vpn | panticz.de

OpenStack: VPNaaS (VPN)

# show VPN objects
openstack vpn ipsec site connection list
openstack vpn endpoint group list
openstack vpn service list
openstack vpn ipsec policy list
openstack vpn ike policy list

# show IP
openstack vpn service list --long
openstack vpn service list -c ID -f value | xargs -i openstack vpn service show {}
openstack vpn ipsec site connection list -c ID -f value | xargs -L1 openstack vpn ipsec site connection show

Restart VPN

openstack vpn ipsec site connection set --disable vpn-conn1
openstack vpn ipsec site connection set --enable vpn-conn1

Check VPN peer address

PRIVATE_PEER_ADDRESSES=$(openstack vpn ipsec site connection list -c "Peer Address" -f value | egrep "^10.|^172.|^192.")
for PRIVATE_PEER_ADDRESSE in ${PRIVATE_PEER_ADDRESSES}; do
    echo "PRIVATE_PEER_ADDRESSES: ${PRIVATE_PEER_ADDRESSE}"

    CONNECTION_ID=$(openstack vpn ipsec site connection list | grep ${PRIVATE_PEER_ADDRESSE} | cut -d" " -f2)
    openstack vpn ipsec site connection show ${CONNECTION_ID}

    VPN_SERVICE_ID=$(openstack vpn ipsec site connection show ${CONNECTION_ID} -c "VPN Service" -f value)
    openstack vpn service show ${VPN_SERVICE_ID}

    PROJECT_ID=$(openstack vpn service show ${VPN_SERVICE_ID} -c project_id -f value)
    openstack project show ${PROJECT_ID}
done

OpenStack IpSec VPN ports

UDP 500
UDP 4500
ESP IP Protocol 50

IPSec VPN – Diffie-Hellman Groups

DH Group 1:    768-bit Key
DH Group 2:   1024-bit Key
DH Group 5:   1536-bit Key
DH Group 14:  2048-bit Key

Links
https://docs.openstack.org/neutron/rocky/admin/vpnaas-scenario.html

sshuttle

Install sshuttle with python3 support
#https://packages.ubuntu.com/xenial/net/sshuttle
https://packages.ubuntu.com/groovy/all/sshuttle/download

# install from PIP
pip3 install sshuttle

# backport from APT mirror
wget http://mirrors.kernel.org/ubuntu/pool/universe/s/sshuttle/sshuttle_1.0.4-1ubuntu4_all.deb -O /tmp/
wget http://mirrors.kernel.org/ubuntu/pool/main/s/sphinx/libjs-sphinxdoc_3.2.1-1_all.deb -O /tmp/
sudo dpkg -i /tmp/*.deb
sudo apt-get install -y sshuttle

Install under Ubuntu 20.04 in virtualenv
https://bugs.launchpad.net/ubuntu/+source/sshuttle/+bug/1887489

sudo apt install -y python3-virtualenv

mkdir -p ~/bin/python2
cd ~/bin/python2
virtualenv .
./bin/pip install sshuttle

# execute
~/bin/python2/bin/sshuttle --remote  ...

Optionally add to sudoers file:

sshuttle --sudoers

Execute

sshuttle \
  --dns \
  --remote foo@example.com \
  10.0.0.0/8 \
  192.168.10.0/24 \
  --exclude 192.168.178.0/24 \
  --exclude 192.168.1.200/32 \
  --exclude 192.168.178.0/24

Linux
https://github.com/sshuttle/sshuttle
https://sshuttle.readthedocs.io/en/stable/
https://sshuttle.readthedocs.io/en/stable/windows.html

openconnect

echo pass1234 | openconnect --no-cert-check vpn.example.com --user foo

start-stop-daemon --start --make-pidfile --pidfile "${VPNPID}" \
            --stderr "${VPNERRFILE}" --stdout "${VPNLOGFILE}" \
            --background --exec /bin/bash \
            -- -c "exec /usr/sbin/openconnect --pid-file=\"${VPNPID}\" ${!VPNOPTS} ${!SERVER} <<< \`echo \"${!PASSWORD}\"\`"

# Custom script
# cat /etc/vpnc/post-connect.d/route 
#!/bin/bash

ip route del default
ip route add default via 10.0.17.254
ip route add 120.1.0.0/16 dev tun0 scope link

Install SSH VPN server

export CONTAINER=vpn

# create container
# TODO: configure MAC on create container
wget -q --no-check-certificate https://raw.githubusercontent.com/panticz/lxc/master/create.jessie.sh -O - | bash -s -- -f

# configure container MAC address
sed -i 's|lxc.network.hwaddr = .*|lxc.network.hwaddr = 00:11:22:33:44:5e|' /var/lib/lxc/${CONTAINER}/config

# enable autostart
echo "lxc.start.auto = 1" | tee -a /var/lib/lxc/${CONTAINER}/config

# configure container
##echo "lxc.hook.autodev=/var/lib/lxc/vpn/autodev" >> /var/lib/lxc/${CONTAINER}/config
#echo "lxc.cgroup.devices.allow = c 10:200 rwm" >> /var/lib/lxc/${CONTAINER}/config

# do we need this outside of container?
#cat < /var/lib/lxc/${CONTAINER}/autodev 
##!/bin/bash

# dep
#cd \${LXC_ROOTFS_MOUNT}/dev
#mkdir net
#mknod net/tun c 10 200
#chmod 0666 net/tun
#EOF
#chmod +x /var/lib/lxc/${CONTAINER}/autodev

# configure SSH access
# generating SSH key for root
sudo lxc-attach -n ${CONTAINER} -- ssh-keygen -q -f /root/.ssh/id_rsa -N ''

# disable SSH password login
sudo lxc-attach -n ${CONTAINER} -- sed -i 's|[#]*PasswordAuthentication yes|PasswordAuthentication no|g' /etc/ssh/sshd_config
sudo lxc-attach -n ${CONTAINER} -- sed -i 's|UsePAM yes|UsePAM no|g' /etc/ssh/sshd_config
sudo lxc-attach -n ${CONTAINER} -- service ssh restart

# configure SSH server
echo "PermitTunnel yes" >> /var/lib/lxc/${CONTAINER}/rootfs/etc/ssh/sshd_config
# do we need this?
###sed -i 's|#   Tunnel no|    Tunnel no|' /var/lib/lxc/${CONTAINER}/rootfs/etc/ssh/ssh_config
sed -i 's|#   TunnelDevice any:any|    TunnelDevice any:any|' /var/lib/lxc/${CONTAINER}/rootfs/etc/ssh/ssh_config
#sudo lxc-attach -n ${CONTAINER} -- service ssh restart

# enable forwarding
sed -i 's|#net.ipv4.ip_forward=1|net.ipv4.ip_forward=1|' /var/lib/lxc/${CONTAINER}/rootfs/etc/sysctl.conf
# echo "1" > /proc/sys/net/ipv4/ip_forward

# load iptables module (on LXC host)
sudo echo 'ip_tables' >> /etc/modules

vpn