IPSec VPN Host to Host on Windows 2012 R2 and Ubuntu 14.04

After one of my recent tutorials about a host to host Linux VPN this post is a how to create a host to host VPN between Windows 2012 and Ubuntu 14.04.  We’ll be using the inbuilt Windows Firewall with Advanced Security and Strongswan.

A lot like my last tutorial I couldn’t find any decent information out there how to get an IPSec connection between Microsoft and Linux, but since IPSec is an open standard I was confident it should work. After spending a lot of time working through how to do this I decided to write this post to hopefully help other people out in the same situation.

Although this post is written for Ubuntu, I see no reason why it shouldn’t work with any other distribution. As for Windows; I’ve only tried this on Windows Server 2012 R2 and can’t vouch for any other flavor. Incidentally this is my first post with anything in-depth for Windows since 2011!

We will also follow the same rules as my last post:

• This approach won’t work if there is any NAT between our Windows and Linux boxes
• Since we are going for quick and easy we will be using a pre-shared key for authentication

The examples I’m working with look like the following:
Green Server – Windows 2012 R2 – 192.168.100.100/24
Yellow Server – Ubuntu 14.04LTS – 192.168.100.200/24

Instructions – Green Server

Logon to your server, and open up “Windows Firewall with Advanced Security”

Navigate down to “Connection Security Rules”, right click in the white space to the right and select “New Rule”

A box like the following should pop up. Select “Custom Rule” in the radio buttons and click “Next”

On the next screen, select “These IP Addresses” and click “Add” by the window at the top for “Endpoint 1”.

Put in the IP address of your Windows box and click “Ok”.

Repeat the process for “Endpoint 2” which is going to be our Linux machine:

Your screen should now look like the screen below, if you’re happy with the two Endpoints, click on Next.

The next screen is fairly self explanatory, but we want to select “Require authentication for inbound and outbound connections”, this will set our Phase 1 and tunnel mode pretty much how we want it.

On the next screen we want to specify “Advanced” since we will be using a pre-shared key, select the appropriate radio button and click “Customize”

Click “Add” for our first Authentication setting.

Select the radio button for “Preshared key (not recommended)”, and type in your preferred password, then click “Ok”.

You should be back at the “Customize Advanced Authentication Methods” screen, review it and if you’re happy with it press “Ok”.

We should be happy with the next screen so press “Next”.

On this next one I’m happy in that I want all the traffic between the two hosts encrypted, however you may want to specify encryption for specific protocols, for instance Telnet, for this tutorial I’m content with everything so I click “Next”.

This next screen again I’m happy that this tunnel will always be online, so I click “Next”.

On this next one I’ve given the tunnel a sensible name and description, when you’re ready click “Finish”.

You should now see something like the following:

DO NOT turn off the Firewall on your Windows Server, I made the naive error of doing this and my tunnel wouldn’t work, then I realised that the Firewall Service contains the IPSec… Turning it back on fixed the issue immediately.

WARNING: You may want to create some granular firewall rules for your IPSec tunnel, especially if you’re communicating over a non-secure network, but for this tutorial we’re going to allow all inbound traffic on the Domain profile.

Right click on “Windows Firewall with Advanced Security” at the top of the tree, and click “Properties”.

Set “Inbound connections” to “Allow”, then click “Ok”.

You’re done on the Windows Server for now, let’s now move on to the Ubuntu Server.

Instructions – Yellow Server

SSH into your Ubuntu Server box.

Lets go ahead and install the Strongwan package if it’s not already installed.

apt-get install ipsec-tools strongswan-starter

Now lets create the settings on our Linux server which compliment those on the Windows server.

nano /etc/ipsec.conf

If you’ve followed the instructions in the previous section, you should put the following on the bottom of that file.

conn yellow-to-green
    authby=secret
    auto=route
    keyexchange=ikev1
    left=192.168.100.200 #This is the IP of Ubuntu
    right=192.168.100.100 #This is the IP of Windows
    type=transport

Now we need to add our secrets to the appropriate file.

nano /etc/ipsec.secrets

If you have anything in that file already, put the following at the bottom.

192.168.100.100 192.168.100.200 : PSK "Your password here!"

Give IPSec a restart:

ipsec restart

You’re all done!

Testing and Monitoring

On your Ubuntu server run the following to ping the Windows Server once, this command should generate some traffic which brings the tunnel up which we configured.

ping -c 1 192.168.100.100

If you see a reply like the below it’s a good sign!

PING 192.168.100.100 (192.168.100.100) 56(84) bytes of data.
64 bytes from 192.168.100.100: icmp_seq=1 ttl=128 time=0.523 ms

Lets see what state the IPSec is in.

ipsec statusall

Status of IKE charon daemon (strongSwan 5.1.2, Linux 3.13.0-24-generic, x86_64):
uptime: 3 minutes, since Jul 25 18:24:23 2015
malloc: sbrk 1486848, mmap 0, used 333200, free 1153648
worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 2
loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pkcs1 pkcs7 pkcs8 pkcs12 pem openssl xcbc cmac hmac ctr ccm gcm attr kernel-netlink resolve socket-default stroke updown eap-identity addrblock
Listening IP addresses:
192.168.100.200
Connections:
yellow-to-green: 192.168.100.200…192.168.100.100 IKEv1
yellow-to-green: local: [192.168.100.200] uses pre-shared key authentication
yellow-to-green: remote: [192.168.100.100] uses pre-shared key authentication
yellow-to-green: child: dynamic === dynamic TRANSPORT
Routed Connections:
yellow-to-green{1}: ROUTED, TRANSPORT
yellow-to-green{1}: 192.168.100.200/32 === 192.168.100.100/32
Security Associations (1 up, 0 connecting):
yellow-to-green[1]: ESTABLISHED 3 minutes ago, 192.168.100.200[192.168.100.200]…192.168.100.100[192.168.100.100]
yellow-to-green[1]: IKEv1 SPIs: b6797bd87167206f_i cbe1c616d5228073_r*, pre-shared key reauthentication in 2 hours
yellow-to-green[1]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
yellow-to-green{1}: INSTALLED, TRANSPORT, ESP SPIs: cdbc79dd_i 24d280fe_o
yellow-to-green{1}: AES_CBC_128/HMAC_SHA1_96, 8224 bytes_i (205 pkts, 0s ago), 8224 bytes_o (205 pkts, 0s ago), rekeying in 38 minutes
yellow-to-green{1}: 192.168.100.200/32 === 192.168.100.100/32

If it’s saying “ESTABLISHED” then we’re good to go! Lets just double check the 2012 box.

Expand out “Monitoring”, “Security Associations” and “Main Mode” and hopefully you see a screen like the one below.

Congratulations! You now have a working IPSec point to point connection.

If you’ve hit problems anywhere or it’s not working, make sure you have specified the end points correctly both on Ubuntu and Windows, double check your preshared key, make sure IPTables on Ubuntu isn’t getting in the way and also make sure you haven’t turned off the Windows firewall.