Setting up StrongSwan Site-to-Site VPN with Ping Work between EdgeRouter #1, EdgeRouter #2, and Debian 12 VM
In this article, we will discuss the steps required to set up a StrongSwan site-to-site VPN with ping work between three nodes: EdgeRouter #1, EdgeRouter #2, and a Debian 12 VM. We will cover the key concepts and provide detailed instructions using subtitles, paragraphs, and code blocks where necessary.
Prerequisites
Before we begin, it is assumed that you have the following:
- Three nodes with public and local IP addresses:
- Node A: EdgeRouter #1 with IP addresses 10.41.1.0/24
- Node B: EdgeRouter #2 with IP addresses 10.48.2.0/24
- Node C: Debian 12 VM with firewall enabled (e.g., ufw or firewalld)
Installing StrongSwan on EdgeRouter #1 and EdgeRouter #2
To install StrongSwan on EdgeRouter #1 and EdgeRouter #2, follow these steps:
- Connect to the EdgeRouter via SSH.
- Run the following command to install StrongSwan:
sudo apt-get update && sudo apt-get install strongswan
Configuring EdgeRouter #1
To configure EdgeRouter #1, follow these steps:
- Create a new StrongSwan connection by editing the
/etc/ipsec.conffile:
sudo nano /etc/ipsec.conf
Add the following configuration:
config setup
strictcrlpolicy=no
uniqueids=no
conn %default
keyexchange=ikev2
ikelifetime=24h
rekey=no
left=%any
leftid=10.41.1.0
leftcert=server-cert.pem
leftsendcert=always
leftsubnet=10.41.1.0/24
right=%any
rightid=%any
rightauth=eap-radius
rightsourceip=10.42.1.0/24
rightdns=8.8.8.8,8.8.4.4
rightsubnet=0.0.0.0/0
eap_identity=%identity
auto=add
Save and close the file.
- Create a new CA certificate by running the following command:
sudo openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 3650 -nodes
Enter the required information when prompted.
- Create a new server certificate by running the following command:
sudo openssl req -newkey rsa:4096 -nodes -keyout key.pem -out req.pem
Enter the required information when prompted.
- Sign the server certificate using the CA certificate:
sudo openssl x509 -req -in req.pem -CA cert.pem -CAkey key.pem -CAcreateserial -out server-cert.pem -days 3650
Save the certificate files in a secure location.
Configuring EdgeRouter #2
To configure EdgeRouter #2, follow these steps:
- Create a new StrongSwan connection by editing the
/etc/ipsec.conffile:
sudo nano /etc/ipsec.conf
Add the following configuration:
config setup
strictcrlpolicy=no
uniqueids=no
conn %default
keyexchange=ikev2
ikelifetime=24h
rekey=no
left=%any
leftid=10.48.2.0
leftcert=server-cert.pem
leftsendcert=always
leftsubnet=10.48.2.0/24
right=%any
rightid=%any
rightauth=eap-radius
rightsourceip=10.42.2.0/24
rightdns=8.8.8.8,8.8.4.4
rightsubnet=0.0.0.0/0
eap_identity=%identity
auto=add
Save and close the file.
- Transfer the CA and server certificates from EdgeRouter #1 to EdgeRouter #2.
Configuring Debian 12 VM
To configure Debian 12 VM, follow these steps:
- Install StrongSwan by running the following command:
sudo apt-get update && sudo apt-get install strongswan
- Edit the
/etc/ipsec.conffile:
sudo nano /etc/ipsec.conf
Add the following configuration:
config setup
strictcrlpolicy=no
uniqueids=no
conn %default
keyexchange=ikev2
ikelifetime=24h
rekey=no
left=%any
leftid=10.42.1.0
leftcert=client-cert.pem
leftsendcert=always
leftsubnet=10.42.1.0/24
right=%any
rightid=10.41.1.0
rightauth=eap-radius
rightsourceip=10.41.2.0/24
rightdns=8.8.8.8,8.8.4.4
rightsubnet=0.0.0.0/0
eap_identity=%identity
auto=add
Save and close the file.
- Create a new CA certificate by running the following command:
sudo openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 3650 -nodes
Enter the required information when prompted.
- Create a new client certificate by running the following command:
sudo openssl req -newkey rsa:4096 -nodes -keyout key.pem -out req.pem
Enter the required information when prompted.
- Sign the client certificate using the CA certificate:
sudo openssl x509 -req -in req.pem -CA cert.pem -CAkey key.pem -CAcreateserial -out client-cert.pem -days 3650
Save the certificate files in a secure location.
Testing the VPN Connection
To test the VPN connection, run the following command on Debian 12 VM:
sudo ipsec up debian12-server
You should see a message indicating that the VPN connection has been established.
To test the ping work, run the following command on Debian 12 VM:
ping -c 4 10.41.2.1
You should see four successful ping responses.
In this article, we have discussed the steps required to set up a StrongSwan site-to-site VPN with ping work between three nodes: EdgeRouter #1, EdgeRouter #2, and a Debian 12 VM. We have covered the key concepts and provided detailed instructions using subtitles, paragraphs, and code blocks where necessary.
References
- StrongSwan documentation: https://wiki.strongswan.org/projects/strongswan/wiki/Ikev2Eap
- EdgeRouter documentation: https://help.ui.com/hc/en-us/categories/200169143-EdgeRouter
- Debian documentation: https://wiki.debian.org/StrongSwan