[strongSwan] IPTables rules for Strongswan gateway on Internet gateway

[Willem-Jan Meijer]

Hello all,

Currently i'm using PPTPD as VPN-server which is working fine, but I want to
migrate to Strongswan IPSec to improve security.

I'll try to describe the situation:

-Debian server acting as internet gateway (router) with services like
iptables apache, postfix, ftp and so on.
	-eth0 is the WAN interface with an external IP-address proivded by
ISP, 92.108.xxx.xxx ($EXTIF, $EXTIP)
	-eth1 is the LAN interface with a static IP-address 192.168.50.1
($INTIF, $INTIP)

Behind eth1 there's a home network with Windows 7 clients which have
IP-addresses assigned by DHCP in the range 192.168.50.100 - 192.168.50.150
Roadwarriors connect to the Debian server. For example. The road warrior
running Windows 7 dials up to "home" and gets an IP-address in the range
192.168.50.234-192.168.238.
When I do ifconfig from the terminal, I see PPTPD bringing up ppp+ tunnel
devices

For PPTPD, I created the following IPTable-rules:


# Accept all packets via ppp* interfaces (for example, ppp0)
$IPTABLES -A INPUT -i ppp+ -j ACCEPT
$IPTABLES -A OUTPUT -o ppp+ -j ACCEPT

# Accept incoming connections to port 1723 (PPTP)
$IPTABLES -A INPUT -p tcp --dport 1723 -j ACCEPT

# Accept GRE packets
$IPTABLES -A INPUT -p 47 -j ACCEPT
$IPTABLES -A OUTPUT -p 47 -j ACCEPT

# Enable IP forwarding
$IPTABLES -F FORWARD
$IPTABLES -A FORWARD -j ACCEPT

# Enable NAT for eth0 и ppp* interfaces
$IPTABLES -A POSTROUTING -t nat -o eth0 -j MASQUERADE
$IPTABLES -A POSTROUTING -t nat -o ppp+ -j MASQUERADE

With this configuration, roadwarriors are able to communicate with the home
LAN and use shared folders like they are at home, my main purpose of setting
up VPN.

Now i'm setting up Strongswan to achieve the same: LAN-browsing.

I ended up with the next configuration file:

# ipsec.conf - strongSwan IPsec configuration file

config setup
	# uniqueids=never
	charondebug="cfg 2, dmn 2, ike 2, net 2"

conn %default
	keyexchange=ikev2
	
ike=aes128-sha256-ecp256,aes256-sha384-ecp384,aes128-sha256-modp2048,aes128-
sha1-modp2048,aes256-sha384-modp4096,aes256-sha256-modp4096,aes256-sha1-modp
4096,aes128-sha256-modp1536,aes128-sha1-modp1536,aes256-sha384-modp2048,aes2
56-sha256-modp2048,aes256-sha1-modp2048,aes128-sha256-modp1024,aes128-sha1-m
odp1024,aes256-sha384-modp1536,aes256-sha256-modp1536,aes256-sha1-modp1536,a
es256-sha384-modp1024,aes256-sha256-modp1024,aes256-sha1-modp1024!
	
esp=aes128gcm16-ecp256,aes256gcm16-ecp384,aes128-sha256-ecp256,aes256-sha384
-ecp384,aes128-sha256-modp2048,aes128-sha1-modp2048,aes256-sha384-modp4096,a
es256-sha256-modp4096,aes256-sha1-modp4096,aes128-sha256-modp1536,aes128-sha
1-modp1536,aes256-sha384-modp2048,aes256-sha256-modp2048,aes256-sha1-modp204
8,aes128-sha256-modp1024,aes128-sha1-modp1024,aes256-sha384-modp1536,aes256-
sha256-modp1536,aes256-sha1-modp1536,aes256-sha384-modp1024,aes256-sha256-mo
dp1024,aes256-sha1-modp1024,aes128gcm16,aes256gcm16,aes128-sha256,aes128-sha
1,aes256-sha384,aes256-sha256,aes256-sha1!
	dpdaction=clear
	dpddelay=300s
	rekey=no
	left=%any
	leftsubnet=0.0.0.0/0
	leftcert=vpnHostCert.pem
	leftid=@vpn.xxxxxxx.nl
	leftfirewall=yes
	right=%any
	rightsourceip=10.10.10.0/24
	rightsubnet=10.10.10.0/24
	rightdns=192.192.168.50.1
	
conn IPSec-IKEv2
	keyexchange=ikev2
	auto=add

conn IPSec-IKEv2-EAP
	also="IPSec-IKEv2"
	rightauth=eap-mschapv2
	rightsendcert=never
	eap_identity=%any
	auto=add

In the IPTables script, I added the following lines:

# IPSec connections

$IPTABLES -A INPUT -p UDP --dport 500 -j ACCEPT
$IPTABLES -A INPUT -p UDP --dport 4500 -j ACCEPT
$IPTABLES -A INPUT -p ESP -j ACCEPT
$IPTABLES -A INPUT -p 50 -j ACCEPT
$IPTABLES -A INPUT -p 51 -j ACCEPT

$IPTABLES -t nat -A POSTROUTING -s 10.10.10.0/24 -o $EXTIF -m policy --dir
out --pol ipsec -j ACCEPT
$IPTABLES -t nat -A POSTROUTING -s 10.10.10.0/24 -o $EXTIF -j MASQUERADE

But from here, I get stuck. The road warrior is able to bring up the
connection, however, even a ping from the debian server fails. I suppose the
problem is in my IPTables-script but i'm not an IPTables master. Can someone
point me in the right direction to create the iptables rules to be able to
browse my lan from the road warriors?

Attached you will find the full iptables script and ipsec.conf file

Kind regards,
Willem-Jan Meijer
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: iptables.txt
URL: <http://lists.strongswan.org/pipermail/users/attachments/20151130/3db5bc47/attachment.txt>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: ipsec.conf.txt
URL: <http://lists.strongswan.org/pipermail/users/attachments/20151130/3db5bc47/attachment-0001.txt>