• site to site VPN: this is used to link sites, such as your office and the data center,
• mobile VPN: this is used to link mobile or home users to a corporate site, or a data center.

The mobile VPN to your office is typically free, you just need to pay a one time setup fee and sometimes an extra license fee depending on the vendor. If your firewall is based on pfSense, there are no extra license fees.

The site to site VPN is typically priced on a per channel basis, to cover our bandwidth and virtual port costs on the terminating firewall in the data center. This is optional, and you can decide to sign up for that service once there is a clear business case for it.

It is necessary for some users to have all their traffic directed through the OpenVPN concentrator. The number one reason for such a configuration is to protect the HTTP traffic over unsecured WiFi (a.k.a. hotspots).

Solution

Add to the bottom of the connecting client’s configuration file (typically under /etc/openvpn/clients.d the following line:
push "redirect-gateway"


Premise

Setting up VPN with IPsec using public / private key authentication between two networks using OpenBSD firewalls.

Concept

Each VPN concentrator will have the public key fo the other machine, and one of the VPN concentrators will be designated as the active requester. The other will be set up in a passive role, to accept the connection initiation, like a central VPN gateway at a datacenter would.

Practical steps

1. Set up proper rules so that the firewalls pass proper traffic. That is done by adding the line in pf.conf to allow for the gateways to communicate:

   pass quick on $ext_if from $remote_vpn_gw_ip

2. Set up the public key for each firewall on it’s counterpart:

   mkdir -p /etc/isakmpd/pubkeys/ipv4
   cp remote_gateway_local.pub /etc/isakmpd/pubkeys/ipv4/xxx.xxx.xxx.xxx

   where xxx.xxx.xxx.xxx is the IP address of the remote gateway. (See below how to generate the public / private keys.)

3. Create the ipsec.conf configuration file on the active VPN gateway:

   GW_LOCAL=ip_of_local_vpn_gateway
   GW_REMOTE=ip_of_remote_vpn_gateway
   LOCAL_NETWORKS="{ local_net1/mask1, local_net2/mask2, ... }"
   REMOTE _NETWORKS="{ remote_net1/mask1, local_net2/mask2, ... }"
   
   ike esp from $LOCAL_NETWORKS to $REMOTE_NETWORKS peer $GW_REMOTE
   ike esp from $GW_LOCAL to $REMOTE_NETWORKS peer $GW_REMOTE
   ike esp from $GW_LOCAL to $GW_REMOTE

4. Create the ipsec.conf configuration file on the passive VPN gateway:

   GW_LOCAL=ip_of_local_vpn_gateway
   GW_REMOTE=ip_of_remote_vpn_gateway
   LOCAL_NETWORKS="{ local_net1/mask1, local_net2/mask2, ... }"
   REMOTE _NETWORKS="{ remote_net1/mask1, local_net2/mask2, ... }"
   
   ike passive esp from $LOCAL_NETWORKS to $REMOTE_NETWORKS peer $GW_REMOTE
   ike passive esp from $GW_LOCAL to $REMOTE_NETWORKS peer $GW_REMOTE
   ike passive esp from $GW_LOCAL to $GW_REMOTE

5. Start the VPN on each VPN gateway:

   isakmpd -K
   ipsecctl -f /etc/ipsec.conf

6. Test the connections:

   ipsecctl -sa

   it may take a few minutes for the VPN channels to get established.

Public / Private Keys

Generating Public / Private keys with OpenSSL (on full OpenBSD install, this is already done automatically):

openssl genrsa -out /etc/isakmpd/private/local.key
chmod 600 /etc/isakmpd/private/local.key
openssl rsa -out /etc/isakmpd/private/local.pub -in /etc/isakmpd/private/local.key -pubout

If you are running a lightweight distro like flashdist, then you might need to generate these keys on a different machine.

References

• Zero to IPSec in 4 minutes
• OpenBSD ipsec.conf man page
• man isakmpd typos email thread

Thanks for the various assists on this, I’m glad to say that the problem I was having is now solved. I am now successfully interworking dynamically addressed (DHCP) Win2K-pro and XP clients with OpenBSD isakmpd using X.509 certificate-based authentication. I believe this to be a lot more scalable and manageable than using pre-shared secrets.

For reference, the problem I was having was caused by incorrectly entering the X.509 certificates into the cert stores on the Windows machines using the MMC snap-in. So it wasn’t an OBSD issue at all

If anyone has the same problem, you need to make sure you are entering the CA and client certs into the cert stores for the LOCAL COMPUTER *not* the CURRENT USER (which is the default if you just double-click on the cert bundle on the desktop). Doh! Instead click start->run and enter “mmc” then add the snap-in for ‘Manage Certificates’ making sure you select ‘local computer’ in the dialogue. Obviously you will also need to add the snap-in for ‘manage IPsec policies’ too.

All-in-all not entirely a pain-free process, but a great learning experience (and now at last I am confident my wireless LAN is *properly* secure).

For ref, below are the isakmpd.conf and isakmp.policy files which I am using on the OPENBSD server.

Generating the X.509 certs correctly requires some care. I do it using the ‘ca’ command on openssl (this avoids the need to use certpatch, but make sure you read the relevant parts of the IPSEC/ISAKMPD/VPN manpages about what is needed here – because you are using DHCP clients, you need to put the FQDN in the subjectAltName part of the cert). I also use the ‘pkcs12′ command on openssl to produce a cert-bundle which is the easiest way to safely transport and import the certs and private key onto the windows boxes. I have some basic scripts for doing the openssl bits, which I guess I can email to anyone who’s interested.

By the way, if you are using PF don’t forget you will additionally need to create some relevant filtering rules to allow traffic on esp0…

Rgds to all
MC

===
# This is the isakmpd.conf file for the SERVER
#

[General]
Listen-on=              10.0.0.1

[Phase 1]
Default=                ISAKMP-peer-dhcp

[Phase 2]
Passive-connections=    IPsec-connection

[ISAKMP-peer-dhcp]
Phase=                  1
Local-address=          10.0.0.1
ID=                     server-fqdn-id
Configuration=          IKE-main-mode-config

[server-fqdn-id]
ID-type=                FQDN
Name=                   server

[IKE-main-mode-config]
DOI=                    IPSEC
EXCHANGE_TYPE=          ID_PROT
Transforms=             AES-SHA-RSA_SIG, 3DES-SHA-RSA_SIG

[IPsec-connection]
Phase=                  2
ISAKMP-peer=            ISAKMP-peer-dhcp
Configuration=          IKE-quick-mode-config
Local-ID=               server-ipv4-id
Remote-ID=              generic-ipv4-id

[IKE-quick-mode-config]
DOI=                    IPSEC
EXCHANGE_TYPE=          QUICK_MODE
Suites=                 QM-ESP-TRP-AES-SHA-SUITE, QM-ESP-TRP-AES-MD5-SUITE, QM-ESP-TRP-3DES-SHA-SUITE, QM-ESP-TRP-3DES-MD5-SUITE

[server-ipv4-id]
ID-type=                IPV4_ADDR
Address=                10.0.0.1

[generic-ipv4-id]
ID-type=                IPV4_ADDR
Address=                0.0.0.0

[X509-certificates]
Ca-directory=           /etc/isakmpd/ca/
Cert-directory=         /etc/isakmpd/certs/
Private-key=            /etc/isakmpd/private/local.key

===
# this is the matching isakmpd.policy file for the SERVER
Authorizer: "POLICY"
Licensees: "DN:/C=My Country/O=My Org/OU=PKI Infrastructure/CN=My Root CA"
conditions:app_domain == "IPsec policy" &&
        doi == "ipsec" &&
        esp_present == "yes" &&
        esp_enc_alg != "null" -> "true";