Setup of DMVPN on Alpine linux

Setting up mGRE tunnel

We start by adding mGRE tunnels to our network configuration.

Contents of /etc/networking/interfaces

...

auto gre1
iface gre1 inet static
       pre-up ip tunnel add $IFACE mode gre key 42 ttl 64 dev br0 || true
       address 192.168.148.2
       netmask 255.255.255.255
       post-down ip tunnel del $IFACE || true

Note: In conjunction with IPsec VPNs this allows passing of routing information between connected networks.

Note: A standard GRE tunnel will specify its start and endpoint. In case of the mGRE tunnel we do not assign an start/endpoint, it will dynamically be manage by NHRP

Note: A tunnel key is a 32-bit number is assigned to both ends of the tunnel. A key is added with the add gre tunnel command, and can be modified or deleted with the set gre tunnel command. The tunnel key provides a weak form of security because packets injected into the tunnel by an external party are rejected unless they contain the correct tunnel key value. The key also allows packets to travel through specific tunnels in multi-point networks because the key identifies each end of one tunnel.

Setting up IPSec VPN

To encrypt this tunnel, and the traffic in it, we will use strongswan ipsec with its vici plugin. The vici plugin provides VICI, the Versatile IKE Configuration Interface. As its name indicates, it provides an interface for external applications to not only configure, but also to control and monitor the IKE daemon charon. for this we also need a modified version of Strongswan which is the default Strongswan in Alpine Linux.

apk add strongswan

Template

Template taken from other wiki docs.

Contents of /etc/swanctl/swanctl.conf

connections {
        dmvpn {
                version = 2                         # enable IKEv2
                pull = no                           # IKEv1 only. Push enabled. IKEv2 does not support pull.
                mobike = no                         # disable support for mobile clients tunnel migration
                dpd_delay = 15                      # Interval to check the liveness of a peer if not traffic has passed
                dpd_timeout = 30                    # IKEv1 only
                fragmentation = yes                 # NOTE: has recently been added. docs are outdated.
                unique = replace                    # replace connection if it already exists
                rekey_time = 4h                     # rekey is by default already 4h
                reauth_time = 13h                   # re authenticate ipsec tunnel
                proposals = aes256-sha512-ecp384    # docs say default is considered safe and has good interoperability
                local {
                        certs = cert                # certificates used for authentication
                        auth  = pubkey              # a private key associated to a usable certificate
                        id    = spoke1              # IKE identity which should be included in the certificate. ie fqdn
                }
                remote {
                        auth = pubkey               # Authentication to expect from remote
                }
                children {                          # what is the difference between remote and children? local and remote is only to specify authentication?
                        dmvpn {
                                esp_proposals = aes256-sha512-ecp384  # docs say default is considered safe and has good interoperability
                                local_ts = dynamic[gre]               # traffic selectors, dynamic to use outer address of virtual ip. restrict to GRE protocol
                                remote_ts = dynamic[gre]              # traffic selectors, dynamic to use outer address of virtual ip. restrict to GRE protocol
                                inactivity = 90m                      # close CHILD_SA after inactivity
                                rekey_time = 100m                     # Time to schedule CHILD_SA rekeying
                                mode = transport                      # IPsec Mode to establish CHILD_SA with
                                dpd_action = clear                    # default is clear
                                reqid = 1                             # why not use dynamic reqids, allocated incrementally? 
                        }
                }
        }
}

Note: To control the IPSec VPN, NHRP will talk to Strongswan via its vici plugin (Versatile IKE Configuration Interface).

Note: You will need a modified version of Strongswan by fabled which you can find in Alpine Linux Git repository

Spoke 1

Contents of /etc/swanctl/swanctl.conf

connections {
        dmvpn {
                version = 2
                mobike = no
                dpd_delay = 15
                fragmentation = yes
                unique = replace
                reauth_time = 13h
                proposals = aes256-sha512-ecp384
                local {
                        certs = spoke1.pem
                        auth  = pubkey
                        id    = spoke1.vpn.domain.tld
                }
                remote {
                        auth = pubkey
                        id   = hub.vpn.domain.tld
                }
                children {
                        dmvpn {
                                esp_proposals = aes256-sha512-ecp384
                                local_ts = dynamic[gre]
                                remote_ts = dynamic[gre]
                                inactivity = 90m
                                rekey_time = 100m
                                mode = transport
                        }
                }
        }
}

HUB

Contents of /etc/swanctl/swanctl.conf

connections {
        dmvpn {
                version = 2
                mobike = no
                dpd_delay = 15
                fragmentation = yes
                unique = replace
                reauth_time = 13h
                proposals = aes256-sha512-ecp384
                local {
                        certs = spoke1.pem
                        auth  = pubkey
                        id    = hub.vpn.domain.tld
                }
                remote {
                        auth = pubkey
                }
                children {
                        dmvpn {
                                esp_proposals = aes256-sha512-ecp384
                                local_ts = dynamic[gre]
                                remote_ts = dynamic[gre]
                                inactivity = 90m
                                rekey_time = 100m
                                mode = transport
                        }
                }
        }
}

Generate PKI certificates

Tip: The ipsec pki command suite allows you to run a simple public key infrastructure. Generate RSA and ECDSA public key pairs, create PKCS#10 certificate requests containing subjectAltNames, create X.509 self-signed end entity and root CA certificates, issue end entity and intermediate CA certificates signed by the private key of a CA and containing subjectAltNames, CRL distribution points and URIs of OCSP servers. You can also extract raw public keys from private keys, certificate requests and certificates and compute two kinds of SHA1-based key IDs.

First, generate a private key, the default generates a 2048 bit RSA key

ipsec pki --gen > caKey.der

Now self-sign a CA certificate using the generated key:

ipsec pki --self --in caKey.der --dn "C=CH, O=strongSwan, CN=strongSwan CA" --ca > caCert.der

Adjust the distinguished name (DN) to your needs, it will be included in all issued certificates.

For each peer, i.e. for all VPN clients and VPN gateways in your network, generate an individual private key and issue a matching certificate using your new CA:

ipsec pki --gen > peerKey.der ipsec pki --pub --in peerKey.der | ipsec pki --issue --cacert caCert.der --cakey caKey.der --san host.vpn.example.tld --dn "C=CH, O=strongSwan, CN=peer" > peerCert.der

Note: The second command extracts the public key and issues a certificate using your CA.

Note: When using id in local/remote config, you will need to add this id to the certificate with --san host.vpn.example.tld

Certificate Revocation Lists (CRL)

In case end entity certificates have to be revoked, Certificate Revocation Lists (CRLs) may be generated with the ipsec pki --signcrl command:

ipsec pki --signcrl --cacert caCert.der --cakey caKey.der --reason superseded --cert peerCert.der > crl.der

Note: The certificate given with --cacert must be either a CA certificate or a certificate with the crlSign extended key usage (--flag crlSign).

Install certificates

On each peer store the following certificates and keys in the /etc/ipsec.d/ subdirectory tree:

/etc/swanctl/rsa/hubKey.der holds the private key of the given peer.
/etc/swanctl/x509/hubCert.der holds the end entity certificate of the given peer.
/etc/swanctl/x509ca/caCert.der holds the CA certificate which issued and signed all peer certificates.

Tip: Never store the private key caKey.der of the Certification Authority (CA) on a host with constant direct access to the Internet (e.g. a VPN gateway), since a theft of this master signing key will completely compromise your PKI.

Note: Optionally, the CRL may be stored in the following directory (if the certificate contains an URL to a CRL, it will be fetched on demand: /etc/ipsec.d/crls/crl.der holds the CRL signed by the CA (or a certificate containing the crlSign EKU).

Quagga/NHRP

apk add quagga

Sending Traffic Indication (redirect) notifications

apk add iptables

iptables -A FORWARD -i gre1 -o gre1 \ -m hashlimit --hashlimit-upto 4/minute --hashlimit-burst 1 \ --hashlimit-mode srcip,dstip --hashlimit-srcmask 16 --hashlimit-dstmask 16 \ --hashlimit-name loglimit-0 -j NFLOG --nflog-group 1 --nflog-range 128

Configuring nhrpd

HUB

vtysh

configure terminal
log syslog
debug nhrp common

router bgp 65000
 bgp router-id 172.16.0.1
 bgp deterministic-med
 network 172.16.0.0/16
 redistribute nhrp
 neighbor spokes-ibgp peer-group
 neighbor spokes-ibgp remote-as 65000
 neighbor spokes-ibgp ebgp-multihop 1
 neighbor spokes-ibgp disable-connected-check
 neighbor spokes-ibgp route-reflector-client
 neighbor spokes-ibgp next-hop-self all
 neighbor spokes-ibgp advertisement-interval 1
 neighbor spokes-ibgp soft-reconfiguration inbound
 neighbor 172.16.1.1 peer-group spokes-ibgp
exit

tunnel protection vici profile dmvpn
tunnel source br0
ip nhrp network-id 1
ip nhrp shortcut
ip nhrp registration no-unique
ip nhrp nhs dynamic nbma hub1.vpn.alpinelinux.org
ipv6 nd suppress-ra
no link-detect