ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/doc/vpe.pod
(Generate patch)

Comparing gvpe/doc/vpe.pod (file contents):
Revision 1.1 by pcg, Sun Mar 23 14:47:39 2003 UTC vs.
Revision 1.2 by pcg, Mon Mar 24 15:20:24 2003 UTC

… …
43=back 43=back
44 44
45=head1 PROGRAMS 45=head1 PROGRAMS
46 46
47Vpe comes with two programs: one daemon (C<vped>) and one control program 47Vpe comes with two programs: one daemon (C<vped>) and one control program
48C<vpectrl>). 48(C<vpectrl>).
49 49
50=over 4 50=over 4
51 51
52=item vpectrl 52=item vpectrl
53 53
54Is used to generate the keys and give an overview of the configuration. 54Is used to generate the keys, check and give an overview of of the
55configuration and contorl the daemon (restarting etc.).
55 56
56=item vped 57=item vped
57 58
58Is the daemon used to establish and maintain conenctions to the other 59Is the daemon used to establish and maintain conenctions to the other
59network members. It should be run on the gateway machine. 60network members. It should be run on the gateway machine.
60 61
61=back 62=back
62 63
63=head1 CONFIGURING VPE 64=head1 COMPILETIME CONFIGURATION
64 65
65Here are a few recipes for configuring your vpe: 66Here are a few recipes for compiling your vpe:
66 67
67=head2 AS LOW PACKET OVERHEAD AS POSSIBLE 68=head2 AS LOW PACKET OVERHEAD AS POSSIBLE
68 69
69 ./configure --enable-hmac-length=4 --enable-rand-length=0 70 ./configure --enable-hmac-length=4 --enable-rand-length=0
70 71
71Minimize the header overhead of VPN packets. 72Minimize the header overhead of VPN packets (the above will result in only
734 bytes of overhead over the raw ethernet frame).
72 74
73=head2 MINIMIZE CPU TIME REQUIRED 75=head2 MINIMIZE CPU TIME REQUIRED
74 76
75 ./configure --enable-cipher=bf --enable-digest=md4 77 ./configure --enable-cipher=bf --enable-digest=md4
76 78
77Use the fastest cipher and digest algorithms. 79Use the fastest cipher and digest algorithms currently available in vpe.
78 80
79=head2 MAXIMIZE SECURITY 81=head2 MAXIMIZE SECURITY
80 82
81 ./configure --enable-hmac-length=16 --enable-rand-length=8 --enable-digest=sha1 83 ./configure --enable-hmac-length=16 --enable-rand-length=8 --enable-digest=sha1
84
85This uses a 16 byte HMAC checksum to authenticate packets (I guess 8-12
86would also be pretty secure ;) and will additionally prefix each packet
87with 8 bytes of random data.
82 88
83In general, remember that AES-128 seems to be more secure and faster than 89In general, remember that AES-128 seems to be more secure and faster than
84AES-192 or AES-256, more randomness and longer hmac is more secure, MD4 is 90AES-192 or AES-256, more randomness helps against sniffing and a longer
85a fast digest, SHA1 or RIPEMD160 are better, and Blowfish is a fast and 91HMAC helps against spoofing. MD4 is a fast digest, SHA1 or RIPEMD160 are
86so-far quite secure cipher. 92better, and Blowfish is a fast cipher (and also quite secure).
87 93
88=head1 HOW TO SET UP A SIMPLE VPN 94=head1 HOW TO SET UP A SIMPLE VPN
89 95
90In this section I will describe how to get a simple VPN consisting of 96In this section I will describe how to get a simple VPN consisting of
91three hosts up and running. 97three hosts up and running.
… …
96configuration directory. This is usually C</etc/vpe>, depending on how you 102configuration directory. This is usually C</etc/vpe>, depending on how you
97configured vpe, and can be overwritten using the C<-c> commandline switch. 103configured vpe, and can be overwritten using the C<-c> commandline switch.
98 104
99Put the following lines into C</etc/vpe/vped.conf>: 105Put the following lines into C</etc/vpe/vped.conf>:
100 106
101 udp-port = 50000 # the external port to listen on (configure your firewall) 107 udp-port = 50000 # the external port to listen on (configure your firewall)
102 mtu = 1400 # minimum MTU of all outgoing interfaces on all hosts 108 mtu = 1400 # minimum MTU of all outgoing interfaces on all hosts
103 ifname = vpn0 # the local network device name 109 ifname = vpn0 # the local network device name
104 110
105 node = first # just a nickname 111 node = first # just a nickname
106 hostname = first.example.net # the DNS name or IP address of the host 112 hostname = first.example.net # the DNS name or IP address of the host
107 113
108 node = second 114 node = second
109 hostname = 133.55.82.9 115 hostname = 133.55.82.9
110 116
111 node = third 117 node = third
112 hostname = third.example.net 118 hostname = third.example.net
113 119
114The only other file neccessary if the C<if-up> script that initializes the 120The only other file neccessary if the C<if-up> script that initializes the
115local ethernet interface. Put the following lines into C</etc/vpe/if-up> 121local ethernet interface. Put the following lines into C</etc/vpe/if-up>
116and make it execute (C<chmod 755 /etc/vpe/if-up>): 122and make it execute (C<chmod 755 /etc/vpe/if-up>):
117 123
118 #!/bin/sh 124 #!/bin/sh
119 ip link set $IFNAME address $MAC mtu $MTU up 125 ip link set $IFNAME address $MAC mtu $MTU up
120 [ $NODENAME = first ] && ip addr add 10.0.1.1 dev $IFNAME 126 [ $NODENAME = first ] && ip addr add 10.0.1.1 dev $IFNAME
121 [ $NODENAME = second ] && ip addr add 10.0.2.1 dev $IFNAME 127 [ $NODENAME = second ] && ip addr add 10.0.2.1 dev $IFNAME
122 [ $NODENAME = third ] && ip addr add 10.0.3.1 dev $IFNAME 128 [ $NODENAME = third ] && ip addr add 10.0.3.1 dev $IFNAME
123 ip route add 10.0.0.0/16 dev $IFNAME 129 ip route add 10.0.0.0/16 dev $IFNAME
124 130
125This script will give each node a different IP address in the C<10.0/16> 131This script will give each node a different IP address in the C<10.0/16>
126network. The internal network (e.g. the C<eth0> interface) should then be 132network. The internal network (e.g. the C<eth0> interface) should then be
127set to a subset of that network, e.g. C<10.0.1.0/24> on node C<first>, 133set to a subset of that network, e.g. C<10.0.1.0/24> on node C<first>,
128C<10.0.2.0/24> on node C<second>, and so on. 134C<10.0.2.0/24> on node C<second>, and so on.
… …
135=head2 STEP 2: create the RSA key pairs for all hosts 141=head2 STEP 2: create the RSA key pairs for all hosts
136 142
137Run the following command to generate all key pairs (that might take a 143Run the following command to generate all key pairs (that might take a
138while): 144while):
139 145
140 vpectrl -c /etc/vpe -g 146 vpectrl -c /etc/vpe -g
141 147
142This command will put the public keys into C<< 148This command will put the public keys into C<<
143/etc/vpe/pubkeys/I<nodename> >> and the private keys into C<< 149/etc/vpe/pubkeys/I<nodename> >> and the private keys into C<<
144/etc/vpe/hostkeys/I<nodename> >>. 150/etc/vpe/hostkeys/I<nodename> >>.
145 151
… …
148Now distribute the config files to the other nodes. This should be done in two steps, since the 154Now distribute the config files to the other nodes. This should be done in two steps, since the
149private keys should not be distributed. The example uses rsync-over-ssh 155private keys should not be distributed. The example uses rsync-over-ssh
150 156
151First all the config files without the hostkeys should be distributed: 157First all the config files without the hostkeys should be distributed:
152 158
153 rsync -avzessh /etc/vpe first.example.net:/etc/. --exclude hostkeys 159 rsync -avzessh /etc/vpe first.example.net:/etc/. --exclude hostkeys
154 rsync -avzessh /etc/vpe 133.55.82.9:/etc/. --exclude hostkeys 160 rsync -avzessh /etc/vpe 133.55.82.9:/etc/. --exclude hostkeys
155 rsync -avzessh /etc/vpe third.example.net:/etc/. --exclude hostkeys 161 rsync -avzessh /etc/vpe third.example.net:/etc/. --exclude hostkeys
156 162
157Then the hostkeys should be copied: 163Then the hostkeys should be copied:
158 164
159 rsync -avzessh /etc/vpe/hostkeys/first first.example.net:/etc/hostkey 165 rsync -avzessh /etc/vpe/hostkeys/first first.example.net:/etc/hostkey
160 rsync -avzessh /etc/vpe/hostkeys/second 133.55.82.9:/etc/hostkey 166 rsync -avzessh /etc/vpe/hostkeys/second 133.55.82.9:/etc/hostkey
161 rsync -avzessh /etc/vpe/hostkeys/third third.example.net:/etc/hostkey 167 rsync -avzessh /etc/vpe/hostkeys/third third.example.net:/etc/hostkey
162 168
163You should now check the configration by issuing the command C<vpectrl -c 169You should now check the configration by issuing the command C<vpectrl -c
164/etc/vpe -s> on each node and verify it's output. 170/etc/vpe -s> on each node and verify it's output.
165 171
166=head2 STEP 4: starting vped 172=head2 STEP 4: starting vped
167 173
168You should then start vped on each node by issuing a command like: 174You should then start vped on each node by issuing a command like:
169 175
170 vped -D -linfo first # first is the nodename 176 vped -D -linfo first # first is the nodename
171 177
172This will make the vped stay in foreground. You should then see 178This will make the vped stay in foreground. You should then see
173"connection established" messages. If you don't see them check your 179"connection established" messages. If you don't see them check your
174firewall and routing (use tcpdump ;). 180firewall and routing (use tcpdump ;).
175 181
… …
178 184
179To make vped run more permanently you can either run it as a daemon 185To make vped run more permanently you can either run it as a daemon
180(by starting it without the C<-D> switch), or, much better, from your 186(by starting it without the C<-D> switch), or, much better, from your
181inittab. I use a line like this on my systems: 187inittab. I use a line like this on my systems:
182 188
183 t1:2345:respawn:/opt/vpe/sbin/vped -D -L first >/dev/null 2>&1 189 t1:2345:respawn:/opt/vpe/sbin/vped -D -L first >/dev/null 2>&1
184 190
185=head2 STEP 5: enjoy 191=head2 STEP 5: enjoy
186 192
187... and play around. Sending a -HUP (C<vpectrl -kHUP>) to the daemon 193... and play around. Sending a -HUP (C<vpectrl -kHUP>) to the daemon
188will make it try to connect to all other nodes again. If you run it from 194will make it try to connect to all other nodes again. If you run it from

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines