear policy for the control node’s IP address. For example, if the mesh should be configured for the 192.0.2.0/24 subnet and the control node uses the IP address 192.0.2.1, you require a clear policy for 192.0.2.1/32 as shown in the playbook.

   For details about policies, see the ipsec.conf(5) man page on a system with Libreswan installed.

   vpn_manage_firewall: true

   Defines that the role opens the required ports in the firewalld service on the managed nodes.

   vpn_manage_selinux: true

   Defines that the role sets the required SELinux port type on the IPsec ports.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.vpn/README.md file on the control node.

4. Validate the playbook syntax:

   $ ansible-playbook --ask-vault-pass --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

5. Run the playbook:

   $ ansible-playbook --ask-vault-pass ~/playbook.yml

Verification

1. On a node in the mesh, ping another node to activate the connection:

   [root@managed-node-01]# ping managed-node-02.example.com

2. Confirm that the connections is active:

   [root@managed-node-01]# ipsec trafficstatus
   006 #2: "private#192.0.2.0/24"[1] ...192.0.2.2, type=ESP, add_time=1741938929, inBytes=372408, outBytes=545728, maxBytes=2^63B, id='CN=managed-node-02.example.com'