Bonjour,
j'essaye de mettre en place un VPN entre deux sites connectés à internet en adsl chez wanadoo.
LAN 2------------ rl0 GW_B pppoe0 ---- net ---- tun0 GW_A rl0 ------------ LAN 1
192.168.2.0/24 .20 .20 192.168.1.0/24
Pour le moment les deuw passerelles GATEWAY-A et GATEWAY_B font offices de routeur, firewall (pf) et cache DNS.
Pour le moment les firewalls autorisent les connexions vers internet sur les ports tcp et udp suivant :
tcp_allow = "{ 80, 8080, 21, 20, 443, 110, 995, 25, 465, 1863, 7080, 53, 22, 113, 8021 }"
udp_allow = "{ 123, 53 }"
les fiewalls bloquent toutes les connexions entrantes sauf sur le port tcp 22 (ssh).
J'ai suivi l'exemple de configuration manuelle du man vpn :
http://www.openbsd.org/cgi-bin/man.cgi?query=vpn&apropos=0&sektion=0&manpath=OpenBSD+Current&arch=i386&format=html
J'ai adatpté l'éxemple à ma configuration :
GATEWAY_A=83.112.80.229
GATEWAY_B=83.112.181.6
NETWORK_A=192.168.1.0/24
NETWORK_B=192.168.2.0/24
ENCRYPTION_KEY_FILE=/somewhere/enc_key
AUTHENTICATION_KEY_FILE=/somewhere/auth_key
Comme je ne métrise pas encore bien les mécanismes de clés privées / clés publics, les fichiers enc_key et auth_key sont strictement les même sur les deux machines.
Sur la GATEWAY_A, j'ai ajouté une ancre à mon fichier
pf.conf
:
anchor vpn
J'ai créé un fichier
/etc/pf_vpn.conf
:
GATEWAY_A = " 83.112.80.229"
GATEWAY_B = " 83.112.181.6"
NETWORK_A = "192.168.1.0/24"
NETWORK_B = "192.168.2.0/24"
# default deny
block in log on enc0 all
block out log on enc0 all
# Passing in encrypted traffic from security gateways
pass in proto esp from $GATEWAY_B to $GATEWAY_A
pass out proto esp from $GATEWAY_A to $GATEWAY_B
# Need to allow ipencap traffic on enc0.
pass in on enc0 proto ipencap all
# Passing in traffic from the designated subnets.
pass in on enc0 from $NETWORK_B to $NETWORK_A
pass out on enc0 from $NETWORK_A to $NETWORK_B
# Passing in isakmpd(8) traffic from the security gateways
pass in on tun0 proto udp from $GATEWAY_B port = 500 to $GATEWAY_A port = 500
pass out on tun0 proto udp from $GATEWAY_A port = 500 to $GATEWAY_B port = 500
Sur la GATEWAY_B, j'ai ajouté une ancre à mon fichier
pf.conf
:
anchor vpn
J'ai créé un fichier
/etc/pf_vpn.conf
:
GATEWAY_A = " 83.112.80.229"
GATEWAY_B = " 83.112.181.6"
NETWORK_A = "192.1.1.0/24"
NETWORK_B = "192.1.2.0/24"
# default deny
block in log on enc0 all
# Passing in encrypted traffic from security gateways
pass in log proto esp from $GATEWAY_A to $GATEWAY_B
pass out proto esp from $GATEWAY_B to $GATEWAY_A
# Need to allow ipencap traffic on enc0.
pass in log on enc0 proto ipencap all
# Passing in traffic from the designated subnets.
pass in log on enc0 from $NETWORK_A to $NETWORK_B
pass out on enc0 from $NETWORK_B to $NETWORK_A
# Passing in isakmpd(8) traffic from the security gateways
pass in on pppoe0 proto udp from $GATEWAY_A port = 500 to $GATEWAY_B port = 500
pass out on pppoe0 proto udp from $GATEWAY_B port = 500 to $GATEWAY_A port = 500
Voici les résultats des configuration avec ipsecadm :
GATEWAY_A# ipsecadm show
sadb_dump: satype esp vers 2 len 22 seq 0 pid 0
errno 1: Operation not permitted
sa: spi 0x00000104 auth hmac-sha1 enc 3des-cbc
state larval replay 0 flags 4
lifetime_cur: alloc 0 bytes 0 add 1122444791 first 0
address_src: 83.112.80.229
address_dst: 83.112.181.6
key_auth: bits 160: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
key_encrypt: bits 192: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
sadb_dump: satype esp vers 2 len 22 seq 0 pid 0
errno 1: Operation not permitted
sa: spi 0x00000105 auth hmac-sha1 enc 3des-cbc
state larval replay 0 flags 4
lifetime_cur: alloc 0 bytes 0 add 1122444802 first 0
address_src: 83.112.181.6
address_dst: 83.112.80.229
key_auth: bits 160: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
key_encrypt: bits 192: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
GATEWAY_B# ipsecadm show
sadb_dump: satype esp vers 2 len 22 seq 0 pid 0
errno 188: Unknown error: 188
sa: spi 0x00000104 auth hmac-sha1 enc 3des-cbc
state larval replay 0 flags 4
lifetime_cur: alloc 0 bytes 0 add 1122453570 first 0
address_src: 83.112.80.229
address_dst: 83.112.181.6
key_auth: bits 160: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
key_encrypt: bits 192: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
sadb_dump: satype esp vers 2 len 22 seq 0 pid 0
errno 188: Unknown error: 188
sa: spi 0x00000105 auth hmac-sha1 enc 3des-cbc
state larval replay 0 flags 4
lifetime_cur: alloc 0 bytes 0 add 1122453582 first 0
address_src: 83.112.181.6
address_dst: 83.112.80.229
key_auth: bits 160: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
key_encrypt: bits 192: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Bizarement j'obtiens un message d'erreur différent sur les deux machines alors que sur l'exemple donné il ne devrait pas y en avoir.
Le résultat de la commande
netstat -rn -f encap
:
GATEWAY_A# netstat -rn -f encap
Routing tables
Encap:
Source Port Destination Port Proto SA(Address/Proto/Type/Direction)
192.168.2/24 0 192.1.1/24 0 0 83.112.181.6/50/require/in
192.168.1/24 0 192.1.2/24 0 0 83.112.181.6/50/require/out
GATEWAY_B# netstat -rn -f encap
Routing tables
Encap:
Source Port Destination Port Proto SA(Address/Proto/Type/Direction)
192.168.1/24 0 192.1.2/24 0 0 83.112.80.229/50/require/in
192.168.2/24 0 192.1.1/24 0 0 83.112.80.229/50/require/out
Apparement ça colle avec l'exemple.
J'active les ancres de mes firewall :
GATEWAY_A# pfctl -a vpn:all -f /etc/pf_vpn.conf
GATEWAY_B# pfctl -a vpn:all -f /etc/pf_vpn.conf
Je test le ping sur l'une et l'autre machine :
GATEWAY_A# ping -I 192.168.1.20 192.168.2.20
PING 192.168.2.20 (192.168.2.20): 56 data bytes
ping: sendto: No route to host
ping: wrote 192.168.2.20 64 chars, ret=-1
ping: sendto: No route to host
ping: wrote 192.168.2.20 64 chars, ret=-1
ping: sendto: No route to host
ping: wrote 192.168.2.20 64 chars, ret=-1
...
GATEWAY_B# ping -I 192.168.2.20 192.168.1.20
PING 192.168.1.20 (192.1.1.20): 56 data bytes
ping: sendto: No route to host
ping: wrote 192.168.1.20 64 chars, ret=-1
ping: sendto: No route to host
ping: wrote 192.168.1.20 64 chars, ret=-1
...
Et la c'est le drame. Le ping ne passe pas.
Est-ce que quelqu'un voit où je me suis trompé ?
Merci d'avance.
▀▄▀▄▀▄
Configuration: GATEWAY_A :
GATEWAY_B :
- OpenBSD 3.7-stable (GENERIC)
- Intel Pentium II 350Mhz, 128 Mo de RAM
- DD IDE Quantum Fireball 4 Go
- 2 cartes réseaux :
- chip realtek 8029
- chip realtek 8139
La mise en place d'une comptabilité dans une entreprise
