VPS IPsec VPN using StrongSwan: NAT Traffic Forwarding
In this article, we will discuss how to set up an IPsec VPN using StrongSwan, allowing traffic to be forwarded from a VPS (Virtual Private Server) to a partner network with a NAT (Network Address Translation) address. The focus will be on providing a detailed context of the topic, covering key concepts and subtitles.
Table of Contents
Prerequisites
Before we begin, it is assumed that you have a VPS with a public IP address and a partner network with a NAT address. Additionally, you have administrative access to both networks and are familiar with Linux command line and networking concepts.
NAT Traversal
NAT Traversal is a technique used to establish IPsec connections between two networks that are separated by NAT devices. StrongSwan uses the IKE (Internet Key Exchange) protocol to negotiate the IPsec security associations and handles NAT traversal automatically using the NAT-T (NAT Traversal) extension.
IPsec Configuration
To configure IPsec using StrongSwan, you need to create a configuration file that defines the connection parameters. The following is an example configuration file:
config setup
conn %default
ike = aes256gcm16-prfsha384-ecp521!
esp = aes256gcm16-ecp521!
keyexchange = ikev2
dpdaction = clear
dpddelay = 30s
rekey = no
conn vpn-to-partner
left = %any
leftid = @vpn.example.com
leftcert = vpn.example.com.cert
leftsubnet = 0.0.0.0/0
right = 192.168.0.0/16
rightid = @partner.example.com
rightcert = partner.example.com.cert
rightsourceip = 10.0.0.0/24
auto = start
In this example, the configuration defines a connection named "vpn-to-partner" between two networks. The left network is the VPS, and the right network is the partner network. The left and right subnets are defined using CIDR notation, and the left and right certificates are used for authentication.
Forwarding Configuration
To forward traffic between the VPS and the partner network, you need to enable IP forwarding and configure the firewall rules. The following is an example configuration:
# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# Configure firewall rules
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT
In this example, the first command enables IP forwarding. The second command uses the MASQUERADE target to translate the source address of outgoing packets to the VPS's public IP address. The last two commands allow incoming and outgoing traffic between the VPS and the partner network.
Testing
To test the IPsec VPN, you can use the following command:
ipsec statusall
If the VPN is established successfully, you should see a message similar to the following:
Security Associations (1 up, 0 connecting):
vpn-to-partner[1]: ESTABLISHED 20 minutes ago, 10.0.0.1[vpn.example.com]...192.168.0.2[partner.example.com]
vpn-to-partner[1]: IKEv2 SPIs: 36d26e8f2d6f5e2a\_i 6a9e6e102f0a7e2c\_r, rekeying in 16 minutes
vpn-to-partner[1]: IKEv2 PSK key, pre-shared key reauthentication in 16 minutes
vpn-to-partner[1]: CHILD\_SA vpn-to-partner{1}:
vpn-to-partner{1}: ESP spi in iv: 0000000000000000\_i 0000000000000000\_o,
vpn-to-partner{1}: ESP spi out iv: 0000000000000000\_i 0000000000000000\_o
vpn-to-partner{1}: AES_GCM_16\_256/ECP\_521 encrypt+auth,
vpn-to-partner{1}: 10.0.0.0/24 - 192.168.0.0/16 in UDP 500, IPsec
vpn-to-partner{1}: 10.0.0.0/24 - 192.168.0.0/16 in ESP 50, IPsec
You can also test the traffic forwarding by pinging a host on the partner network from the VPS or vice versa.
References
The following are some references used in this article:
Types of references:
- Online resources