… | |
… | |
9 | Vpe is a suite designed to provide a virtual private network for |
9 | Vpe is a suite designed to provide a virtual private network for |
10 | multiple nodes over an untrusted network. |
10 | multiple nodes over an untrusted network. |
11 | |
11 | |
12 | "Virtual" means that no physical network is created (of course), but an |
12 | "Virtual" means that no physical network is created (of course), but an |
13 | ethernet is emulated by creating multiple tunnels between the member |
13 | ethernet is emulated by creating multiple tunnels between the member |
|
|
14 | nodes. |
|
|
15 | |
14 | nodes. "Private" means that non-participating nodes cannot decode |
16 | "Private" means that non-participating nodes cannot decode ("sniff)" nor |
15 | ("sniff)" nor inject ("spoof") packets. In the case of vpe, even |
17 | inject ("spoof") packets. |
16 | participating nodes cannot spoof packets from other nodes. And "network" |
18 | |
17 | means that more than two parties - many so-called vpn solutions only |
19 | In the case of vpe, even participating nodes cannot sniff packets send |
18 | create point-to-point tunnels - can participate in the network, so it's |
20 | to other nodes or spoof packets as if sent from other nodes. |
19 | possible to connect multiple branches of a company into a single |
21 | |
20 | network. |
22 | "Network" means that more than two parties can participate in the |
|
|
23 | network, so for instance it's possible to connect multiple branches of a |
|
|
24 | company into a single network. Many so-called "vpn" solutions only |
|
|
25 | create point-to-point tunnels. |
21 | |
26 | |
22 | |
27 | |
23 | == DESIGN GOALS == |
28 | == DESIGN GOALS == |
24 | |
29 | |
25 | : SIMPLE DESIGN |
30 | : SIMPLE DESIGN |
… | |
… | |
41 | |
46 | |
42 | |
47 | |
43 | ==== PROGRAMS ==== |
48 | ==== PROGRAMS ==== |
44 | |
49 | |
45 | Vpe comes with two programs: one daemon (``vped'') and one control |
50 | Vpe comes with two programs: one daemon (``vped'') and one control |
46 | program ``vpectrl''). |
51 | program (``vpectrl''). |
47 | |
52 | |
48 | : vpectrl |
53 | : vpectrl |
49 | Is used to generate the keys and give an overview of the |
54 | Is used to generate the keys, check and give an overview of of the |
50 | configuration. |
55 | configuration and contorl the daemon (restarting etc.). |
51 | |
56 | |
52 | : vped |
57 | : vped |
53 | Is the daemon used to establish and maintain conenctions to the |
58 | Is the daemon used to establish and maintain conenctions to the |
54 | other network members. It should be run on the gateway machine. |
59 | other network members. It should be run on the gateway machine. |
55 | |
60 | |
56 | |
61 | |
57 | ==== CONFIGURING VPE ==== |
62 | ==== COMPILETIME CONFIGURATION ==== |
58 | |
63 | |
59 | Here are a few recipes for configuring your vpe: |
64 | Here are a few recipes for compiling your vpe: |
60 | |
65 | |
61 | |
66 | |
62 | == AS LOW PACKET OVERHEAD AS POSSIBLE == |
67 | == AS LOW PACKET OVERHEAD AS POSSIBLE == |
63 | |
68 | |
64 | ./configure --enable-hmac-length=4 --enable-rand-length=0 |
69 | ./configure --enable-hmac-length=4 --enable-rand-length=0 |
65 | |
70 | |
66 | Minimize the header overhead of VPN packets. |
71 | Minimize the header overhead of VPN packets (the above will result in |
|
|
72 | only 4 bytes of overhead over the raw ethernet frame). |
67 | |
73 | |
68 | |
74 | |
69 | == MINIMIZE CPU TIME REQUIRED == |
75 | == MINIMIZE CPU TIME REQUIRED == |
70 | |
76 | |
71 | ./configure --enable-cipher=bf --enable-digest=md4 |
77 | ./configure --enable-cipher=bf --enable-digest=md4 |
72 | |
78 | |
73 | Use the fastest cipher and digest algorithms. |
79 | Use the fastest cipher and digest algorithms currently available in vpe. |
74 | |
80 | |
75 | |
81 | |
76 | == MAXIMIZE SECURITY == |
82 | == MAXIMIZE SECURITY == |
77 | |
83 | |
78 | ./configure --enable-hmac-length=16 --enable-rand-length=8 --enable-digest=sha1 |
84 | ./configure --enable-hmac-length=16 --enable-rand-length=8 --enable-digest=sha1 |
|
|
85 | |
|
|
86 | This uses a 16 byte HMAC checksum to authenticate packets (I guess 8-12 |
|
|
87 | would also be pretty secure ;) and will additionally prefix each packet |
|
|
88 | with 8 bytes of random data. |
79 | |
89 | |
80 | In general, remember that AES-128 seems to be more secure and faster |
90 | In general, remember that AES-128 seems to be more secure and faster |
81 | than AES-192 or AES-256, more randomness and longer hmac is more secure, |
91 | than AES-192 or AES-256, more randomness helps against sniffing and a |
82 | MD4 is a fast digest, SHA1 or RIPEMD160 are better, and Blowfish is a |
92 | longer HMAC helps against spoofing. MD4 is a fast digest, SHA1 or |
83 | fast and so-far quite secure cipher. |
93 | RIPEMD160 are better, and Blowfish is a fast cipher (and also quite |
|
|
94 | secure). |
84 | |
95 | |
85 | |
96 | |
86 | ==== HOW TO SET UP A SIMPLE VPN ==== |
97 | ==== HOW TO SET UP A SIMPLE VPN ==== |
87 | |
98 | |
88 | In this section I will describe how to get a simple VPN consisting of |
99 | In this section I will describe how to get a simple VPN consisting of |
… | |
… | |
96 | you configured vpe, and can be overwritten using the ``-c'' commandline |
107 | you configured vpe, and can be overwritten using the ``-c'' commandline |
97 | switch. |
108 | switch. |
98 | |
109 | |
99 | Put the following lines into ``/etc/vpe/vped.conf'': |
110 | Put the following lines into ``/etc/vpe/vped.conf'': |
100 | |
111 | |
101 | udp-port = 50000 # the external port to listen on (configure your firewall) |
112 | udp-port = 50000 # the external port to listen on (configure your firewall) |
102 | mtu = 1400 # minimum MTU of all outgoing interfaces on all hosts |
113 | mtu = 1400 # minimum MTU of all outgoing interfaces on all hosts |
103 | ifname = vpn0 # the local network device name |
114 | ifname = vpn0 # the local network device name |
104 | |
115 | |
105 | node = first # just a nickname |
116 | node = first # just a nickname |
106 | hostname = first.example.net # the DNS name or IP address of the host |
117 | hostname = first.example.net # the DNS name or IP address of the host |
107 | |
118 | |
108 | node = second |
119 | node = second |
109 | hostname = 133.55.82.9 |
120 | hostname = 133.55.82.9 |
110 | |
121 | |
111 | node = third |
122 | node = third |
112 | hostname = third.example.net |
123 | hostname = third.example.net |
113 | |
124 | |
114 | The only other file neccessary if the ``if-up'' script that initializes |
125 | The only other file neccessary if the ``if-up'' script that initializes |
115 | the local ethernet interface. Put the following lines into |
126 | the local ethernet interface. Put the following lines into |
116 | ``/etc/vpe/if-up'' and make it execute (``chmod 755 /etc/vpe/if-up''): |
127 | ``/etc/vpe/if-up'' and make it execute (``chmod 755 /etc/vpe/if-up''): |
117 | |
128 | |
118 | #!/bin/sh |
129 | #!/bin/sh |
119 | ip link set $IFNAME address $MAC mtu $MTU up |
130 | ip link set $IFNAME address $MAC mtu $MTU up |
120 | [ $NODENAME = first ] && ip addr add 10.0.1.1 dev $IFNAME |
131 | [ $NODENAME = first ] && ip addr add 10.0.1.1 dev $IFNAME |
121 | [ $NODENAME = second ] && ip addr add 10.0.2.1 dev $IFNAME |
132 | [ $NODENAME = second ] && ip addr add 10.0.2.1 dev $IFNAME |
122 | [ $NODENAME = third ] && ip addr add 10.0.3.1 dev $IFNAME |
133 | [ $NODENAME = third ] && ip addr add 10.0.3.1 dev $IFNAME |
123 | ip route add 10.0.0.0/16 dev $IFNAME |
134 | ip route add 10.0.0.0/16 dev $IFNAME |
124 | |
135 | |
125 | This script will give each node a different IP address in the |
136 | This script will give each node a different IP address in the |
126 | ``10.0/16'' network. The internal network (e.g. the ``eth0'' interface) |
137 | ``10.0/16'' network. The internal network (e.g. the ``eth0'' interface) |
127 | should then be set to a subset of that network, e.g. ``10.0.1.0/24'' on |
138 | should then be set to a subset of that network, e.g. ``10.0.1.0/24'' on |
128 | node ``first'', ``10.0.2.0/24'' on node ``second'', and so on. |
139 | node ``first'', ``10.0.2.0/24'' on node ``second'', and so on. |
… | |
… | |
136 | == STEP 2: create the RSA key pairs for all hosts == |
147 | == STEP 2: create the RSA key pairs for all hosts == |
137 | |
148 | |
138 | Run the following command to generate all key pairs (that might take a |
149 | Run the following command to generate all key pairs (that might take a |
139 | while): |
150 | while): |
140 | |
151 | |
141 | vpectrl -c /etc/vpe -g |
152 | vpectrl -c /etc/vpe -g |
142 | |
153 | |
143 | This command will put the public keys into |
154 | This command will put the public keys into |
144 | ``/etc/vpe/pubkeys/*nodename*'' and the private keys into |
155 | ``/etc/vpe/pubkeys/*nodename*'' and the private keys into |
145 | ``/etc/vpe/hostkeys/*nodename*''. |
156 | ``/etc/vpe/hostkeys/*nodename*''. |
146 | |
157 | |
… | |
… | |
151 | in two steps, since the private keys should not be distributed. The |
162 | in two steps, since the private keys should not be distributed. The |
152 | example uses rsync-over-ssh |
163 | example uses rsync-over-ssh |
153 | |
164 | |
154 | First all the config files without the hostkeys should be distributed: |
165 | First all the config files without the hostkeys should be distributed: |
155 | |
166 | |
156 | rsync -avzessh /etc/vpe first.example.net:/etc/. --exclude hostkeys |
167 | rsync -avzessh /etc/vpe first.example.net:/etc/. --exclude hostkeys |
157 | rsync -avzessh /etc/vpe 133.55.82.9:/etc/. --exclude hostkeys |
168 | rsync -avzessh /etc/vpe 133.55.82.9:/etc/. --exclude hostkeys |
158 | rsync -avzessh /etc/vpe third.example.net:/etc/. --exclude hostkeys |
169 | rsync -avzessh /etc/vpe third.example.net:/etc/. --exclude hostkeys |
159 | |
170 | |
160 | Then the hostkeys should be copied: |
171 | Then the hostkeys should be copied: |
161 | |
172 | |
162 | rsync -avzessh /etc/vpe/hostkeys/first first.example.net:/etc/hostkey |
173 | rsync -avzessh /etc/vpe/hostkeys/first first.example.net:/etc/hostkey |
163 | rsync -avzessh /etc/vpe/hostkeys/second 133.55.82.9:/etc/hostkey |
174 | rsync -avzessh /etc/vpe/hostkeys/second 133.55.82.9:/etc/hostkey |
164 | rsync -avzessh /etc/vpe/hostkeys/third third.example.net:/etc/hostkey |
175 | rsync -avzessh /etc/vpe/hostkeys/third third.example.net:/etc/hostkey |
165 | |
176 | |
166 | You should now check the configration by issuing the command ``vpectrl |
177 | You should now check the configration by issuing the command ``vpectrl |
167 | -c /etc/vpe -s'' on each node and verify it's output. |
178 | -c /etc/vpe -s'' on each node and verify it's output. |
168 | |
179 | |
169 | |
180 | |
170 | == STEP 4: starting vped == |
181 | == STEP 4: starting vped == |
171 | |
182 | |
172 | You should then start vped on each node by issuing a command like: |
183 | You should then start vped on each node by issuing a command like: |
173 | |
184 | |
174 | vped -D -linfo first # first is the nodename |
185 | vped -D -linfo first # first is the nodename |
175 | |
186 | |
176 | This will make the vped stay in foreground. You should then see |
187 | This will make the vped stay in foreground. You should then see |
177 | "connection established" messages. If you don't see them check your |
188 | "connection established" messages. If you don't see them check your |
178 | firewall and routing (use tcpdump ;). |
189 | firewall and routing (use tcpdump ;). |
179 | |
190 | |
… | |
… | |
182 | |
193 | |
183 | To make vped run more permanently you can either run it as a daemon (by |
194 | To make vped run more permanently you can either run it as a daemon (by |
184 | starting it without the ``-D'' switch), or, much better, from your |
195 | starting it without the ``-D'' switch), or, much better, from your |
185 | inittab. I use a line like this on my systems: |
196 | inittab. I use a line like this on my systems: |
186 | |
197 | |
187 | t1:2345:respawn:/opt/vpe/sbin/vped -D -L first >/dev/null 2>&1 |
198 | t1:2345:respawn:/opt/vpe/sbin/vped -D -L first >/dev/null 2>&1 |
188 | |
199 | |
189 | |
200 | |
190 | == STEP 5: enjoy == |
201 | == STEP 5: enjoy == |
191 | |
202 | |
192 | ... and play around. Sending a -HUP (``vpectrl -kHUP'') to the daemon |
203 | ... and play around. Sending a -HUP (``vpectrl -kHUP'') to the daemon |