Aquilenet » Services

# Configuration of a Libre Hosting aka Anouncing our public IPs to Internet from an indifferent place

technical resume: IPSec between OPNSense and OpenBSD to announce our ASN IP from an indifferent ISP place. 

## General presentation

### Who we are

[Aquilenet](https://www.aquilenet.fr) is a non profit organization since 2010 and a "do it yourself ISP", member of a Federation of similar ISP in France called [FFDN](https://www.ffdn.org). We are netneutrality builders, helping for more freedom and building networks using and participating Libre Software.

We provide xDSL, VPN and we hope soon Fiber accesses, and a lot of services for our members (mail, nextcloud, hosting, VPS...) and for others [searx](https://searx.aquilenet.fr), [Etherpad](https://pad.aquilenet.fr), [Pastebin](https://pastebin.aquilenet.fr), [Peertube](https://tube.aquilenet.fr), ...

### The need: create a Libre format hosting in our cool local called "la mezzanine".

To allow our the members of our non-profit organization to connect the hardware they want (like Nuc, Raspberry pi, tower, etc...) in our Libre hosting space called "la mezzanine" with a Public IPv6 and IPv4 and from our [ASN](https://en.wikipedia.org/wiki/Autonomous_system_(Internet)), we need to announce our IPs from another place than our Datacenter.

### How we do

We have to tunnel all the network from the Libre Hosting to Internet and vice versa. We have tried first with OpenVPN but the userland application use to much resources for needed bandwidth (200Mbps).

This IP range will be routed by IPSec to our [ASN](https://en.wikipedia.org/wiki/Autonomous_system_(Internet)) point of [BGP](https://en.wikipedia.org/wiki/Border_Gateway_Protocol) announce in our datacenter, then they will route them to the Libre Hosting.

From our Libre Hosting we have a [OPNSense](https://opnsense.org/) Firewall and in our Datacenter two clustered [OpenBSD](https://www.openbsd.org/).

A diagram to explain this:

![](https://atelier.aquilenet.fr/attachments/download/550/Aquilenet-IPSec-Logical_Scheme.png)

Diagram explanation:

* (1) [ASN](https://en.wikipedia.org/wiki/Autonomous_system_(Internet)) & [BGP](https://en.wikipedia.org/wiki/Border_Gateway_Protocol)

With our [ASN](https://en.wikipedia.org/wiki/Autonomous_system_(Internet)) with can do BGP to announce our IP adresses in our Datacenter.

* (2) Firewalls in the Datacenter

The job is done with a cluster of firewalls using the magic power of [OpenBSD](https://www.openbsd.org/) and [OpenBGPD](http://www.openbgpd.org/).

For firewall redundancy we use [CARP and pfsync](https://www.openbsd.org/faq/pf/carp.html)

* (3) La Mezzanine

Is our cool place where we can meet our members and friends.

This place use green power with a supplier called [Enercoop](https://en.wikipedia.org/wiki/Enercoop), it's a French electric utility cooperative company, which only uses renewable energy.

Here, the firewall is a special hardware to afford filter & IPSec on 500Mbps [OPNSense](https://opnsense.org/), we choose an hardware with [AES-NI](https://en.wikipedia.org/wiki/AES_instruction_set) and here we have a Qotom-Q355G4 Fanless X86Intel ® Core ™i5-5250Uprocessor coming from Shenzen. He is doing the PPPOE connection on a general public fiber provider (Yes we had to hack a little to remove this ISP blackbox).

* (4) Public IPv6 and v4 from the Mezzanine to Internet

This firewall is routing threw an IPSec tunnel (for each OpenBSD firewall) our public dedicated IP for this place. These IP allow our friend's to put there their servers / Arduino's & co to Internet with our network <3

---

## Technical information, let's rock !

We configure IPSec tunnels with 

* Phase 1: IKEv1 AES (192 bits) + SHA1 + DH Group 14 (2048 bits)

* Phase 2: ESP IPv4 tunnel AES (256 bits) SHA512 Group 18 (8192 bits)

* Phase 2: ESP IPv6 tunnel AES (256 bits) SHA512 Group 18 (8192 bits) 

### [OpenBSD](https://www.openbsd.org/) configuration

We configure the [OpenBSD](https://www.openbsd.org/)'s IPSec configuration file for 2 Phase 2 tunnels one for IPv4 another on for IPv6

**/etc/ipsec.conf**

~~~

ike passive esp from any to $LIBRE_HOSTING_PUB_IP_V4/26 \

    peer $OPSense_Public_IP\

    main group modp2048\

    psk "My super secret shared key"

flow esp from any to $LIBRE_HOSTING_PUB_IP_V4/26 peer $OPSense_Public_IP

flow esp from any to $LIBRE_HOSTING_PUB_IP_V6/48 peer $OPSense_Public_IP

~~~

~~~

chmod 500 /etc/ipsec.conf

~~~

**Launch the tunnel:**

~~~

isakmpd -K  

ipsecctl -f /etc/ipsec.conf

~~~

To make it permanent add this to /etc/rc.conf.local:

~~~

isakmpd_flags="-K"

ipsec_rules=/etc/ipsec.conf

ipsec=YES

~~~

check the configuration:

~~~

ipsecctl -sa 

~~~

Enable some logs on Isakmpd:

~~~

sh -c "echo S \> /var/run/isakmpd.fifo"  

less /var/run/isakmpd.result

~~~

and:

~~~

isakmpd -d -DA=70 -K

~~~

Check IPSec Flows:

~~~

ipsecctl -F

~~~

## [OPNSense](https://opnsense.org/) configuration

* **IPSec Phase 1**

![](https://atelier.aquilenet.fr/attachments/download/556/OPNSense-Tunnel_Settings_IPsec_VPN-Phase1.png)

* **IPSec Phase 2 IPv4**

![](https://atelier.aquilenet.fr/attachments/download/553/OPNSense-Tunnel_Settings_IPsec-Phase2-IPv4.png)

* **IPSec Phase 2 IPv6**

To have an IPv6 phase 2 with a IPv4 phase on Opnsense ensure you got [this patch](https://github.com/opnsense/core/commit/a79b20c12759007f2079ffd6e0cad26d04b00808)

![](https://atelier.aquilenet.fr/attachments/download/554/OPNSense-Tunnel_Settings_IPsec-Phase2-IPv6.png)

* **IPSec Advanced Settings**

Important exclude the routed network to allow it to talk to itself (exemple ARP/ICMP request to the gateway) 

![](https://atelier.aquilenet.fr/attachments/download/555/OPNSense-Tunnel_Settings_IPsec-Advanced_Settings.png)

## Hosted server settings

IP: The public IP/Mask

Gateway: OPNSense's IP

mtu 1378

---