Skip to content

Posts categoriezed as Uncategorized

IKEv2 with Let’s Encrypt- robust IPsec vpn solution for Windows, Android, Linux, macOS and iOS clients

IKEv2 with Let’s Encrypt- robust IPsec vpn solution for Windows, Android, Linux, macOS and iOS clients published on No Comments on IKEv2 with Let’s Encrypt- robust IPsec vpn solution for Windows, Android, Linux, macOS and iOS clients

Hello 🙂

In this post I will describe how to prepare solid vpn gateway which works flawlessly with many different clients.

I choose the solution based on modern IKEv2 protocol created with Microsoft and Cisco together. In a big simplification – IKEv2 (Internet Key Exchange version 2) is responsible to set up a security association (SA) in the IPsec protocol suite.

Advantages of IKEv2 over IKEv1 protocol:

  • it tolerates interruptions, latency etc. on network connection. For example, if the connection is temporarily lost, or if a user moves a client computer from one network to another, IKEv2 automatically restores the VPN after the network connection is reestablished — in transparent way to the user.
  • EAP authentication – we can authenticate simply, by username and password
  • better dead peer/tunnel detection
  • consume less bandwidth

IKEv2 has built in client in Windows 7 and newer and on macOS and iOS systems.
For Android there is a StrongSwan client app which is working very well. In Linux we can simply use Strongswan which is one of IPsec implementation for Linux.

In setup below I will use certificate for server obtained from Let’s Encrypt. It is needed because Windows clients will not work with self signed certificate without adding our CA as trusted. My goal is that we don’t have to provide anything other then user name and password 🙂

I will skip the part describing an obtaining a certificate from Let’s Encrypt. It is well documented in internet.
For server/gateway side I used Strongswan which provides support for IKEv2.

Server configuration

For setup server side we have to:
Install Strongswan:
(I’m installing it on OpenSUSE)

or if you using Debian based Linux distribution

I already have a certificate Let’s Encrypt for my domain. The typical catalog structure with the certificates from Let’s Encrypt looks as follows:

To use it in Strongswan it is necessary to create links to certificates and keys:

W need to provide Let’s Encrypt intermediate certificate:

This is very important step, I was spent a lot of hours to discover that Windows works properly only if we are providing intermediate certificate. Other CA certs in /etc/ipsec.d/cacerts/ , especially self-signed may also causing problems

Now we can edit /etc/ipsec.conf
My configuration looks as follows:

After that we have to add private key (/etc/ipsec.d/private/privkey.pem) and define usernames and passwords for vpn clients.

This is the whole Strongswan configuration. To apply configuration Strongswan must be restarted:

If don’t have configured NAT/masquerade your clients will not have internet.

If you want allow your clients access to the internet, you have to enable nat/masquerade

In some cases there is a problem with mtu/mss which can cause for example problem with opening some web pages. Strongswan documentation recommends reduce the MSS for packets transmitded through tunnel. Strongswan documentation
To reduce the mss, add a rule to iptables:

From my observations, reducing mss to 1200 ensures trouble-free operation on all clients

Clients configuration

In most clients it is trivial.
Windows

Android

iPhone – iOS

macOS
Very simple configuration, analogous to iOS/iPhone

Linux
Unfortunately, manual configuration is slightly complicated. But then it works very well.
In newer releases of Linux distribution there is a gui plugin for network manager which provide easy configuration of vpn connection. But I haven’t tried it.

Strongswan configuration: /etc/ipsec.conf

password for user1 i stored in /etc/ipsec.secret:

We have to had intermediate and CA root certyficate in /etc/ipsec.d/cacerts:
intermediate:

root CA certificate is available to copy from  DST Root CA X3
I had to copy it to a file in such way (with adding “—–BEGIN CERTIFICATE—–” and “—–END CERTIFICATE—–“:

In the default configuration, strongswan does not set the dns addresses provided by the server. This behavior can be changed by editing /etc/strongswan.d/charon/resolv.conf. I uncommented line with “file = /etc/resolv.conf”

Restart Strongswan:

And connection should be start:

We can check connection status:

And disconnect connection:

[Update 21.12.2018]

Carsten who reads this post shared with me some observations with configuring IKEv2 connections on Windows clients.

In more sophisticated scenario, than described here when we don’t want to set vpn connection as default gateway for clients (redirect all trafic to vpn tunnel), but we want use vpn connection only for some specified remote networks then Windows client is a problem.
Windows has no support for traffic selector provided by strongSwan.
Carsten writes:

  • The VPN LAN should be different to the remote LAN.
  • Therefore in Windows “Use default gateway on remote network” must be set.
  • Therefore “leftsubnet=0.0.0.0/0” is necessary, because all traffic of the client goes through the VPN (which is not nice).
  • Without “Use default gateway on remote network” Windows only sets a route for the VPN LAN, which is useless. It should be possible to set a route to the remote LAN by using the PowerShell. I haven’t tried that yet.

This problem is also described here

Thanks Carsten for sharing your observations.

Esp8266 – log temperature readings from DS18B20 and wifi signal strength to graphite grafana

Esp8266 – log temperature readings from DS18B20 and wifi signal strength to graphite grafana published on 3 Comments on Esp8266 – log temperature readings from DS18B20 and wifi signal strength to graphite grafana

Hello!
Recently I bought esp8266 (NodeMcu) – it is a low cost device with wifi chip, that can be programmed by Arduino IDE or Lua script language.

My first idea for this device is to draw graphs of temperature readings from ds18b20 sensor and signal strength on wifi connection for each SSID with which the device can connect. For logging I have raspberry pi configured with graphite server and Grafana. To log something on graphite server the esp8266 have to send UDP packet with string containg: metric name, metric value, timestamp. Bellow expample of such strings:

Charts in Grafana:
And the code doing this looks as follows:

Libraries used in this code (DallasTemperature and OneWire):
libraries.zip
You can download this through library manager from Arduino IDE.