Projet

Général

Profil

Librehosting » Historique » Version 32

sacha, 02/08/2018 09:19

1 27 openbeelab
# Configuration of a Libre Hosting aka Anouncing our public IPs to Internet from an indifferent place
2 1 sacha
3 13 sacha
technical resume: IPSec between OPNSense and OpenBSD to announce our ASN IP from an indifferent ISP place. 
4 1 sacha
5 13 sacha
## General presentation
6 1 sacha
7 13 sacha
### Who we are
8
9 32 sacha
[Aquilenet](https://www.aquilenet.fr) is a non profit organization since 2010 and a "do it yourself ISP", member of a Federation of similar ISP in France called [FFDN](https://www.ffdn.org). We are netneutrality builders, helping for more freedom and building networks using and participating Libre Software.
10 1 sacha
We provide xDSL, VPN and we hope soon Fiber accesses, and a lot of services for our members (mail, nextcloud, hosting, VPS...) and for others [searx](https://searx.aquilenet.fr), [Etherpad](https://pad.aquilenet.fr), [Pastebin](https://pastebin.aquilenet.fr), [Peertube](https://tube.aquilenet.fr), ...
11
12 13 sacha
### The need: create a Libre format hosting in our cool local called "la mezzanine".
13 1 sacha
14 12 sacha
To allow our the members of our non-profit organization to connect the hardware they want (like Nuc, Raspberry pi, tower, etc...) in our Libre hosting space called "la mezzanine" with a Public IPv6 and IPv4 and from our [ASN](https://en.wikipedia.org/wiki/Autonomous_system_(Internet)), we need to announce our IPs from another place than our Datacenter.
15 1 sacha
16 13 sacha
### How we do
17 1 sacha
18 12 sacha
We have to tunnel all the network from the Libre Hosting to Internet and vice versa. We have tried first with OpenVPN but the userland application use to much resources for needed bandwidth (200Mbps).
19 28 sacha
This IP range will be routed by IPSec to our [ASN](https://en.wikipedia.org/wiki/Autonomous_system_(Internet)) point of [BGP](https://en.wikipedia.org/wiki/Border_Gateway_Protocol) announce in our datacenter, then they will route them to the Libre Hosting.
20 1 sacha
21 29 sacha
From our Libre Hosting we have a [OPNSense](https://opnsense.org/) Firewall and in our Datacenter two clustered [OpenBSD](https://www.openbsd.org/).
22 1 sacha
23 27 openbeelab
A diagram to explain this:
24 1 sacha
25
![](https://atelier.aquilenet.fr/attachments/download/550/Aquilenet-IPSec-Logical_Scheme.png)
26
27 27 openbeelab
Diagram explanation:
28 1 sacha
29 28 sacha
* (1) [ASN](https://en.wikipedia.org/wiki/Autonomous_system_(Internet)) & [BGP](https://en.wikipedia.org/wiki/Border_Gateway_Protocol)
30 1 sacha
31 28 sacha
With our [ASN](https://en.wikipedia.org/wiki/Autonomous_system_(Internet)) with can do BGP to announce our IP adresses in our Datacenter.
32 12 sacha
33
* (2) Firewalls in the Datacenter
34
35
The job is done with a cluster of firewalls using the magic power of [OpenBSD](https://www.openbsd.org/) and [OpenBGPD](http://www.openbgpd.org/).
36 27 openbeelab
For firewall redundancy we use [CARP and pfsync](https://www.openbsd.org/faq/pf/carp.html)
37 12 sacha
38
* (3) La Mezzanine
39
40
Is our cool place where we can meet our members and friends.
41 31 sacha
This place use green power with a supplier called [Enercoop](https://en.wikipedia.org/wiki/Enercoop), it's a French electric utility cooperative company, which only uses renewable energy.
42 27 openbeelab
Here, the firewall is [OPNSense](https://opnsense.org/) doing the PPPOE connection on a general public fiber provider (Yes we had to hack a little to remove this ISP blackbox).
43 1 sacha
44
* (4) Public IPv6 and v4 from the Mezzanine to Internet
45 12 sacha
46 27 openbeelab
This firewall is routing threw an IPSec tunnel (for each OpenBSD firewall) our public dedicated IP for this place. These IP allow our friend's to put there their servers / Arduino's & co to Internet with our network <3
47 12 sacha
48 13 sacha
---
49
50 14 sacha
## Technical information, let's rock !
51 12 sacha
52
### [OpenBSD](https://www.openbsd.org/) configuration
53
54
We configure the [OpenBSD](https://www.openbsd.org/)'s IPSec configuration file for 2 Phase 2 tunnels one for IPv4 another on for IPv6
55 3 sacha
56 15 sacha
**/etc/ipsec.conf**
57 1 sacha
58
~~~
59 3 sacha
ike passive esp from any to $LIBRE_HOSTING_PUB_IP_V4/26 \
60
    peer $OPSense_Public_IP\
61 1 sacha
    main group modp2048\
62 17 sacha
    psk "My super secret shared key"
63 1 sacha
64 3 sacha
flow esp from any to $LIBRE_HOSTING_PUB_IP_V4/26 peer $OPSense_Public_IP
65
flow esp from any to $LIBRE_HOSTING_PUB_IP_V6/48 peer $OPSense_Public_IP
66 1 sacha
~~~
67
68 7 sacha
~~~
69
chmod 500 /etc/ipsec.conf
70
~~~
71 1 sacha
72 15 sacha
**Launch the tunnel:**
73 1 sacha
74 7 sacha
~~~
75
isakmpd -K  
76
ipsecctl -f /etc/ipsec.conf
77
~~~
78 1 sacha
79 9 sacha
To make it permanent add this to /etc/rc.conf.local:
80 4 sacha
81 3 sacha
~~~
82 1 sacha
isakmpd_flags="-K"
83
ipsec_rules=/etc/ipsec.conf
84
ipsec=YES
85
~~~
86
87 7 sacha
check the configuration:
88 1 sacha
89 7 sacha
~~~
90
ipsecctl -sa 
91
~~~
92
93 8 sacha
Enable some logs on Isakmpd:
94
95 7 sacha
~~~
96 5 sacha
sh -c "echo S \> /var/run/isakmpd.fifo"  
97 1 sacha
less /var/run/isakmpd.result
98
~~~
99
100 8 sacha
and:
101 1 sacha
102 8 sacha
~~~
103 1 sacha
isakmpd -d -DA=70 -K
104 8 sacha
~~~
105 1 sacha
106 8 sacha
Check IPSec Flows:
107 1 sacha
108 8 sacha
~~~
109 1 sacha
ipsecctl -F
110 8 sacha
~~~
111
112 29 sacha
## [OPNSense](https://opnsense.org/) configuration
113 1 sacha
114 20 sacha
* **IPSec Phase 1**
115 24 sacha
116 16 sacha
![](https://atelier.aquilenet.fr/attachments/download/552/OPNSense-Tunnel_Settings_IPsec-Phase1.png)
117 19 sacha
118 20 sacha
* **IPSec Phase 2 IPv4**
119 24 sacha
120 18 sacha
![](https://atelier.aquilenet.fr/attachments/download/553/OPNSense-Tunnel_Settings_IPsec-Phase2-IPv4.png)
121 19 sacha
122 20 sacha
* **IPSec Phase 2 IPv6**
123 24 sacha
124 23 sacha
To have an IPv6 phase 2 with a IPv4 phase on Opnsense ensure you got [this patch](https://github.com/opnsense/core/commit/a79b20c12759007f2079ffd6e0cad26d04b00808)
125 20 sacha
![](https://atelier.aquilenet.fr/attachments/download/554/OPNSense-Tunnel_Settings_IPsec-Phase2-IPv6.png)
126 21 sacha
127
* **IPSec Advanced Settings**
128
129 30 sacha
Important exclude the routed network to allow it to talk to itself (exemple ARP/ICMP request to the gateway) 
130 21 sacha
![](https://atelier.aquilenet.fr/attachments/download/555/OPNSense-Tunnel_Settings_IPsec-Advanced_Settings.png)
131 25 sacha
132 26 sacha
## Hosted server settings
133 25 sacha
134
IP: The public IP/Mask
135 29 sacha
Gateway: OPNSense's IP
136 1 sacha
mtu 1378
137 26 sacha
138
---