IPSec VPN Host to Host on Ubuntu 14.04 with strongSwan

After spending a crazy amount of time trying to find something up to date regarding network security and host to host VPN I decided to write something which will hopefully be useful to other people in the same situation.

Setting up a host to host IPSec connection between two or more hosts running Ubuntu isn’t always a simple process. We want encryption to protect all the communication between two hosts and for this tutorial we will be using what I feel to be the simplest method of using Pre-shared Keys (PSK).

Remember that we’re creating a transport IPSec VPN and not a network to network VPN, we only want two or more hosts having encrypted conversations between them.

Why would you want to have a VPN running inside your network? Well possible use cases include:

• You want to prevent the use of packet sniffing to discover network traffic
• There are governance reasons why you must make two hosts communicate securely
• You want to make sure that two or more hosts are having TCP and UDP communications which aren’t being tampered with

For this tutorial I will assume the following:

• You have at least two Ubuntu 14.04 devices which you want to encrypt communications between (named Red and Blue in these examples)
• These devices can access each other without any NAT in the way (NAT adds an additional layer of complexity for VPNs like this)
• You want a comparatively quick and easy IPSec configuration so you want to use pre-shared keys (PSK) for authentication
  We want some assurance that things will be secure so we’ll be using Suite B assured cryptography for IPSec

In my example the servers I’m connecting together look like the below, they don’t have to be on the same subnet but as I mentioned above this method will not work with NAT.

Red Server IP 192.168.100.100/24
Blue Server IP 192.168.100.200/24

Instructions – Red Server

Firstly SSH onto your first server as normal and install the following dependancies:

apt-get install ipsec-tools strongswan-starter

Now we need to create the actual crypto maps which we’ll be using, so edit the IPSec configuration file on the Red:

nano /etc/ipsec.conf

And fill in the following with the details pertinent to your network at the end of that file, e.g. IP address:

conn red-to-blue
    authby=secret
    auto=route
    keyexchange=ike
    left=192.168.100.100
    right=192.168.100.200
    type=transport
    esp=aes128gcm16!

Now create the file which holds the PSKs

nano /etc/ipsec.secrets

Populate like the following with your IP datails (warning each element in this file should be separated by a space NOT a tab):

192.168.100.100 192.168.100.200 : PSK "Your password here!"

Lets restart our IPSec:

ipsec restart

Then you should have something like the following:

Stopping strongSwan IPsec…
Starting strongSwan 5.1.2 IPsec [starter]…

If you type in:

ipsec statusall

You should see something like the following which means we’re looking healthy and ready to go.

Status of IKE charon daemon (strongSwan 5.1.2, Linux 3.13.0-24-generic, x86_64):
uptime: 98 seconds, since Jun 05 19:34:12 2015
malloc: sbrk 1486848, mmap 0, used 318864, free 1167984
worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 0
loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pkcs1 pkcs7 pkcs8 pkcs12 pem openssl xcbc cmac hmac ctr ccm gcm attr kernel-netlink resolve socket-default stroke updown eap-identity addrblock
Listening IP addresses:
192.168.100.100
Connections:
red-to-blue: 192.168.100.100…192.168.100.200 IKEv1/2
red-to-blue: local: [192.168.100.100] uses pre-shared key authentication
red-to-blue: remote: [192.168.100.200] uses pre-shared key authentication
red-to-blue: child: dynamic === dynamic TRANSPORT
Routed Connections:
red-to-blue{1}: ROUTED, TRANSPORT
red-to-blue{1}: 192.168.100.100/32 === 192.168.100.200/32
Security Associations (0 up, 0 connecting):
none

Instructions – Blue Server

SSH onto this server as usual and do some very similar things as what we did on the Red server, other than some changes to IP addresses the rest is identical.

Make sure the necessary packages are installed:

apt-get install ipsec-tools strongswan-starter

Edit the ipsec.conf again:

nano /etc/ipsec.conf

And populate like the following, again bear in mind your IP addresses could be different and should be different than on our Red server, namely the left and right side of the tunnel:

conn blue-to-red
    authby=secret
    auto=route
    keyexchange=ike
    left=192.168.100.200
    right=192.168.100.100
    type=transport
    esp=aes128gcm16!

Now create the file which holds the PSKs

nano /etc/ipsec.secrets

Populate like the following with your IP datails (warning each element in this file should be separated by a space NOT a tab):

192.168.100.100 192.168.100.200 : PSK "Your password here!"

Lets restart IPsec:

ipsec restart

Testing our Tunnel

On the red server do the following and leave it running:

ping -s 4048 192.168.100.200

On the blue server run the following:

watch ipsec statusall

If you notice the the number of packets and the number of bytes should be increasing with the ping being run, this shows things are running the way they should be.

Or you could run the following to show the ESP packets hitting the interfaces:

tcpdump esp

But congratulations you now have a host to host VPN up and working on Ubuntu!

Update 17 July 2015 – Fixed the indentations on the ipsec.conf examples.