Beiträge von ATD

# ipsec.conf - strongSwan IPsec configuration file /etc/ipsec.conf 


# basic configuration


config setup
        # strictcrlpolicy=yes
        # uniqueids = no


# Add connections here.


conn %default
        left=%defaultroute
        leftsubnet=192.168.1.0/24
        leftid=@cougar.tvdr.de
        leftfirewall=no
        keyexchange=ikev1
        aggressive=yes
        authby=secret
        ike=aes128-sha1-modp2048
        esp=aes128-sha1-modp2048
        auto=start


conn racoon
        right=88.198.76.220
        rightid=@racoon.tvdr.de


conn panther
        right=%panther.tvdr.de
        rightid=@panther.tvdr.de
        rightsubnet=192.168.100.0/24

# /etc/strongswan.conf
# strongswan.conf - strongSwan configuration file
#
# Refer to the strongswan.conf(5) manpage for details
#
# Configuration changes should be made in the included files


charon {
filelog {
        /var/log/charon.log {
            # add a timestamp prefix
            time_format = %b %e %T
            # prepend connection name, simplifies grepping
            ike_name = yes
            # overwrite existing files
            append = no
            # increase default loglevel for all daemon subsystems
            default = 2
            # flush each line to disk
            flush_line = yes
        }
        stderr {
            # more detailed loglevel for a specific subsystem, overriding the
            # default loglevel.
            ike = 2
            knl = 3
        }
    }
        load_modular = yes
        plugins {
                include strongswan.d/charon/*.conf
        kernel-netlink {
            fwmark = !0x42
        }
        socket-default {
            fwmark = 0x42
        }
        kernel-libipsec {
            allow_peer_ts = yes
        }
    }
}

#/etc/config/firewall
config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option family 'ipv4'
        option target 'ACCEPT'


config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'


config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'


config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fe80::/10'
        option src_port '547'
        option dest_ip 'fe80::/10'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'


config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'


config zone
        option name 'vpn'
        option network ' '
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option subnet '192.168.8.0/24'


config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'


config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'


config forwarding
        option src 'vpn'
        option dest 'lan'


config forwarding
        option src 'lan'
        option dest 'vpn'


config forwarding
        option src 'lan'
        option dest 'wan'


config include
        option path '/etc/firewall.user'
        option reload 1

login as: root
root@192.168.220.1's password:




BusyBox v1.23.2 (2015-07-25 06:35:11 CEST) built-in shell (ash)


  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 CHAOS CALMER (15.05, r46767)
 -----------------------------------------------------
  * 1 1/2 oz Gin            Shake with a glassful
  * 1/4 oz Triple Sec       of broken ice and pour
  * 3/4 oz Lime Juice       unstrained into a goblet.
  * 1 1/2 oz Orange Juice
  * 1 tsp. Grenadine Syrup
 -----------------------------------------------------
root@OpenWrt:~# cat /etc/config/firewall
#/etc/config/firewall
config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option family 'ipv4'
        option target 'ACCEPT'


config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'


config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'


config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fe80::/10'
        option src_port '547'
        option dest_ip 'fe80::/10'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'


config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'


config zone
        option name 'vpn'
        option network ' '
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option subnet '192.168.8.0/24'


config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'


config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'


config forwarding
        option src 'vpn'
        option dest 'wan'


config forwarding
        option src 'lan'
        option dest 'wan'


config include
        option path '/etc/firewall.user'
        option reload 1


root@OpenWrt:~# cat /etc/firewall.user
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.


# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.


iptables -t nat -A prerouting_wan_rule -m policy --dir in --pol ipsec -j ACCEPT
iptables -t nat -A postrouting_wan_rule -m policy --dir out --pol ipsec -j ACCEPT
iptables -A forwarding_rule -m policy --dir in --pol ipsec -m conntrack --ctstate N -j zone_vpn_forward
iptables -A input_wan_rule -m policy --dir in --pol ipsec -m conntrack --ctstate N -j ACCEPT
root@OpenWrt:~#

root@OpenWrt:/# ipsec restart
Stopping strongSwan IPsec...
Starting strongSwan 5.3.3 IPsec [starter]...
root@OpenWrt:/# ipsec statusall
Status of IKE charon daemon (strongSwan 5.3.3, Linux 3.18.20, x86_64):
  uptime: 11 seconds, since Dec 09 18:48:47 2015
  malloc: sbrk 225280, mmap 0, used 212256, free 13024
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 2
  loaded plugins: charon aes des rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pgp dnskey sshkey pem fips-prf gmp xcbc hmac attr kernel-netlink resolve socket-default stroke updown xauth-generic
Listening IP addresses:
  192.168.220.1
  79.xxx.xxx.118
Connections:
          ms:  %any...xxx.dyndns.org,0.0.0.0/0,::/0  IKEv1 Aggressive
          ms:   local:  [cougar] uses pre-shared key authentication
          ms:   remote: [racoon] uses pre-shared key authentication
          ms:   child:  192.168.220.0/24 === 192.168.8.0/24 TUNNEL
Security Associations (1 up, 0 connecting):
          ms[1]: ESTABLISHED 11 seconds ago, 79.xxx.xxx.118[cougar]...79.xxx.xxx.173[racoon]
          ms[1]: IKEv1 SPIs: 8b89a581b1d31502_i* 46613ad86a57075c_r, pre-shared key reauthentication in 56 minutes
          ms[1]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
          ms{1}:  INSTALLED, TUNNEL, reqid 1, ESP SPIs: c0026296_i 31a345cc_o
          ms{1}:  AES_CBC_128/HMAC_SHA1_96, 28 bytes_i, 0 bytes_o, rekeying in 14 minutes
          ms{1}:   192.168.220.0/24 === 192.168.8.0/24
root@OpenWrt:/# traceroute 192.168.8.21
traceroute to 192.168.8.21 (192.168.8.21), 30 hops max, 46 byte packets
 1  192.168.8.254 (192.168.8.254)  53.702 ms  53.536 ms  53.449 ms
 2  192.168.8.21 (192.168.8.21)  53.158 ms  53.760 ms  54.332 ms
root@OpenWrt:/# ping 192.168.8.21
PING 192.168.8.21 (192.168.8.21): 56 data bytes
64 bytes from 192.168.8.21: seq=0 ttl=254 time=53.470 ms
64 bytes from 192.168.8.21: seq=1 ttl=254 time=53.430 ms