Skip to content

Commit 19310b1

Browse files
AdSchellevisAdSchellevis
committed
VPN: IPsec - add example (23.1)
1 parent ac814e6 commit 19310b1

File tree

3 files changed

+170
-4
lines changed

3 files changed

+170
-4
lines changed

‎source/manual/how-tos/ipsec-s2s-conn-route.rst

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
====================================
2-
IPsec VTI - Route based PSK setup
2+
IPsec - Route based (VTI) PSK setup
33
====================================
44

55
This example utilises the new options available in OPNsense 23.1 to setup a site to site tunnel in routed mode
@@ -44,7 +44,7 @@ to peer both firewalls. We will create a tunnel network using :code:`192.168.123
4444

4545

4646
--------------------------------
47-
Preperations
47+
Preparations
4848
--------------------------------
4949

5050
.....................
@@ -91,8 +91,8 @@ Property site A site B
9191
======================= =================== ===================
9292
Name IPSEC10_GW IPSEC10_GW
9393
Interface IPSEC10 IPSEC10
94-
Address Family IPv4 IPv4
95-
IP address **192.168.123.2** **192.168.123.1**
94+
Address Family IPv4 IPv4
95+
IP address **192.168.123.2** **192.168.123.1**
9696
======================= =================== ===================
9797

9898

@@ -114,6 +114,12 @@ Gateway IPSEC10_GW IPSEC10_GW
114114
======================= =================== ===================
115115

116116

117+
.....................
118+
Enable IPsec
119+
.....................
120+
121+
Before configuring the connections, we enable the IPsec module. Just mark the "enable" checkbox on the connections tab.
122+
117123
--------------------------------
118124
Setting up the IPsec connection
119125
--------------------------------

‎source/manual/how-tos/ipsec-s2s-conn.rst

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
========================================
2+
IPsec - Policy based public key setup
3+
========================================
4+
5+
This example utilises the new options available in OPNsense 23.1 to setup a site to site tunnel in policy mode
6+
between two OPNsense machines using key pairs.
7+
8+
.. contents:: Index
9+
10+
--------------------------------
11+
Network topology
12+
--------------------------------
13+
14+
The schema below describes the situation we are implementing. Two networks (A,B) and a transit network (10.10.1.0/24)
15+
to peer both firewalls.
16+
17+
.. nwdiag::
18+
:scale: 100%
19+
20+
nwdiag {
21+
22+
span_width = 90;
23+
node_width = 180;
24+
network A {
25+
address = "10.1.0.0/24";
26+
pclana [label="PC Site A\n10.1.0.20",shape="cisco.pc"];
27+
fwa [shape = "cisco.firewall", address="10.1.0.1/24"];
28+
}
29+
network Ext {
30+
address = "10.10.1.0/24";
31+
label = "Ext";
32+
fwa [shape = "cisco.firewall", address="10.10.1.1/24"];
33+
fwb [shape = "cisco.firewall", address="10.10.1.2/24"];
34+
}
35+
network B {
36+
address = "192.168.1.0/24"
37+
fwb [shape = "cisco.firewall", address="192.168.1.20"];
38+
pclanb [label="PC Site B\n192.168.1.20",shape="cisco.pc"];
39+
}
40+
41+
42+
}
43+
44+
45+
--------------------------------
46+
Preparations
47+
--------------------------------
48+
49+
Since our policy based setup doesn't require interfaces, gateways and routes, we only need to make sure the IPsec
50+
module is enabled on the Connections tab and Key pairs are registered for both hosts.
51+
52+
..................................
53+
Key pairs
54+
..................................
55+
56+
Go to the :menuselection:`VPN->IPsec->Key Pairs` option in the menu and create a new key on both hosts, then copy the public part
57+
from Site A to Site B and vise versa. Keys may easily be generated with the gear button in the Key type field.
58+
59+
60+
--------------------------------
61+
Setting up the IPsec connection
62+
--------------------------------
63+
64+
In order to setup a simple (and common) IPsec connection, we go to :menuselection:`VPN->IPsec->Connections` and add
65+
a new entry.
66+
67+
68+
.....................
69+
General settings
70+
.....................
71+
72+
Side by side the following general settings need to be set in this case, which configures the first part of the security association between
73+
both sites:
74+
75+
===============================================================
76+
77+
======================= =================== ===================
78+
Property site A site B
79+
======================= =================== ===================
80+
Local addresses **10.10.1.1** **10.10.1.2**
81+
Remote addresses **10.10.1.2** **10.10.1.1**
82+
======================= =================== ===================
83+
84+
Press <save> to go to the next step.
85+
86+
.. Note::
87+
88+
One may omit the local address if any address may be used to initiate the connection from, other valid options
89+
are also mentioned in the help text of the attribute.
90+
91+
92+
.....................
93+
Authentication
94+
.....................
95+
96+
Next we will need to add local authentication (add a new record in the local grid):
97+
98+
===============================================================
99+
100+
======================= =================== ===================
101+
Property site A site B
102+
======================= =================== ===================
103+
Authentication Public Key Public Key
104+
Id **hostA** **hostB**
105+
Public Keys **hostA-key** **hostB-key**
106+
======================= =================== ===================
107+
108+
Then we need to set Pre-Shared Key for remote authentication as well:
109+
110+
===============================================================
111+
112+
======================= =================== ===================
113+
Property site A site B
114+
======================= =================== ===================
115+
Authentication Public Key Public Key
116+
Id **hostB** **hostA**
117+
Public Keys **hostB-key** **hostA-key**
118+
======================= =================== ===================
119+
120+
121+
.. Note::
122+
123+
On host A the private key for Host A should be known and only the public key of Host B, Host B is exactly the oposite.
124+
125+
126+
.....................
127+
Children
128+
.....................
129+
130+
Finally we may add a child which will add security policies and kernel routes.
131+
132+
133+
======================= =================== ===================
134+
Property site A site B
135+
======================= =================== ===================
136+
Mode Tunnel Tunnel
137+
Policies [checked] [checked]
138+
Local **192.168.1.0/24** **10.0.1.0/24**
139+
Remote **10.0.1.0/24** **192.168.1.0/24**
140+
======================= =================== ===================
141+
142+
.....................
143+
Save and apply
144+
.....................
145+
146+
Finally save the settings and hit apply on the connections page to establish the tunnel.
147+
148+
--------------------------------
149+
Validate
150+
--------------------------------
151+
152+
Now can check if the tunnel is active on both side using the status overview in :menuselection:`VPN->IPsec->Status Overview`
153+
154+
--------------------------------
155+
Install firewall policies
156+
--------------------------------
157+
158+
With the tunnel active, all that remains is to accept traffic on this tunnel using the :menuselection:`Firewall->Rules->IPsec`
159+
menu option.

‎source/manual/vpnet.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -228,6 +228,7 @@ New > 23.1 (:menuselection:`VPN -> IPsec -> Connections`)
228228
:maxdepth: 2
229229
:titlesonly:
230230

231+
how-tos/ipsec-s2s-conn
231232
how-tos/ipsec-s2s-conn-route
232233

233234

0 commit comments

Comments
 (0)