{"id":1948,"date":"2022-09-08T11:41:04","date_gmt":"2022-09-08T03:41:04","guid":{"rendered":"http:\/\/notes4it.com\/?p=1948"},"modified":"2022-09-09T08:23:55","modified_gmt":"2022-09-09T00:23:55","slug":"freebsd-firewall-with-strongswan-building-site-to-site-vpn-tunnel-sample","status":"publish","type":"post","link":"http:\/\/notes4it.com\/?p=1948","title":{"rendered":"FreeBSD firewall with Strongswan building site to site vpn tunnel – sample"},"content":{"rendered":"\n

I recently has upgraded the FreeBSD version to 13 and found that the IPSec site to site between FreeBSD 13 to Juniper SRX is not working anymore. Strongswan is ditching the ipsec.conf and move to swanctl.conf. If we are moving to the vici, this requires some effort to translate the config.<\/p>\n\n\n\n

I have attached the quick and dirty sample to build a Policy based site to site IPSec vpn with Strongswan. Enhancement is required for production.
The sample is suitable for the following:
– policy based VPN
– using PSK.
– source vpn termination point is NATTed and behind a internet gateway.
– dynamic public IP address for source vpn termination point.
– dynamic destination IP address for the remote IPSec VPN termination point. (required the DNS lookup for the source vpn termination point.)
– multiple VPN termination points from the same source public IP address are allowed.
<\/p>\n\n\n\n\n\n\n\n

Install the Strongswan into the FreeBSD:
<\/p>\n\n\n\n

pkg install strongswan\n\nThe default strongSwan configuration interface have been updated to vici since version 5.9.2_1.\nTo use the stroke interface by default either compile the port without the vici option or\nset 'strongswan_interface=\"stroke\"' in your rc.conf file.<\/pre>\n\n\n\n
The swanctl config is located as listed below:
<\/p>\n\n\n\n
\/usr\/local\/etc\/swanctl\/conf.d # ls\nFBSD-AJ1401SRX01.conf\n\/usr\/local\/etc\/swanctl\/conf.d # vi FBSD-AJ1401SRX01.conf<\/pre>\n\n\n\n
Add the following into the \/etc\/rc.conf<\/p>\n\n\n\n
##### enable strongswan for IPSec VPN\n##### \/usr\/local\/etc. Edit ipsec.conf\nstrongswan_enable=\"YES\"\n########################<\/pre>\n\n\n\n


Once the config file is completed, then reset the service.
service strongswan restart<\/p>\n\n\n\n
connections {\nAJ1401SRX01 {\n    aggressive = yes\n    remote_addrs = <ip address or domain name>\n# if using domain then the machine needs to be able to perform DNS lookup.\n    version = 1\n# using ikev1 only.\n    proposals = <same format as the ipsec.conf>\n    local-1 {\n        auth = psk\n        id = AJHKGMATFWL01.ddns.sample\n# this is the local identity using hostname\n    }\n    remote-1 {\n        id = fatball.ddns.sample\n# this is the remote identity using hostname\n        auth = psk\n    }\n    children {\n# this is the phase 2 section.\n        AJ1401SRX01-1 {\n            local_ts = 172.16.254.13\/32 \n            remote_ts = 172.16.254.12\/32\n# the lines above are the interested traffic for policy based vpn.\n            esp_proposals = <same format as the ipsec.conf>\n            start_action = trap\n            dpd_action = restart\n        }\n    }\n}\n}\nsecrets {\nike-AJ1401SRX01 {\nsecret = \"the_PSK_secret_of_the_tunnel\"\nid-1 = fatball.ddns.sample\n}\n}<\/code><\/pre>\n\n\n\n
<\/p>\n\n\n\n
The following command can be used for troubleshooting and checking:
swanctl –list-conns
# this lists out the loaded config.

swanctl –log
# this gives you the error log for live troubleshoot.

swanctl –list-sas
# this lists out the connected tunnel.
<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
Allow to use aggressive mode with PSK.
vi \/usr\/local\/etc\/strongswan.conf
add the following.
<\/p>\n\n\n\n
    i_dont_care_about_security_and_use_aggressive_mode_psk = yes        <\/code><\/pre>\n\n\n\n

<\/p>\n\n\n\n
Reference:
– Strongswan ipsec.conf to swanctl.conf migration sample.
https:\/\/wiki.strongswan.org\/projects\/strongswan\/wiki\/Fromipsecconf

– Strongswan sample.
https:\/\/wiki.strongswan.org\/projects\/strongswan\/wiki\/UsableExamples

– Cipher options.
https:\/\/wiki.strongswan.org\/projects\/strongswan\/wiki\/IKEv1CipherSuites
https:\/\/wiki.strongswan.org\/projects\/strongswan\/wiki\/IKEv2CipherSuites

– allow  aggressive mode with PSK in Strongswan.
error message: Aggressive Mode PSK disabled for security reasons
https:\/\/support.fortinet.com.cn\/uploadfile\/wangxiang\/IPSEC%20VPN%20_between_Strongswan_and_FGT.pdf<\/p>\n","protected":false},"excerpt":{"rendered":"
I recently has upgraded the FreeBSD version to 13 and found that the IPSec site to site between FreeBSD 13 to Juniper SRX is not working anymore. Strongswan is ditching the ipsec.conf and move to swanctl.conf. If we are moving to the vici, this requires some effort to translate the config. I have attached the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[233,234,225,231,232,230],"class_list":["post-1948","post","type-post","status-publish","format-standard","hentry","category-networking","tag-behind-nat","tag-dynamic-public-ip","tag-freebsd","tag-policy-based-vpn","tag-psk","tag-site-to-site-vpn"],"_links":{"self":[{"href":"http:\/\/notes4it.com\/index.php?rest_route=\/wp\/v2\/posts\/1948","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/notes4it.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/notes4it.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/notes4it.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/notes4it.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1948"}],"version-history":[{"count":17,"href":"http:\/\/notes4it.com\/index.php?rest_route=\/wp\/v2\/posts\/1948\/revisions"}],"predecessor-version":[{"id":1984,"href":"http:\/\/notes4it.com\/index.php?rest_route=\/wp\/v2\/posts\/1948\/revisions\/1984"}],"wp:attachment":[{"href":"http:\/\/notes4it.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1948"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/notes4it.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1948"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/notes4it.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1948"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}