#openswan

Una VPN o Virtual Private Network è una rete all’interno di un’altra rete.

Le VPN vengono utilizzate principalmente per trasferire i dati su una rete privata che viaggia all’interno di una rete pubblica, come Internet.

(more…)

New Post has been published on http://blog.seabow.pe.kr/?p=7102

(RHEL)sosreport 실행시 iptables(nf_conntrack) 룰이 활성화 되는 문제

문제 : RHEL6 에서 sosreport 를 실행 시킬경우 iptables 이 활성화 되면서 최악의 경우엔 /var/log/messages 파일 에아래와 같은 메시지가 발생.

내용 : 

“nf_conntrack: table full, dropping packet” <== 해당 메시지

위 메시지로만 보면 nf_contrack table 이 Full 이 되어 packet drop 이 발생된다는 내용으로 사용자는 iptables 를 활성화 한 적이 없으나? 

왜? iptables 이 활성화 되고 “nf_conntrack: table full, dropping packet” 메시지가 발생 되는지?

이해하기 힘들 것이다.

관련 내용을 찾아 보던 중 RHE6.4 에서 관련 Bug 가 확인 되었다. Link : https://bugzilla.redhat.com/show_bug.cgi?id=980390

 RHEL6.4 환경에서 openswan 패키지가 설치되어 있고 sosreport 를 실행하게되면 sosreport 의 openswan plugin 이 실행 되면서 iptables 이 활성화 되는 문제점.

관련 내용은 위의 bugzilla 를 참고.

해결 발법 : 

1. openswan 패키지 삭제 

해당 패키지가 설치되어 있는 환경에서 sosreport 실행될때 iptables 작동으로 인한 nf_conntrack 모듈이 활성화 됨.

  방법 : 

# rpm -e openswan-xxx

  *) 해당 시스템에서 해당 패키지 사용 여부 확인 후 조치 필요

  2. sos 패키지 업데이트

Link : https://bugzilla.redhat.com/show_bug.cgi?id=980390

  위 버그에 의해서 openswan 이 설치되어 있는 환경에서 sosreport 를 수행하게되면 iptables 가 작동되어 nf_conntrack 모듈이 활성화 됨.

  방법 : 

# rpm -Uvh sos-xxx.rpm

  3. /etc/sos.conf 상에 openswan plugin 비 활성화

sosreport 수행할 때 openswan plugin 을 수행하지 않도록 조치

  방법 : 

# vi /etc/sos.conf [plugins] disable = <pluginA>, <pluginB>, <pluginC>

확인 :

# sosreport --list-plugin

  Link : https://access.redhat.com/solutions/900583

  4. nf_conntrack 모듈을 blacklist 처리

  해당 모듈을 지속적으로 활성화 되지 않도록 조치

    # vi /etc/modprobe.d/blacklist.conf

  ~~~ 생략

install nf_conntrack /bin/false  <=== 끝에 추가

  관련 KBase 는 다음과 같습니다.

  How do I blacklist a kernel module to prevent it from loading automatically?

UPDATE: This now works on CentOS/RHEL too!

There's a great gist out there on the interwebs by Lin Song (aka hwdsl2) that installs an IPSec/L2TP VPN but it requires you to compile Libreswan. I'm not really into installing development tools on my VPSes, though.

Luckily the Libreswan guys (and gals) uploaded a few binaries for select OSes on their website! Debian Wheezy (Debian stable) is one of those select systems.

I just spent the last two days writing/perfecting this install script l2tp-install.sh. It would've taken me a lot less time, but late last night I realized that Openswan was no longer actively developed. :OOps! ;)

It works/ was tested on DigitalOcean's 64bit Debian 7 VPSes too, which is nice.

Anyway, check it out and let me know if it works/fails.

First update (and restart if you installed a new kernel) your VPS. apt-get update && apt-get upgrade shutdown -r now

Once you're logged back in clone my gist. git clone https://gist.github.com/77810e0af65594a2a26e.git cd 77810e0af65594a2a26e

If you're not using DigitalOcean, or are behind a NAT router you might need to manually set $PUBLIC_IP and $PRIVATE_IP.

nano +37 l2tp-install.sh

PUBLIC_IP="IP Provided by ISP" PRIVATE_IP="192.168.1.22"

Now, just make the script executable and run it.

chmod +x l2tp-install.sh ./l2tp-install.sh

Usage: ./l2tp-install.sh [OPTION...] Install and configure IPSec/L2TP VPN on Debian Wheezy (or Debian-like OS with modifications) install - install packages backups - backup (default|current) configuration config - update configuration restart - restart daemons print - print configuration wrapper - run all at once (only if each exists successfully)

I've been having problems with the Libreswan install script crashing so if you encounter something like this:

... Selecting previously unselected package libreswan. (Reading database ... 26559 files and directories currently installed.) Unpacking libreswan (from libreswan_3.12~3-gdd6f200-deb_amd64.deb) ... Setting up libreswan (1:3.12~3-gdd6f200-deb) ... Starting pluto IKE daemon for IPsec: Message from syslogd@test0 at Nov 23 18:37:08 ... kernel:[ 74.379506] Oops: 0000 [#1] SMP Message from syslogd@test0 at Nov 23 18:37:08 ... kernel:[ 74.380615] Stack: Message from syslogd@test0 at Nov 23 18:37:08 ... kernel:[ 74.380615] Call Trace: Message from syslogd@test0 at Nov 23 18:37:08 ... kernel:[ 74.380615] Code: 4d 31 da 44 0f b6 5e 01 49 c1 e2 05 4d 31 da 44 0f b6 1e 49 c1 e2 05 4d 31 da 4d 6b fa 21 49 c1 ef 05 4c 89 fd 81 e5 ff 3f 00 00 <4d> 8b 14 e8 49 39 fa 72 6f 4c 39 d6 74 6a 49 89 f3 4d 29 d3 49 Message from syslogd@test0 at Nov 23 18:37:08 ... kernel:[ 74.380615] CR2: ffffc900001684a0

Break out of the script (with CTRL+C) and then re-run the configure script. dpkg --configure libreswan

Now, you can continue with the installation process. ./l2tp-install.sh backups && ./l2tp-install.sh config && ./l2tp-install.sh restart && ./l2tp-install.sh print

If this is a fresh Debian install, you'll need to add users. adduser <username>

To configure your devices to use the IPSec/L2TP VPN you'll need the information outputted by the print parameter of my script. ./l2tp-install.sh print

IP Address: 10.236.3.217 PRE SHARED KEY: 37458FB7E5F907F5FF2AA057BD91FF18DB08B739B4C1F15C0806DDA52499F4BA User/Password: All users on system. to see users: /etc/passwd to add users: `man adduser`

For you road warriors who wish to set up their own VPN to secure their traffic when using any untrusted/unprotected networks ("free" WiFi?) when travelling, this would be the thing you use: a trusted VPN setup.

I recently bought a Zywall 2 for my home office, and tried to set up a VPN connection using OpenSwan. Quite a lot of research later it was done. To prevent others from searching, I decided to put together a short guide.

First of all you need to configure the Zywall and set up an incoming VPN connection there:

Select "Security" -> "VPN" in the left menu

Add a new Gateway Policy by clicking on the "Add Gateway Policy" icon (two little routers with a plus sign)

Fill in the details as shown on the image below, however of course you should fill in your own Pre-Shared-Key (which is empty here, guess why...).

Now that we have the Gateway Policy, all we need to add is a Network Policy:

Go back to "Security" -> "VPN" (left menu)

Next to your added Gateway Policy you will find an icon with two small clouds and a plus sign ("Add Network Policy"), click on it.

Change all settings as shown in the image below. Make sure you have set the correct internal networking address.

Now the Zywall is set up and ready to handle an incoming VPN connection.

All we still need to do is configure the OpenSwan at our Linux system. Basically this is done using two files: /etc/ipsec.conf and /etc/ipsec.secrets !

Here is the listing of my ipsec.conf:

conn zywall-psk         authby=secret         pfs=yes         type=tunnel         auth=esp         aggrmode=no         disablearrivalcheck=no         # Local         left=1.1.1.1         leftid=%defaultroute         # Remote (Distant)         right=1.1.1.1         rightid=1.1.1.1         rightsubnet=192.168.1.0/24         auto=start

In fact only four values need to be modified for you: left, right, rightid and rightsubnet.

left: always fill in the local IP address of the interface you are trying to connect from. This always has to be changed when your IP changes.

right: fill in the WAN IP of your router

rightid: same as "right", fill in the WAN IP of your router

rightsubnet: Fill in the details of the network you have in your home-LAN.

One more thing is still missing, the Pre-Shared-Key. This has to be added in the /etc/ipsec.secrets file. Just add the following line to it:

: PSK "YOUR_PRE_SHARED_KEY_GOES_HERE"

Note: the ':' is by intention. This way your PSK will be used for any connection, so this only works if you have one. If you have more than one connection configured, you need to specify the IP-Addresses before the ':'.

Now we are done, start your VPN connection by running /etc/init.d/ipsec start.