This material is work-in-progress ...

Do not follow instructions here until this notice is removed.
(Last edited by Larena on 19 Aug 2013.)

http://alpinelinux.org/about under Why the Name Alpine? states:

The first open-source implementation of Cisco's DMVPN, called OpenNHRP, was written for Alpine Linux.

So the aim of this document is to be the reference DMVPN setup, with all the networking services needed for the clients that will use the DMVPN (DNS, DHCP, firewall, etc.).

A DMVPN is made up two kind of hosts: an Hub node (also called Core router) and a Leaf node (also called Edge router). We'll start documenting the Leaf node setup.

Tip: The recommended version of Alpine for building a DMVPN should be at minimum 2.4.11. Don't use 2.5.x, or 2.6.0 since it has in-tunnel IP fragmentation issues. Alpine 2.6.1 or later should be also okay

Note: This document assume that all Alpine installations are run in diskless mode and that the configuration is saved on USB key

Leaf Node

Alpine Setup

We will setup the network interfaces as follows:

bond0.1 = LAN
bond0.2 = DMZ
bond0.10 = ISP1
bond0.11 = ISP2

Boot Alpine in diskless mode and run setup-alpine

You will be prompted something like this...	Suggestion on what you could enter...
`Select keyboard layout [none]:`	Type an appropriate layout for you
`Select variant:`	Type an appropriate layout for you (if prompted)
`Enter system hostname (short form, e.g. 'foo') [localhost]:`	Enter the hostname, e.g. vpnc
`Available interfaces are: eth0 Enter '?' for help on bridges, bonding and vlans. Which one do you want to initialize? (or '?' done')`	Enter bond0.1
`Available bond slaves are: eth0 eth1 Which slave(s) do you want to add to bond0? (or 'done') [eth0]`	eth0 eth1
`IP address for bond0? (or 'dhcp', 'none', '?') [dhcp]:`	Press Enter confirming 'none'
`IP address for bond0.1? (or 'dhcp', 'none', '?') [dhcp]:`	Enter the IP address of you LAN interface, e.g. 192.168.1.1
`Netmask? [255.255.255.0]:`	Press Enter confirming '255.255.255.0' or type an appropriate another appropriate subnet mask
`Gateway? (or 'none') [none]:`	Press Enter confirming 'none'
`Do you want to do any manual network configuration? [no]`	yes
Make a copy of the bond0.1 configuration for bond0.2, bond0.10 and bond0.20 (optional) interfaces. Don't forget to add a gateway and a metric value for ISP interfaces when multiple gateways are set. Save and close the file (:wq)
`DNS domain name? (e.g. 'bar.com') []:`	Enter the domain name of your intranet, e.g., example.net
`DNS nameservers(s)? []:`	8.8.8.8 8.8.4.4 (we will change them later)
`Changing password for root New password:`	Enter a secure password for the console
`Retype password:`	Retype the above password
`Which timezone are you in? ('?' for list) [UTC]:`	Press Enter confirming 'UTC'
`HTTP/FTP proxy URL? (e.g. 'http://proxy:8080', or 'none') [none]`	Press Enter confirming 'none'
`Enter mirror number (1-9) or URL to add (or r/f/e/done) [f]:`	Select a mirror close to you and press Enter
`Which SSH server? ('openssh', 'dropbear' or 'none') [openssh]:`	Press Enter confirming 'openssh'
`Which NTP client to run? ('openntpd', 'chrony' or 'none') [chrony]:`	Press Enter confirming 'chrony'
`Which disk(s) would you like to use? (or '?' for help or 'none') [none]:`	Press Enter confirming 'none' or type 'none' if needed
`Enter where to store configs ('floppy', 'usb' or 'none') [usb]:`	Press Enter confirming 'usb'
`Enter apk cache directory (or '?' or 'none') [/media/usb/cache]:`	Press Enter confirming '/media/usb/cache'

Bonding

Update the bonding configuration:

echo bonding mode=balance-tlb miimon=100 updelay=500 >> /etc/modules

DNS

apk add unbound

Unbound configuration goes here...

/etc/init.d/unbound start

echo nameserver 192.168.1.1 > /etc/resolv.conf

GRE Tunnel

With your favorite editor open /etc/network/interfaces and add the following:

auto gre1
iface gre1 inet static
      pre-up ip tunnel add $IFACE mode gre ttl 64 tos inherit key 12.34.56.78 || true
      address 172.12.1.1
      netmask 255.255.0.0
      post-down ip tunnel del $IFACE || true

Save and close the file.

ifup gre1

IPSEC

apk add ipsec-tools

With your favorite editor open /etc/ipsec.conf and change contents the following:

spdflush;
spdadd 0.0.0.0/0 0.0.0.0/0 gre -P out	ipsec esp/transport//require;
spdadd 0.0.0.0/0 0.0.0.0/0 gre -P in 	ipsec esp/transport//require;

Racoon configuration goes here...