Setup of DMVPN on Alpine linux

Setting up mGRE tunnel

We start by adding mGRE tunnels to our network configuration.

Contents of /etc/networking/interfaces

... auto gre1 iface gre1 inet static pre-up ip tunnel add $IFACE mode gre key 42 ttl 64 dev br0 || true address 192.168.148.2 netmask 255.255.255.255 post-down ip tunnel del $IFACE || true

Note: In conjunction with IPsec VPNs this allows passing of routing information between connected networks.

Note: A standard GRE tunnel will specify its start and endpoint. In case of the mGRE tunnel we do not assign an start/endpoint, it will dynamically be manage by NHRP

Note: A tunnel key is a 32-bit number is assigned to both ends of the tunnel. A key is added with the add gre tunnel command, and can be modified or deleted with the set gre tunnel command. The tunnel key provides a weak form of security because packets injected into the tunnel by an external party are rejected unless they contain the correct tunnel key value. The key also allows packets to travel through specific tunnels in multi-point networks because the key identifies each end of one tunnel.

Setting up IPSec VPN

To encrypt this tunnel, and the traffic in it, we will use strongswan ipsec with its vici plugin. The vici plugin provides VICI, the Versatile IKE Configuration Interface. As its name indicates, it provides an interface for external applications to not only configure, but also to control and monitor the IKE daemon charon. for this we also need a modified version of Strongswan which is the default Strongswan in Alpine Linux.

apk add strongswan

Template

Template taken from other wiki docs.

Contents of /etc/swanctl/swanctl.conf

connections { dmvpn { version = 2 # enable IKEv2 pull = no # IKEv1 only. Push enabled. IKEv2 does not support pull. mobike = no # disable support for mobile clients tunnel migration dpd_delay = 15 # Interval to check the liveness of a peer if not traffic has passed dpd_timeout = 30 # IKEv1 only fragmentation = yes # NOTE: has recently been added. docs are outdated. unique = replace # replace connection if it already exists rekey_time = 4h # rekey is by default already 4h reauth_time = 13h # re authenticate ipsec tunnel proposals = aes256-sha512-ecp384 # docs say default is considered safe and has good interoperability local { certs = cert # certificates used for authentication auth = pubkey # a private key associated to a usable certificate id = spoke1 # IKE identity which should be included in the certificate. ie fqdn } remote { auth = pubkey # Authentication to expect from remote } children { # what is the difference between remote and children? local and remote is only to specify authentication? dmvpn { esp_proposals = aes256-sha512-ecp384 # docs say default is considered safe and has good interoperability local_ts = dynamic[gre] # traffic selectors, dynamic to use outer address of virtual ip. restrict to GRE protocol remote_ts = dynamic[gre] # traffic selectors, dynamic to use outer address of virtual ip. restrict to GRE protocol inactivity = 90m # close CHILD_SA after inactivity rekey_time = 100m # Time to schedule CHILD_SA rekeying mode = transport # IPsec Mode to establish CHILD_SA with dpd_action = clear # default is clear reqid = 1 # why not use dynamic reqids, allocated incrementally? } } } }

Note: To control the IPSec VPN, NHRP will talk to Strongswan via its vici plugin (Versatile IKE Configuration Interface).

Note: You will need a modified version of Strongswan by fabled which you can find in Alpine Linux Git repository

Spoke 1

Contents of /etc/swanctl/swanctl.conf

connections { dmvpn { version = 2 mobike = no dpd_delay = 15 fragmentation = yes unique = replace reauth_time = 13h proposals = aes256-sha512-ecp384 local { certs = spoke1.pem auth = pubkey id = spoke1.vpn.domain.tld } remote { auth = pubkey id = hub.vpn.domain.tld } children { dmvpn { esp_proposals = aes256-sha512-ecp384 local_ts = dynamic[gre] remote_ts = dynamic[gre] inactivity = 90m rekey_time = 100m mode = transport } } } }

HUB

Contents of /etc/swanctl/swanctl.conf

connections { dmvpn { version = 2 mobike = no dpd_delay = 15 fragmentation = yes unique = replace reauth_time = 13h proposals = aes256-sha512-ecp384 local { certs = spoke1.pem auth = pubkey id = hub.vpn.domain.tld } remote { auth = pubkey } children { dmvpn { esp_proposals = aes256-sha512-ecp384 local_ts = dynamic[gre] remote_ts = dynamic[gre] inactivity = 90m rekey_time = 100m mode = transport } } } }

Generate PKI certificates

Tip: The ipsec pki command suite allows you to run a simple public key infrastructure. Generate RSA and ECDSA public key pairs, create PKCS#10 certificate requests containing subjectAltNames, create X.509 self-signed end entity and root CA certificates, issue end entity and intermediate CA certificates signed by the private key of a CA and containing subjectAltNames, CRL distribution points and URIs of OCSP servers. You can also extract raw public keys from private keys, certificate requests and certificates and compute two kinds of SHA1-based key IDs.

First, generate a private key, the default generates a 2048 bit RSA key

ipsec pki --gen > caKey.der

Now self-sign a CA certificate using the generated key:

ipsec pki --self --in caKey.der --dn "C=CH, O=strongSwan, CN=strongSwan CA" --ca > caCert.der

Adjust the distinguished name (DN) to your needs, it will be included in all issued certificates.

For each peer, i.e. for all VPN clients and VPN gateways in your network, generate an individual private key and issue a matching certificate using your new CA:

ipsec pki --gen > peerKey.der ipsec pki --pub --in peerKey.der | ipsec pki --issue --cacert caCert.der --cakey caKey.der --san host.vpn.example.tld --dn "C=CH, O=strongSwan, CN=peer" > peerCert.der

Note: The second command extracts the public key and issues a certificate using your CA.

Note: When using id in local/remote config, you will need to add this id to the certificate with --san host.vpn.example.tld

Certificate Revocation Lists (CRL)

In case end entity certificates have to be revoked, Certificate Revocation Lists (CRLs) may be generated with the ipsec pki --signcrl command:

ipsec pki --signcrl --cacert caCert.der --cakey caKey.der --reason superseded --cert peerCert.der > crl.der

Note: The certificate given with --cacert must be either a CA certificate or a certificate with the crlSign extended key usage (--flag crlSign).

Install certificates

On each peer store the following certificates and keys in the /etc/ipsec.d/ subdirectory tree:

/etc/swanctl/rsa/hubKey.der holds the private key of the given peer.
/etc/swanctl/x509/hubCert.der holds the end entity certificate of the given peer.
/etc/swanctl/x509ca/caCert.der holds the CA certificate which issued and signed all peer certificates.

Tip: Never store the private key caKey.der of the Certification Authority (CA) on a host with constant direct access to the Internet (e.g. a VPN gateway), since a theft of this master signing key will completely compromise your PKI.

Note: Optionally, the CRL may be stored in the following directory (if the certificate contains an URL to a CRL, it will be fetched on demand: /etc/ipsec.d/crls/crl.der holds the CRL signed by the CA (or a certificate containing the crlSign EKU).

Quagga/NHRP

adding the required packages

apk add iptables quagga-nhrp

Sending Traffic Indication (redirect) notifications

iptables -A FORWARD -i gre1 -o gre1 \ -m hashlimit --hashlimit-upto 4/minute --hashlimit-burst 1 \ --hashlimit-mode srcip,dstip --hashlimit-srcmask 16 --hashlimit-dstmask 16 \ --hashlimit-name loglimit-0 -j NFLOG --nflog-group 1 --nflog-range 128

Tip: We filter HRHP information from packets and provide them to the NHRP daemon

Configuring Quagga

Note: Quagga needs to be configured with the vty shell. The following parts are split into sections, but all run in the same shell.

vtysh

General

configure terminal
log syslog
debug nhrp common

BGP config

router bgp 65000
 bgp router-id 172.16.0.1
 bgp deterministic-med
 network 172.16.0.0/16
 redistribute nhrp
 neighbor spokes-ibgp peer-group
 neighbor spokes-ibgp remote-as 65000
 neighbor spokes-ibgp ebgp-multihop 1
 neighbor spokes-ibgp disable-connected-check
 neighbor spokes-ibgp route-reflector-client
 neighbor spokes-ibgp next-hop-self all
 neighbor spokes-ibgp advertisement-interval 1
 neighbor spokes-ibgp soft-reconfiguration inbound
exit

NHRP config

interface gre1
 tunnel protection vici profile dmvpn
 tunnel source br0
 ip nhrp network-id 1
 ip nhrp shortcut
 ip nhrp registration no-unique
 ip nhrp nhs dynamic nbma hub1.vpn.domain.tld
 ipv6 nd suppress-ra
 no link-detect
exit

Save config

exit
write mem

Adding spokes to hub

Note: For each spoke you are adding, you need to add the gre ip address to the bgp configuration, simillar like above in the config

vtysh

conf terminal
router bgp 65000
 neighbor 172.16.3.1 peer-group spokes-ibgp
exit
write mem

Tip: Most of the commands used in the vty shell are similar like in Cisco devices. This means you can also gather information from the Cisco docs

See also

• Dynamic Multipoint VPN (DMVPN)
• Dynamic Multipoint VPN (DMVPN) Phase 3 with Quagga NHRPd