StrongSwan: Difference between revisions

Line 1:

strongSwan is a VPN server that allows a connection over the insecure internet to a secure private network. The connection is encrypted and authenticated for confidentiality and to prevent tampering of the data. It allows the following:

* Secure internet browsing over an insecure, open Wi-Fi connection.

* Secure internet browsing, for example, over an insecure, open Wi-Fi connection.

* Allows full access to your internal network securely over the insecure internet.

We will be setting up the connection to allow a connection from this server to a Windows 10 ~~1803~~ (~~Spring Creators~~ Update) client. Windows 10 ~~1803~~ supports the Internet Key Exchange v2 (IKEv2), which is a modern VPN protocol and has some provisions for working over the internet, such as MOBIKE. This helps in situations where the internet connection maybe poor and has to reconnect. Windows 10 ~~1803~~ supports the use of the following modern ciphers:

We will be setting up the connection to allow a connection from this server to a Windows 10 1809 (October 2018 Update) client. Windows 10 1809 supports the Internet Key Exchange v2 (IKEv2), which is a modern VPN protocol and has some provisions for working over the internet, such as MOBIKE. This helps in situations where the internet connection maybe poor and has to reconnect. Windows 10 1809 supports the use of the following modern ciphers:

* Certificate authentication.

Line 12:

We will be configuring our connection to use ECDSA 384-bit certificates and AES256-GCM encryption/authentication, currently the strongest supported settings.

Note that Windows initially uses '''VERY''' weak encryption and authentication schemes by default (from the Windows 2000 days) so it is very important to set up the connection correctly and not use the default Windows settings.

Note that Windows initially uses '''VERY''' weak encryption (3DES) and authentication schemes by default (from the Windows 2000 days) so it is very important to set up the connection correctly and not use the default Windows settings.

strongSwan 5.6.0 in [[openSUSE Leap 15.0]] were used as the basis for this guide.

We will be using the modern strongSwan VICI backend, not the old stroke backend as strongSwan is starting to phase this method out.

Commands under Windows with the [[File:Administrator_Shield.png]] icon may need administrator credentials to complete them.

= ~~What is~~ needed =

= Packages needed =

Make sure the following packages is installed:

Make sure the following packages are installed:

* <code>strongswan</code>

* <code>openssl</code>

~~Allow~~ any dependencies the packages asks for.

These packages are usually installed by default in an normal setup. If installing, allow any dependencies the packages asks for.

IKEv2 requires port 500 and 4500 to be port forwarded/opened in the firewall/router.

Remove the following packages:

* <code>firewalld</code>

~~IKEv2 requires port 500 and 4500 to~~ be ~~port forwarded~~/~~opened in~~ the firewall.

As this is a system package, restart the computer afterwards. We will be using <code>iptables</code> to manipulate the traffic, not <code>firewalld</code> as we don't run a firewall at the server level, it is run futher up. It can be configured through the SuSEFirewall2 but we do not use this so additional research would be required.

= Creating the certificates =

Line 33:

Line 41:

IKEv2 can use a Username/Pre-shared Key (PSK) for authentication. This is a very weak method of authenticating and is easily brute-forced. Certificates, especially when created correctly, are the strongest possible way to authenticate.

We will be creating modern, elliptic curve certificates. These use very short keys (384-bits) compared to RSA keys (4096-bits) but provide the same ~~amount of~~ security.

We will be creating modern, elliptic curve certificates. These use very short keys (384-bits) compared to RSA keys (4096-bits) but provide the same or better security.

== Initial setup ==

# As most of this work will require root privileges, open a Terminal and elevate to root by typing <code>su</code>. Type the root user password.

# Move to the correct path. If strongSwan is installed correctly, you should be able to type <code>cd /etc/~~ipsec.d~~</code>. This is strongSwan's PKI directory.

# Move to the correct path. If strongSwan is installed correctly, you should be able to type <code>cd /etc/swanctl</code>. This is strongSwan's PKI directory.

== Creating a self-signed certificate authority (CA) ==

Line 46:

Line 54:

# Make sure you are in the correct directory above.

# Generate a private key for the CA:

#:<pre>ipsec pki --gen --type ecdsa --size 384 --outform pem > private/CAkey.pem</pre>

#:<pre>ipsec pki --gen --type ecdsa --size 384 --lifetime 3650 --outform pem > private/CAkey.pem</pre>

# Change the permissions of the private key, so that only root can access it:

#:<pre>chmod 600 private/CAkey.pem</pre>

# Now we have the private key, generate the CA certificate:

#:<pre>ipsec pki --self --ca --lifetime 3650 --in private/CAkey.pem --type ecdsa --dn "C=GB, O=strongSwan, CN=strongSwan ~~Root~~ CA" --outform pem > cacerts/CAcert.pem</pre>

#:<pre>ipsec pki --self --ca --lifetime 3650 --in private/CAkey.pem --type ecdsa --dn "C=GB, O=strongSwan, CN=strongSwan CA" --outform pem > cacerts/CAcert.pem</pre>

You now have a self-signed CA certificate, ready to sign any certificates to be used by the VPN server.

Line 64:

Line 72:

#:<pre>chmod 600 private/serverkey.pem</pre>

# Now we have the private key, generate the server certificate:

#:<pre>ipsec pki --pub --in private/serverkey.pem --type ecdsa | ipsec pki --issue --lifetime 365 --cacert cacerts/CAcert.pem --cakey private/CAkey.pem --dn "C=GB, O=strongSwan, CN=thinkserver.freddythechick.uk" --san thinkserver.freddythechick.uk --flag serverAuth --outform pem > certs/servercert.pem</pre>

#:<pre>ipsec pki --pub --in private/serverkey.pem --type ecdsa | ipsec pki --issue --lifetime 365 --cacert cacerts/CAcert.pem --cakey private/CAkey.pem --dn "C=GB, O=strongSwan, CN=thinkserver.freddythechick.net" --san thinkserver.freddythechick.net --flag serverAuth --flag ikeIntermediate --outform pem > certs/servercert.pem</pre>

The certificate created will be used to authenticate the VPN server. Only one needs creating.

Line 70:

Line 78:

'''IMPORTANT NOTES'''

When customising to fit your server, certain parts of the certificate generation must be done correctly for Windows to allow the certificate to be used. If not done correctly, Windows will refuse to connect. It is advisable to make sure these are correct in the first place to avoid errors further down the line and painstaking troubleshooting.

When customising to fit your server, certain parts of the server certificate generation must be done correctly for Windows to allow the certificate to be used. If not done correctly, Windows will refuse to connect. It is advisable to make sure these are correct in the first place to avoid errors further down the line and painstaking troubleshooting.

* The Common Name (<code>CN</code>) part of the Distinguishable Name (DN) '''MUST''' be the DNS resolvable name you will be using to connect to the VPN server from Windows.

* The SAN '''MUST''' also be the DNS resolvable name you will be using to connect to the VPN server from Windows. It '''MUST''' also match the <code>CN</code> from the DN.

* It '''MUST''' contain the <code>serverAuth</code> flag.

* It '''MUST''' contain the <code>serverAuth</code> flag. the <code>ikeIntermediate</code> is included for compatibility with MacOS and doesn't affect a Windows installation so is safe to add.

== Creating a certificate for clients ==

@@ Line 1: / Line 1: @@
 strongSwan is a VPN server that allows a connection over the insecure internet to a secure private network. The connection is encrypted and authenticated for confidentiality and to prevent tampering of the data. It allows the following:
-* Secure internet browsing over an insecure, open Wi-Fi connection.
+* Secure internet browsing, for example, over an insecure, open Wi-Fi connection.
 * Allows full access to your internal network securely over the insecure internet.
-We will be setting up the connection to allow a connection from this server to a Windows 10 1803 (Spring Creators Update) client. Windows 10 1803 supports the Internet Key Exchange v2 (IKEv2), which is a modern VPN protocol and has some provisions for working over the internet, such as MOBIKE. This helps in situations where the internet connection maybe poor and has to reconnect. Windows 10 1803 supports the use of the following modern ciphers:
+We will be setting up the connection to allow a connection from this server to a Windows 10 1809 (October 2018 Update) client. Windows 10 1809 supports the Internet Key Exchange v2 (IKEv2), which is a modern VPN protocol and has some provisions for working over the internet, such as MOBIKE. This helps in situations where the internet connection maybe poor and has to reconnect. Windows 10 1809 supports the use of the following modern ciphers:
 * Certificate authentication.
@@ Line 12: / Line 12: @@
 We will be configuring our connection to use ECDSA 384-bit certificates and AES256-GCM encryption/authentication, currently the strongest supported settings.
-Note that Windows initially uses '''VERY''' weak encryption and authentication schemes by default (from the Windows 2000 days) so it is very important to set up the connection correctly and not use the default Windows settings.
+Note that Windows initially uses '''VERY''' weak encryption (3DES) and authentication schemes by default (from the Windows 2000 days) so it is very important to set up the connection correctly and not use the default Windows settings.
 strongSwan 5.6.0 in [[openSUSE Leap 15.0]] were used as the basis for this guide.
+We will be using the modern strongSwan VICI backend, not the old stroke backend as strongSwan is starting to phase this method out.
 Commands under Windows with the [[File:Administrator_Shield.png]] icon may need administrator credentials to complete them.
-= What is needed =
+= Packages needed =
-Make sure the following packages is installed:
+Make sure the following packages are installed:
 * <code>strongswan</code>
 * <code>openssl</code>
-Allow any dependencies the packages asks for.
+These packages are usually installed by default in an normal setup. If installing, allow any dependencies the packages asks for.
+IKEv2 requires port 500 and 4500 to be port forwarded/opened in the firewall/router.
+Remove the following packages:
+* <code>firewalld</code>
-IKEv2 requires port 500 and 4500 to be port forwarded/opened in the firewall.
+As this is a system package, restart the computer afterwards. We will be using <code>iptables</code> to manipulate the traffic, not <code>firewalld</code> as we don't run a firewall at the server level, it is run futher up. It can be configured through the SuSEFirewall2 but we do not use this so additional research would be required.
 = Creating the certificates =
@@ Line 33: / Line 41: @@
 IKEv2 can use a Username/Pre-shared Key (PSK) for authentication. This is a very weak method of authenticating and is easily brute-forced. Certificates, especially when created correctly, are the strongest possible way to authenticate.
-We will be creating modern, elliptic curve certificates. These use very short keys (384-bits) compared to RSA keys (4096-bits) but provide the same amount of security.
+We will be creating modern, elliptic curve certificates. These use very short keys (384-bits) compared to RSA keys (4096-bits) but provide the same or better security.
 == Initial setup ==
 # As most of this work will require root privileges, open a Terminal and elevate to root by typing <code>su</code>. Type the root user password.
-# Move to the correct path. If strongSwan is installed correctly, you should be able to type <code>cd /etc/ipsec.d</code>. This is strongSwan's PKI directory.
+# Move to the correct path. If strongSwan is installed correctly, you should be able to type <code>cd /etc/swanctl</code>. This is strongSwan's PKI directory.
 == Creating a self-signed certificate authority (CA) ==
@@ Line 46: / Line 54: @@
 # Make sure you are in the correct directory above.
 # Generate a private key for the CA:
-#:<pre>ipsec pki --gen --type ecdsa --size 384 --outform pem > private/CAkey.pem</pre>
+#:<pre>ipsec pki --gen --type ecdsa --size 384 --lifetime 3650 --outform pem > private/CAkey.pem</pre>
 # Change the permissions of the private key, so that only root can access it:
 #:<pre>chmod 600 private/CAkey.pem</pre>
 # Now we have the private key, generate the CA certificate:
-#:<pre>ipsec pki --self --ca --lifetime 3650 --in private/CAkey.pem --type ecdsa --dn "C=GB, O=strongSwan, CN=strongSwan Root CA" --outform pem > cacerts/CAcert.pem</pre>
+#:<pre>ipsec pki --self --ca --lifetime 3650 --in private/CAkey.pem --type ecdsa --dn "C=GB, O=strongSwan, CN=strongSwan CA" --outform pem > cacerts/CAcert.pem</pre>
 You now have a self-signed CA certificate, ready to sign any certificates to be used by the VPN server.
@@ Line 64: / Line 72: @@
 #:<pre>chmod 600 private/serverkey.pem</pre>
 # Now we have the private key, generate the server certificate:
-#:<pre>ipsec pki --pub --in private/serverkey.pem --type ecdsa | ipsec pki --issue --lifetime 365 --cacert cacerts/CAcert.pem --cakey private/CAkey.pem --dn "C=GB, O=strongSwan, CN=thinkserver.freddythechick.uk" --san thinkserver.freddythechick.uk --flag serverAuth --outform pem > certs/servercert.pem</pre>
+#:<pre>ipsec pki --pub --in private/serverkey.pem --type ecdsa | ipsec pki --issue --lifetime 365 --cacert cacerts/CAcert.pem --cakey private/CAkey.pem --dn "C=GB, O=strongSwan, CN=thinkserver.freddythechick.net" --san thinkserver.freddythechick.net --flag serverAuth --flag ikeIntermediate --outform pem > certs/servercert.pem</pre>
 The certificate created will be used to authenticate the VPN server. Only one needs creating.
@@ Line 70: / Line 78: @@
 '''IMPORTANT NOTES'''
-When customising to fit your server, certain parts of the certificate generation must be done correctly for Windows to allow the certificate to be used. If not done correctly, Windows will refuse to connect. It is advisable to make sure these are correct in the first place to avoid errors further down the line and painstaking troubleshooting.
+When customising to fit your server, certain parts of the server certificate generation must be done correctly for Windows to allow the certificate to be used. If not done correctly, Windows will refuse to connect. It is advisable to make sure these are correct in the first place to avoid errors further down the line and painstaking troubleshooting.
 * The Common Name (<code>CN</code>) part of the Distinguishable Name (DN) '''MUST''' be the DNS resolvable name you will be using to connect to the VPN server from Windows.
 * The SAN '''MUST''' also be the DNS resolvable name you will be using to connect to the VPN server from Windows. It '''MUST''' also match the <code>CN</code> from the DN.
-* It '''MUST''' contain the <code>serverAuth</code> flag.
+* It '''MUST''' contain the <code>serverAuth</code> flag. the <code>ikeIntermediate</code> is included for compatibility with MacOS and doesn't affect a Windows installation so is safe to add.
 == Creating a certificate for clients ==