Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
| install_24_4_strongswan [2026/01/11 14:43] – system | install_24_4_strongswan [2026/01/12 06:08] (current) – [Create PKI] system | ||
|---|---|---|---|
| Line 55: | Line 55: | ||
| ------ | ------ | ||
| ===== Create PKI ===== | ===== Create PKI ===== | ||
| - | * Next we will creaate | + | * Next we will create |
| * We need to install a helper package that is part of StrongSwan first. | * We need to install a helper package that is part of StrongSwan first. | ||
| <code bash> | <code bash> | ||
| Line 62: | Line 62: | ||
| * We issue the following commands. | * We issue the following commands. | ||
| <code bash> | <code bash> | ||
| - | mkdir -p ~/pki/{cacerts, | + | mkdir -p ~/pki/{ca, |
| chmod 700 ~/pki | chmod 700 ~/pki | ||
| cd ~/pki | cd ~/pki | ||
| Line 82: | Line 82: | ||
| </ | </ | ||
| + | <WRAP center round tip 100%> | ||
| + | * StrongSwan has some very good documentation on managing certificates | ||
| + | * https:// | ||
| + | </ | ||
| + | |||
| -------- | -------- | ||
| Line 139: | Line 144: | ||
| } | } | ||
| </ | </ | ||
| - | + | ||
| + | ------------ | ||
| + | ==== Cert and Key Files ==== | ||
| + | * As we stated there are some pre-installed sub folders under the **/ | ||
| + | * The following should be used to contain the CA, server cert and server key files. | ||
| + | * Copy the **ca.crt** file to **/ | ||
| + | * Copy the **server.key** file to **/ | ||
| + | * Copy the **server.crt** file to **/ | ||
| + | |||
| + | ---------- | ||
| + | ===== Xfrm Interface Prep ===== | ||
| + | * When a client connects establishes a connection to the StrongSwan server, it is referred to as a Security Association (SA). | ||
| + | * We can use the swanctl command to see if there are any existing SAs. | ||
| + | <code bash> | ||
| + | sudo swanctl --list-sa | ||
| + | xfrm-gw: #11, ESTABLISHED, | ||
| + | local ' | ||
| + | remote ' | ||
| + | AES_CBC-128/ | ||
| + | established 679s ago, rekeying in 2626s | ||
| + | xfrm-gw: #7, reqid 1, INSTALLED, TUNNEL-in-UDP, | ||
| + | installed 1372s ago, rekeying in 2128s, expires in 2588s | ||
| + | in c9f9936f (-|0x00000064), | ||
| + | out c33bfaa6 (-|0x00000064), | ||
| + | local 0.0.0.0/0 | ||
| + | remote 0.0.0.0/0 | ||
| + | </ | ||
| + | * We implement a route based IPsec VPN (The other option is policy based). | ||
| + | * Route based IPsec specify a **if_id_in** and **if_id_out**. | ||
| + | * This is used to tag traffic inside a SA. | ||
| + | * With Wireguard, you can have multiple instances running on different ports. | ||
| + | * With StrongSwan there is one instance, but you can have multiple connections defined in the config file each using a unique **if_id_in** and **if_id_out**. | ||
| + | * The **if_id_in** and **if_if_out** in tern have to terminate into a **xfrm** interface. | ||
| + | * We will create a startup script that prepare this interface for us **BEFORE** we start StrongSwan. | ||
| + | * Create the file **/ | ||
| + | * We assume eth0 is the interface name where the server gets it Internet from. Please adapt if your server is different. | ||
| + | <code bash> | ||
| + | #!/bin/sh | ||
| + | set -e | ||
| + | # | ||
| + | IFACE=xfrm0 | ||
| + | IF_ID=100 | ||
| + | ADDR=10.3.0.1/ | ||
| + | SUBNET=10.3.0.0/ | ||
| + | |||
| + | # Create XFRM interface | ||
| + | ip link show " | ||
| + | ip link add " | ||
| + | |||
| + | # Assign IP | ||
| + | ip addr show " | ||
| + | ip addr add " | ||
| + | |||
| + | # Bring interface up | ||
| + | ip link set " | ||
| + | |||
| + | # Route for remote side | ||
| + | ip route show " | ||
| + | ip route add " | ||
| + | |||
| + | # ---- NAT via nftables ---- | ||
| + | |||
| + | # Create table if missing | ||
| + | nft list table ip nat >/ | ||
| + | nft add table ip nat | ||
| + | |||
| + | # Create postrouting chain if missing | ||
| + | nft list chain ip nat postrouting >/ | ||
| + | nft add chain ip nat postrouting { type nat hook postrouting priority 100\; } | ||
| + | |||
| + | # Add SNAT/ | ||
| + | nft list chain ip nat postrouting | grep -q " | ||
| + | nft add rule ip nat postrouting oifname " | ||
| + | nft add rule ip nat postrouting oifname " | ||
| + | |||
| + | </ | ||
| + | * Create a startup script called **/ | ||
| + | <code bash> | ||
| + | [Unit] | ||
| + | Description=XFRM Interface xfrm0 | ||
| + | Before=strongswan.service | ||
| + | Wants=network-online.target | ||
| + | After=network-online.target | ||
| + | |||
| + | [Service] | ||
| + | Type=oneshot | ||
| + | ExecStart=/ | ||
| + | RemainAfterExit=yes | ||
| + | |||
| + | [Install] | ||
| + | WantedBy=multi-user.target | ||
| + | </ | ||
| + | * Enable the startup script and start it up | ||
| + | <code bash> | ||
| + | systemctl enable xfrm0 | ||
| + | systemctl start xfrm0 | ||
| + | </ | ||
| + | * Everything is now prepared on the server side. | ||
| + | * We can now configure clients in APdesk and MESHdesk to route certain traffic through the IPsec tunnel. | ||
| + | * These are covered in a dedicated Wiki page. | ||