Qube Point to Point VPN

Qube point to point VPN is an implementation of FreeSwan's Ipsec. It uses FreeSwan version 1.91 and inherits all the features (and all of the flaws) of this version.

Only a subset of these features can be administered from the Graphic Interface. For more detailed control you must edit files in the "/etc./freeswan" directory:

1. ipsec.conf
2. ipsec.conf.profiles
3. ipsec.conf.tunnels
4. ipsec.secrets

After editing any of these files you must be careful what you do from the Graphic Interface so as not to overwrite your changes.

First some general comments

The Perl code which implements Setup from the Graphic Interface ("/usr/sausalito/sbin/ipsec.pl") has a bug in it which prevents it from properly rewriting "/etc/ipchains.conf". For most users this bug is more like a feature, as they probably do not want Ipchains rules changed. But if you reload or restart the Basic Firewall without fixing this bug it will crash the VPN. My experience is that even if you fix this bug over time the system will corrupt the "etc/ipchains/conf" file due to tunnel crashes etc. My suggestion is to eliminate the code which changes the "etc/ipchains/conf" file. For security reasons you then need Ipchains rules to prevent improper access if the tunnel's are down.

Restarting CCED for any reason (most common is backup) will eliminate the network interfaces thus breaking the tunnels. To fix this you must run the "/etc/rc.d/init.d/ipsec restart" command or the "ipsec setup restart" command after restarting CCED. Also Ipsec cannot be started properly before the network connection it will use is established. This can be a problem for certain kinds of DSL or dial up connections.

If you are using some kind of WAN connection that uses PPP or some other kind of login, you may want to remove Ipsec from startup (usually with "/sbin/chconfig/ -del ipsec") and start and stop Ipsec with the "up" and "down" executables for the connection.

If there are any occurrences of NAT between the hosts, it will break Ipsec (this is not totally true, under special circumstances and if only ESP is used, you can establish a tunnel through NAT).

For information on just what is happening you can view the "/var/logs/secure" log. You can also run the "ipsec look" command. For very detailed information run the "ipsec barf" command.

After you get the VPN up and running you will want to change the "ipsec.conf" file line "plutodebug=all" to "plutodebug=none" to reduce the size of the "secure" log generated.

You may also want to change the "ipsec.conf" file line "plutostart=" to "plutostart=%search". But notice the warning above about having the interface running first.

You may want to increase the number of "keyingtries" ("keying attempts" in the Graphic Interface ) in the "ipsec.conf.profiles".

If you have a "standard" Qube you can add the Point to Point VPN features by installing the following RPM's available for download from Sun:

1. base ipsec-capstone
2. base ipsec-glue
3. base ipsec -locale

This will not properly populate the "ipsec.secrets" file.

For more details on FreeSwan see www.freeswan.org .

All of the above and all of the following may or may not apply to "manual" configurations.

Using FreeSwan with hosts other than Qubes

There are two methods for doing this. You can completely ignore the Graphic Interface and do everything from the command line (this gives you much more flexibility but require the end user use the command line). You can use the command line for initial setup and use the Graphic Interface for routine operation (this frees the end user from needing command line skills). I will mostly discuss the second case here.

The Qube normally establishes four tunnels

1. Network1 to network2
2. Network1 to host2
3. Host1 to network2
4. Host1 to host2

For most situations you will need only the first tunnel or possibly the first and second tunnel.

If you start the connection from the non Qube host, you can create the tunnel setups ( in "ipsec.conf.tunnels') then set the Qube to "the other end starts connection ". In most cases the non Qube host will then automatically initiate the tunnel when you try to connect to any IP on the Qube's network.

If you wish to be able to start the tunnel(s) from the Qube end you can create a PHP script that can be accessed from the "Point to Point VPN" screen on the Qube (the default startup will try to start four tunnels). You can also set the tunnel(s) to "auto=start" in the "ipsec.conf.tunnels" file in which case they will start when ipsec starts (if "plutostart=%search" is set in the "ipsec.conf"file), but if you do anything with the Graphic Interface besides view tunnel status it will break the configuration.

The limits on various configuration items are:

1. Only 3DES is supported (not DES)
2. Only Diffie-Hellman group 2 (1536) is supported
3. Max keylife=1440m (default is 480m)
4. Max ikelifetime=480m (default is 60m)
5. Default is pfs=yes (perfect forward security)
6. If keyingtries=0 the system will keep retrying indefinitely
7. Keep Alive is not implemented
8. Setting conn %default before any specific conn will result in defaults being used unless overridden by the specific conn

Random hazards

1. The subnets on opposite ends of the tunnel must not overlap
2. NAT must not exist between the hosts
3. WAN delays over 500 ms. Will usually break tunnels
4. Packet fragmentation will tend to break tunnels (check mtu)
5. If you have tunnel crashes you probably will have to reload ipchains rules either from the command line or by stopping and restarting the basic firewall from the Graphic Interface
6. If you find yourself locked out from the remote Qube see item four (you may need to connect to the Remote Qube from a different IP to gain access to it)

Sample "ipsec.conf.profiles" file section for WatchGuard SOHO6tc

conn watchguard-auto
   auth=esp
   pfs=no
   keylife=1440m
   rekeymargin=9m
   rekeyfuzz=9m
   keyingtries=99    (cannot set to 0 from the Graphic Interface)
   ikelifetime=60m

This file can be created from the Graphic Interface using "Add Profile"

For this configuration you would want to set WatchGuard

1. Select the negotiation Mode (unless you are paranoid use Aggressive)
2. Select the Local ID and Remote ID to IP
3. Select Authentication Algorithm MD5-HMAC
4. Select Encryption Algorithm 3DES-CBC
5. Select Negotiation Expires in kilobaud 0 (No limit)
6. Select Negotiation Expires in hours 24
7. Select Diffie-Hellman Group 2
8. Do not select Enable Perfect Forward Security
9. Do not select Generate IKE Keep Alive Messages
10. Proceed to Phase 2
11. Select Authentication Algorithm MD5-HMAC
12. Select Encryption Algorithm 3DES-CBC
13. Do not select Enable Perfect Forward Security
14. Select Key Expires in kilobaud 8192
15. Select KEY Expires in hours 1
16. Enter the IP's and Netmasks for the private networks.
17. Submit

For the WatchGuard you must use Shared Secret
You can create the shared secret on the Qube using Add or Modify Connection but do not change anything but the shared secret or it will overwrite "ipsec.conf.tunnels"
You can also manually edit "ipsec.conf.secrets".

The Qube should automatically change the ipchains rules to handle the connection

Setup very similar to the WatchGuard works for other FireWall-VPN boxes.

You can also connect a remote computer using IRE's SafeNet VPN (unless you are really paranoid the Qube's Remote Login VPN is a lot easier).