NethServer 6

The implementation can support custom properties to override the configuration from web interface.

Every property in the form Custom_<name> will override any existing prop. The same syntax can also be used to set any IPsec options supported by OpenSwan.

Example: override left prop

Given the following record:

nethesis-test=ipsec-tunnel
    compress=no
    dpdaction=hold
    esp=auto
    ike=auto
    left=192.168.2.246
    leftid=@nethesis
    leftsubnets=192.168.1.0/24
    pfs=yes
    psk=Nethesis,12345678911
    right=1.2.3.4.5
    rightid=@test
    rightsubnets=192.168.6.0/24
    status=enabled

The admin can override the left property:

db vpn setprop nethesis-test Custom_left %any
signal-event nethserver-ipsec-save

Example: set new option

Set aggressive mode:

db vpn setprop nethesis-test Custom_aggrmode yes
signal-event nethserver-ipsec-save

• nethserver-ipsec-1.0.3-1.7.g584aafa.ns6.noarch.rpm

• Create a tunnel on a public server
• Create the same tunnel on another server (you can swap local/remote parameters)
• Check the tunnel can connect both firewalls

Partially verified:

pluto daemon logs the tunnel is up. Can't verify now if routes are set up correctly.

[root@vm5epa ~]# ping 192.168.102.78Jun 17 16:43:19 vm5epa pluto[6381]: packet from 192.168.102.78:500: received Vendor ID payload [Openswan (this version) 2.6.32 ]
Jun 17 16:43:19 vm5epa pluto[6381]: packet from 192.168.102.78:500: received Vendor ID payload [Dead Peer Detection]
Jun 17 16:43:19 vm5epa pluto[6381]: packet from 192.168.102.78:500: received Vendor ID payload [RFC 3947] method set to=109 
Jun 17 16:43:19 vm5epa pluto[6381]: packet from 192.168.102.78:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 109
Jun 17 16:43:19 vm5epa pluto[6381]: packet from 192.168.102.78:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 109
Jun 17 16:43:19 vm5epa pluto[6381]: packet from 192.168.102.78:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109
Jun 17 16:43:19 vm5epa pluto[6381]: packet from 192.168.102.78:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
Jun 17 16:43:19 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #2: responding to Main Mode
Jun 17 16:43:19 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #2: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Jun 17 16:43:19 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #2: STATE_MAIN_R1: sent MR1, expecting MI2
Jun 17 16:43:19 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #2: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected
Jun 17 16:43:19 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #2: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Jun 17 16:43:19 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #2: STATE_MAIN_R2: sent MR2, expecting MI3
Jun 17 16:43:19 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #2: Main mode peer ID is ID_IPV4_ADDR: '192.168.102.78'
Jun 17 16:43:19 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #2: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Jun 17 16:43:19 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #2: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_sha group=modp2048}
Jun 17 16:43:19 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #2: the peer proposed: 192.168.103.0/24:0/0 -> 192.168.104.0/24:0/0
Jun 17 16:43:19 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #3: responding to Quick Mode proposal {msgid:5c84497a}
Jun 17 16:43:19 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #3:     us: 192.168.103.0/24===192.168.101.44<192.168.101.44>[+S=C]
Jun 17 16:43:19 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #3:   them: 192.168.102.78<192.168.102.78>[+S=C]===192.168.104.0/24
Jun 17 16:43:19 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #3: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
Jun 17 16:43:19 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #3: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2
Jun 17 16:43:19 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #3: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
Jun 17 16:43:19 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #3: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP=>0x1ac11826 <0xb419c686 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none}
Jun 17 16:43:21 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #1: received Vendor ID payload [Openswan (this version) 2.6.32 ]
Jun 17 16:43:21 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #1: received Vendor ID payload [Dead Peer Detection]
Jun 17 16:43:21 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #1: received Vendor ID payload [RFC 3947] method set to=109 
Jun 17 16:43:21 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #1: enabling possible NAT-traversal with method 4
Jun 17 16:43:21 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
Jun 17 16:43:21 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #1: STATE_MAIN_I2: sent MI2, expecting MR2
Jun 17 16:43:21 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #1: I will NOT send an initial contact payload
Jun 17 16:43:21 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected
Jun 17 16:43:21 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #1: Not sending INITIAL_CONTACT
Jun 17 16:43:21 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
Jun 17 16:43:21 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #1: STATE_MAIN_I3: sent MI3, expecting MR3
Jun 17 16:43:21 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #1: received Vendor ID payload [CAN-IKEv2]
Jun 17 16:43:21 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #1: Main mode peer ID is ID_IPV4_ADDR: '192.168.102.78'
Jun 17 16:43:21 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4
Jun 17 16:43:21 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_sha group=modp2048}
Jun 17 16:43:21 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #4: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:996daa4c proposal=defaults pfsgroup=OAKLEY_GROUP_MODP2048}
Jun 17 16:43:21 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #4: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2
Jun 17 16:43:21 vm5epa pluto[6381]: "a2b_ipsec-tunnel/1x1" #4: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0x3ff6e082 <0x87d67579 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none}

The inline help is present, the Italian lang pack adds correct translations.

• nethserver-vpn-1.1.6-1.ns6.noarch.rpm
• nethserver-openvpn-1.2.3-1.ns6.noarch.rpm
• nethserver-ipsec-1.1.0-1.ns6.noarch.rpm

Admin manual: http://docs.nethserver.org/en/latest/vpn.html