PLC/vPLC>> strongswan-host-2-host-sandbox>> 返回
项目作者： githubfoam

项目描述 ：
strongswan IPsec VPN tunnel Pre-shared Keys (PSK)
高级语言：
项目地址: git://github.com/githubfoam/strongswan-host-2-host-sandbox.git
创建时间： 2020-02-16T12:17:47Z
项目社区：https://github.com/githubfoam/strongswan-host-2-host-sandbox
开源协议：GNU General Public License v3.0
下载


IPSec VPN Host to Host (without NAT)

WEST

  2. vagrant@west-01:
  3. sudo cp /etc/ipsec.conf /etc/ipsec.conf.orig
  5. cat<<EOF | sudo tee /etc/ipsec.conf
  6. conn west-to-east
  7.     authby=secret
  8.     auto=route
  9.     keyexchange=ike
  10.     left=192.168.1.120
  11.     right=192.168.1.121
  12.     type=transport
  13.     esp=aes128gcm16!
  14. EOF
  16. sudo cp /etc/ipsec.secrets /etc/ipsec.secrets.orig
  18. cat<<EOF | sudo tee /etc/ipsec.secrets
  19. 192.168.1.120 192.168.1.121 : PSK "vagrant"
  20. EOF
  22. sudo ipsec restart
  23. sudo ipsec statusall

EAST

  3. vagrant@east-01:~$
  5. sudo cp /etc/ipsec.conf /etc/ipsec.conf.orig
  7. cat<<EOF | sudo tee /etc/ipsec.conf
  8. conn east-to-west
  9.     authby=secret
  10.     auto=route
  11.     keyexchange=ike
  12.     left=192.168.1.121
  13.     right=192.168.1.120
  14.     type=transport
  15.     esp=aes128gcm16!
  16. EOF
  18. sudo cp /etc/ipsec.secrets /etc/ipsec.secrets.orig
  20. cat<<EOF | sudo tee /etc/ipsec.secrets
  21. 192.168.1.120 192.168.1.121 : PSK "vagrant"
  22. EOF
  24. sudo ipsec restart
  25. sudo ipsec statusall

smoke tests

  2. LEFT-WEST
  4. vagrant@west-01::~/strongswan-5.8.2$ ping -s 4048 192.168.1.121
  7. RIGHT-EAST
  9. vagrant@east-01:~/strongswan-5.8.2$ sudo watch ipsec statusall
  10. Every 2.0s: ipsec statusall                                                                                                                                 east-01: Sun Feb 16 18:48:07 2020
  11. Status of IKE charon daemon (strongSwan 5.8.2, Linux 5.0.0-37-generic, x86_64):
  12.   uptime: 33 seconds, since Feb 16 18:47:34 2020
  13.   malloc: sbrk 2146304, mmap 0, used 425408, free 1720896
  14.   worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 3
  15.   loaded plugins: charon aes des rc2 sha2 sha1 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem fips-prf gmp curve25519 xcbc cmac hmac drbg attr kernel-netlink resolve socket-default stroke vici updown xauth-generic counters
  16. Listening IP addresses:
  17.   10.0.2.15
  18.   192.168.1.121
  19. Connections:
  20. east-to-west:  192.168.1.121...192.168.1.120  IKEv1/2
  21. east-to-west:   local:  [192.168.1.121] uses pre-shared key authentication
  22. east-to-west:   remote: [192.168.1.120] uses pre-shared key authentication
  23. east-to-west:   child:  dynamic === dynamic TRANSPORT
  24. Routed Connections:
  25. east-to-west{1}:  ROUTED, TRANSPORT, reqid 1
  26. east-to-west{1}:   192.168.1.121/32 === 192.168.1.120/32
  27. Security Associations (1 up, 0 connecting):
  28. east-to-west[1]: ESTABLISHED 21 seconds ago, 192.168.1.121[192.168.1.121]...192.168.1.120[192.168.1.120]
  29. east-to-west[1]: IKEv2 SPIs: 890f31a2573445ec_i 8526fa4155f6c299_r*, pre-shared key reauthentication in 2 hours
  30. east-to-west[1]: IKE proposal: AES_CBC_128/HMAC_SHA2_256_128/PRF_AES128_XCBC/CURVE_25519
  31. east-to-west{2}:  INSTALLED, TRANSPORT, reqid 1, ESP SPIs: cbb690a7_i c45ce6ae_o
  32. east-to-west{2}:  AES_GCM_16_128, 81120 bytes_i (20 pkts, 1s ago), 81120 bytes_o (20 pkts, 1s ago), rekeying in 44 minutes
  33. east-to-west{2}:   192.168.1.121/32 === 192.168.1.120/32
  36. vagrant@east-01:~$ sudo tcpdump esp -i eth1
  37. tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
  38. listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes
  39. 18:48:56.337730 IP west-01.local > east-01.local: ESP(spi=0xcbb690a7,seq=0x45), length 1440
  40. 18:48:56.337787 IP west-01.local > east-01.local: esp
  41. 18:48:56.337805 IP west-01.local > east-01.local: esp
  42. 18:48:56.337870 IP east-01.local > west-01.local: ESP(spi=0xc45ce6ae,seq=0x45), length 1440
  43. 18:48:56.337923 IP east-01.local > west-01.local: esp
  44. 18:48:56.337933 IP east-01.local > west-01.local: esp
  45. 18:48:57.362834 IP west-01.local > east-01.local: ESP(spi=0xcbb690a7,seq=0x46), length 1440
  46. 18:48:57.362876 IP west-01.local > east-01.local: esp
  47. 18:48:57.362880 IP west-01.local > east-01.local: esp
  48. 18:48:57.363036 IP east-01.local > west-01.local: ESP(spi=0xc45ce6ae,seq=0x46), length 1440
  49. 18:48:57.363152 IP east-01.local > west-01.local: esp
  50. 18:48:57.363178 IP east-01.local > west-01.local: esp
  51. ^C
  52. 12 packets captured
  53. 12 packets received by filter
  54. 0 packets dropped by kernel