Setting up a StrongSwan Site-to-Site Connection: Making PING work between Debian 12 and Two Edge Routers
In this article, we will discuss how to set up a StrongSwan site-to-site connection between two edge routers and a Debian 12 virtual machine or Docker container with firewalld. We will cover the key concepts of IPsec, StrongSwan, and firewalld, and provide step-by-step instructions to configure the connection and make PING work.
Prerequisites
- Three nodes with public IP addresses
- Edge Router #1 with IP address 10.41.1.0/24
- Edge Router #2 with IP address 10.48.2.0/24
- Debian 12 virtual machine or Docker container with firewalld
IPsec and StrongSwan
IPsec (Internet Protocol Security) is a set of protocols that provide secure communication over IP networks. It is used to protect data in transit between two or more devices by encrypting and authenticating the data. StrongSwan is an open-source IPsec implementation that provides a robust and flexible solution for setting up IPsec connections.
Firewalld
Firewalld is a firewall management tool for Linux systems that provides a dynamic firewall configuration. It uses the concept of firewall zones to define the security policies for different network interfaces. Firewalld can be used to configure the firewall rules for IPsec connections.
Setting up the StrongSwan Site-to-Site Connection
To set up the StrongSwan site-to-site connection, we need to perform the following steps:
- Configure the IPsec connection on Edge Router #1
- Configure the IPsec connection on Edge Router #2
- Configure the firewall rules on Debian 12
Configure the IPsec Connection on Edge Router #1
First, we need to configure the IPsec connection on Edge Router #1. To do this, we need to perform the following steps:
- Generate the IPsec configuration file
- Configure the IPsec connection parameters
- Start the IPsec service
Generate the IPsec Configuration File
To generate the IPsec configuration file, we need to run the following command:
sudo nano /etc/ipsec.conf
This will open the IPsec configuration file in the nano text editor. We need to add the following configuration to the file:
config setup
strictcrlpolicy=no
uniqueids = no
conn %default
keyexchange=ikev2
ikelifetime=24h
ikelifetime=24h
esp=aes256gcm16-ecp384,aes256-sha2_256,aes256-sha1,3des-sha1!
rekey=no
conn myconn
left=%any
leftid=10.41.1.0
leftsourceip=10.41.1.0
leftfirewall=yes
leftauth=eap-radius
leftauth2=psk
leftprotoport=udp/1701
right=%any
rightid=%any
rightauth=eap-radius
rightauth2=psk
rightprotoport=udp/1701
auto=add
This configuration defines the IPsec connection parameters for Edge Router #1. The left parameters define the configuration for the local network, and the right parameters define the configuration for the remote network. We have defined the authentication method as EAP-Radius and pre-shared key (PSK).
Configure the IPsec Connection Parameters
Next, we need to configure the IPsec connection parameters. To do this, we need to edit the /etc/ipsec.secrets file and add the following configuration:
10.41.1.0 : PSK "mysecret"
This configuration defines the pre-shared key (PSK) for the IPsec connection. We need to replace "mysecret" with the actual pre-shared key.
Start the IPsec Service
Finally, we need to start the IPsec service. To do this, we need to run the following command:
sudo systemctl start ipsec
This will start the IPsec service and establish the IPsec connection between Edge Router #1 and Edge Router #2.
Configure the IPsec Connection on Edge Router #2
Next, we need to configure the IPsec connection on Edge Router #2. To do this, we need to perform the following steps:
- Generate the IPsec configuration file
- Configure the IPsec connection parameters
- Start the IPsec service
The configuration for Edge Router #2 is similar to the configuration for Edge Router #1. We need to replace the left and right parameters in the IPsec configuration file and the leftid parameter in the /etc/ipsec.secrets file with the appropriate values for Edge Router #2.
Configure the Firewall Rules on Debian 12
Finally, we need to configure the firewall rules on Debian 12. To do this, we need to perform the following steps:
- Add the IPsec interface to the firewall zone
- Allow traffic to the IPsec interface
- Allow traffic from the IPsec interface
Add the IPsec Interface to the Firewall Zone
To add the IPsec interface to the firewall zone, we need to run the following command:
sudo firewall-cmd --permanent --zone=public --add-interface=ipsec0
This will add the IPsec interface to the public firewall zone.
Allow Traffic to the IPsec Interface
Next, we need to allow traffic to the IPsec interface. To do this, we need to run the following command:
sudo firewall-cmd --permanent --zone=public --add-service=ipsec
This will allow traffic to the IPsec interface.
Allow Traffic from the IPsec Interface
Finally, we need to allow traffic from the IPsec interface. To do this, we need to run the following command:
sudo firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 "-i ipsec0 -j ACCEPT"
This will allow traffic from the IPsec interface.
Testing the Connection
To test the connection, we can use the PING command. We can run the following command on Debian 12:
ping 10.41.1.1
This should send a PING request to Edge Router #1 and receive a response. If the PING request fails, we need to check the IPsec and firewall configuration and make sure that the configuration is correct.
- We have discussed how to set up a StrongSwan site-to-site connection between two edge routers and a Debian 12 virtual machine or Docker container with firewalld.
- We have covered the key concepts of IPsec, StrongSwan, and firewalld, and provided step-by-step instructions to configure the connection and make PING work.
- We have provided code blocks for the IPsec configuration files and firewall rules.
References
- IPsec:
- StrongSwan:
- Firewalld: