FRITZBOX_WAN_IP=111.1.2.3 FRITZBOX_CIDR=192.168.178.0/24 OS_USER=foo PROJECT_ID=xxxxxxxxxxxxxx PSK=PASS1234 openstack vpn ike policy create ${OS_USER}-ike-aes256-sha512 \ --encryption-algorithm aes-256 \ --auth-algorithm sha512 \ --pfs group2 openstack vpn ipsec policy create ${OS_USER}-ipsec-aes256-sha512 \ --encryption-algorithm aes-256 \ --auth-algorithm sha512 \ --pfs group2 ROUTER_ID=$(openstack router list --project ${PROJECT_ID} -c ID -f value) openstack vpn service create ${OS_USER}-vpn-service1 \ --router ${ROUTER_ID} SUBNET_ID=$(openstack subnet list --project ${PROJECT_ID} -c ID -f value) openstack vpn endpoint group create ${OS_USER}-vpn-ep-subnet \ --type subnet \ --value ${SUBNET_ID} openstack vpn endpoint group create ${OS_USER}-vpn-ep-cidr \ --type cidr \ --value ${FRITZBOX_CIDR} openstack vpn ipsec site connection create ${OS_USER}-vpn-conn1 \ --vpnservice ${OS_USER}-vpn-service1 \ --ikepolicy ${OS_USER}-ike-aes256-sha512 \ --ipsecpolicy ${OS_USER}-ipsec-aes256-sha512 \ --peer-address ${FRITZBOX_WAN_IP} \ --peer-id ${FRITZBOX_WAN_IP} \ --psk ${PSK} \ --local-endpoint-group ${OS_USER}-vpn-ep-subnet \ --peer-endpoint-group ${OS_USER}-vpn-ep-cidr # Show VPN server external IP openstack vpn service show -c external_v4_ip -f value ${OS_USER}-vpn-service1
Allow SSH access from VPN
openstack security group rule create default \ --protocol tcp \ --dst-port 22 \ --remote-ip 192.168.178.0/24
Optional: AVM VPN import
vpncfg { connections { enabled = yes; conn_type = conntype_lan; name = "Fritzbox to OpenStack VPNaaS"; always_renew = yes; reject_not_encrypted = no; dont_filter_netbios = yes; localip = 0.0.0.0; local_virtualip = 0.0.0.0; remoteip = ${VPN_SERVER_IP}; remote_virtualip = 0.0.0.0; localid { ipaddr = ${FRITZBOX_WAN_IP}; } remoteid { ipaddr = ${VPN_SERVER_EXTERNAL_IP}; } mode = phase1_mode_idp; phase1ss = "all/all/all"; keytype = connkeytype_pre_shared; key = "${PSK}"; cert_do_server_auth = no; use_nat_t = yes; use_xauth = no; use_cfgmode = no; phase2localid { ipnet { ipaddr = 192.168.178.0; mask = 255.255.255.0; } } phase2remoteid { ipnet { ipaddr = 10.0.1.0; mask = 255.255.255.0; } } phase2ss = "esp-all-all/ah-none/comp-all/pfs"; accesslist = "permit ip any 10.0.1.0 255.255.255.0"; } ike_forward_rules = "udp 0.0.0.0:500 0.0.0.0:500", "udp 0.0.0.0:4500 0.0.0.0:4500"; }
Create S2S VPN connection on Fritz!Box
Broken since Fritz!Box UI does not provide option to set phase1 mode to main
Fritz!Box Admin Internet > Freigaben > VPN VPN-Verbindung hinzufügen Ihr Heimnetz mit einem anderen FRITZ!Box-Netzwerk verbinden (LAN-LAN-Kopplung) VPN-Kennwort (Preshared Key): <psk> Internet-Adresse: OpenStack VPN Services IPv4
Delete OpenStack VPNaaS
PROJECT_ID=xxxxxxxxxxxxxx openstack vpn ipsec site connection list --long | grep ${PROJECT_ID} openstack vpn ipsec site connection delete ${IPSEC_SITE_CONNECTION_ID} openstack vpn endpoint group list --long | grep ${PROJECT_ID} openstack vpn endpoint group delete ${VPN_ENDPOINT_CIDR_GROUP_ID} ${VPN_ENDPOINT_SUBNET_GROUP_ID} openstack vpn service list --long | grep ${PROJECT_ID} openstack vpn service delete ${VPN_SERVICE_ID} openstack vpn ipsec policy list --long | grep ${PROJECT_ID} openstack vpn ipsec policy delete ${VPN_IPSEC_POLICY_ID} openstack vpn ike policy list --long | grep ${PROJECT_ID} openstack vpn ike policy delete ${VPN_IKE_POLICY_ID}
Links
https://docs.openstack.org/neutron/rocky/admin/vpnaas-scenario.html
https://hit-systemhaus.net/2015/12/01/securepoint-ipsec-vpn-zu-avm-fritzbox/
https://docs.openstack.org/neutron/rocky/admin/vpnaas-scenario.html
https://mlohr.com/fritzbox-lan-2-lan-vpn-with-pfsense/
https://docs.netgate.com/pfsense/en/latest/troubleshooting/ipsec.html