Ubiquiti EdgeMax configuration

[dmwyatt]

Anyone have any ideas or advice on how to configure an EdgeRouter Lite to send all internet traffic on LAN through the algo server?

Specifically, I'm looking for step-by-step instructions to enable my EdgeRouter Lite to route all internet traffic on my LAN through my algo VPN instead of the open internet.

Here's my thread on the ubiquiti forums linking to this issue.

[chriseldredge]

I just started looking at this too and found these community discussions that may be helpful:

• EdgeRouter strongSwan configuration
• Route all traffic through VPN

[ebrandell-2]

Also very interested in this.

On a side note, I wasn't even entirely sure this router would support Algo. The only thing I wasn't able to confirm after talking with Ubiquiti's support was support for ECDSA certificate keys. I did, however, find this in the release notes for version 1.8.0 of EdgeOS (it's currently on 1.9.1):

[IPsec] Add the include-ipsec-secrets option for including a custom secrets file. This can be useful for example if an ECDSA key is used. Implemented by TriJetScud

This tells me it can support it with the latest versions of EdgeOS, but once I get mine I'll test it out.

[dmwyatt]

I found this which I think is what we need, but I'm far from a networking guy so I'm not sure.

[ebrandell-2]

root@ubnt:/etc/ipsec.d/certs# ipsec up ikev2-<ALGO_IP>
initiating IKE_SA ikev2-<ALGO_IP>[8] to <ALGO_IP>
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
sending packet: from <WAN_IP>[500] to <ALGO_IP>[500] (1188 bytes)
received packet: from <ALGO_IP>[500] to <WAN_IP>[500] (265 bytes)
parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]
received cert request for "CN=<ALGO_IP>"
sending cert request for "CN=<ALGO_IP>"
no private key found for 'CN=router'
establishing connection 'ikev2-<ALGO_IP>' failed

This is as close as I got to getting it working. I tried starting ipsec through bash since the uqiquiti CLI seems like a PITA to configure. You can do it by using sudo bash and then running ipsec <cmd>.

Output of ipsec statusall:

root@ubnt:/etc/ipsec.d/private# ipsec statusall
Status of IKE charon daemon (strongSwan 5.2.2, Linux 3.10.20-UBNT, mips64):
  uptime: 39 minutes, since Apr 02 08:05:46 2017
  malloc: sbrk 410768, mmap 0, used 264632, free 146136
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 0
  loaded plugins: charon ldap sqlite pkcs11 aes des sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs8 pem openssl agent xcbc cmac ctr ccm gcm curl attr kernel-netlink resolve socket-default stroke vici updown eap-identity eap-md5 eap-mschapv2 eap-radius eap-tls xauth-generic xauth-eap addrblock
Listening IP addresses:
  <WAN_IP>
  192.168.1.1
  192.168.2.1
Connections:
ikev2-<ALGO_IP>:  %any...<ALGO_IP>  IKEv2, dpddelay=35s
ikev2-<ALGO_IP>:   local:  [CN=router] uses public key authentication
ikev2-<ALGO_IP>:    cert:  "CN=router"
ikev2-<ALGO_IP>:   remote: [<ALGO_IP>] uses public key authentication
ikev2-<ALGO_IP>:   child:  dynamic === 0.0.0.0/0 TUNNEL, dpdaction=clear
Security Associations (0 up, 0 connecting):
  none

My directory structure for certs/keys/etc on my EdgeRouter Lite:

root@ubnt:/etc# tree -pug ipsec.d/
ipsec.d/
|-- [drwxr-xr-x root     root    ]  aacerts
|-- [drwxr-xr-x root     root    ]  acerts
|-- [drwxr-xr-x root     root    ]  cacerts
|   `-- [-rw------- root     root    ]  ca.crt
|-- [drwxr-xr-x root     root    ]  certs
|   |-- [-rw------- root     root    ]  04.pem
|   |-- [-rw------- root     root    ]  <ALGO_IP>.crt
|   `-- [-rw------- root     root    ]  router.crt
|-- [drwxr-xr-x root     root    ]  crls
|-- [drwxr-xr-x root     root    ]  ocspcerts
|-- [drwxr-x--- root     root    ]  private
|   |-- [-rw------- root     root    ]  <ALGO_IP>.key
|   |-- [-rw------- root     root    ]  router.key
|   `-- [-rw------- root     root    ]  router.p12
|-- [drwxr-xr-x root     root    ]  reqs
`-- [drwxr-xr-x root     root    ]  tunnels
    `-- [-rw-r--r-- root     root    ]  remote-access

Perhaps I'm missing some files/permissions?

Any help would be greatly appreciated.

[ebrandell-2]

Got super close last night. It tried installing a new virtual ip on my EdgeRouter, but then right after I lost all internet and LAN access. I configured all of this using bash on my EdgeRouter (not using the built-in CLI). I'm guessing the fact that it blows up my network access has something to do with NAT traversal or iptables firewall rules being missing/misconfigured. I'm using EdgeOS 1.9.1 by the way (here).

My hardware setup:

Internet <- Modem <- ERLite3 <- Asus AC68U
                      	|           |
                        V           V
                       Algo       DHCP Lan Clients

Can someone else try this and let me know?

Some resources, some of which I still have to try):

• IPSEC-Tunnel-UP-but-no-traffic
• EdgeRouter-Set-up-L2TP-over-IPsec-VPN-server
• EdgeRouter-IPSEC-VPN-site-to-site-tunnel-not-passing-traffic
• Firewall-rules-needed-to-pass-IPSEC-point-to-point-traffic

Output of ipsec up <ikev2-ip>:

root@ubnt:/etc# ipsec restart
Stopping strongSwan IPsec failed: starter is not running
Starting strongSwan 5.2.2 IPsec [starter]...
root@ubnt:/etc# ipsec up ikev2-<ALGO_VPN>
initiating IKE_SA ikev2-<ALGO_VPN>[1] to <ALGO_VPN>
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]
sending packet: from <WAN_IP>[500] to <ALGO_VPN>[500] (1196 bytes)
received packet: from <ALGO_VPN>[500] to <WAN_IP>[500] (273 bytes)
parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(MULT_AUTH) ]
received cert request for "CN=<ALGO_VPN>"
sending cert request for "CN=<ALGO_VPN>"
authentication of 'CN=<USER>' (myself) with ECDSA-256 signature successful
sending end entity cert "CN=<USER>"
establishing CHILD_SA ikev2-<ALGO_VPN>
generating IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH CPRQ(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]
splitting IKE message with length of 943 bytes into 2 fragments
generating IKE_AUTH request 1 [ EF ]
generating IKE_AUTH request 1 [ EF ]
sending packet: from <WAN_IP>[4500] to <ALGO_VPN>[4500] (544 bytes)
sending packet: from <WAN_IP>[4500] to <ALGO_VPN>[4500] (464 bytes)
received packet: from <ALGO_VPN>[4500] to <WAN_IP>[4500] (544 bytes)
parsed IKE_AUTH response 1 [ EF ]
received fragment #1 of 2, waiting for complete IKE message
received packet: from <ALGO_VPN>[4500] to <WAN_IP>[4500] (369 bytes)
parsed IKE_AUTH response 1 [ EF ]
received fragment #2 of 2, reassembling fragmented IKE message
parsed IKE_AUTH response 1 [ IDr CERT AUTH CPRP(ADDR DNS DNS DNS6 DNS6) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_6_ADDR) ]
received end entity cert "CN=<ALGO_VPN>"
  using certificate "CN=<ALGO_VPN>"
  using trusted ca certificate "CN=<ALGO_VPN>"
checking certificate status of "CN=<ALGO_VPN>"
certificate status is not available
  reached self-signed root ca with a path length of 0
authentication of '<ALGO_VPN>' with ECDSA-256 signature successful
IKE_SA ikev2-<ALGO_VPN>[1] established between <WAN_IP>[CN=<USER>]...<ALGO_VPN>[<ALGO_VPN>]
installing DNS server 8.8.8.8 to /etc/resolv.conf
installing DNS server 8.8.4.4 to /etc/resolv.conf
installing DNS server 2001:4860:4860::8888 to /etc/resolv.conf
installing DNS server 2001:4860:4860::8844 to /etc/resolv.conf
installing new virtual IP 10.19.48.1
... <<< dies here

Here's the updated directory structure:

root@ubnt:/etc# tree -pug ipsec.d/
ipsec.d/
|-- [drwxr-xr-x root     root    ]  aacerts
|-- [drwxr-xr-x root     root    ]  acerts
|-- [drwxr-xr-x root     root    ]  cacerts
|   `-- [-rw-r--r-- root     root    ]  ca.crt
|-- [drwxr-xr-x root     root    ]  certs
|   |-- [-rw------- root     root    ]  01.pem
|   |-- [-rw------- root     root    ]  02.pem
|   |-- [-rw------- root     root    ]  <ALGO_IP>.crt
|   `-- [-rw------- root     root    ]  <ALGO_IP>_<USER>.crt
|-- [drwxr-xr-x root     root    ]  crls
|-- [drwxr-xr-x root     root    ]  ecparams
|   `-- [-rw------- root     root    ]  prime256v1.pem
|-- [drwxr-xr-x root     root    ]  ocspcerts
|-- [drwxr-x--- root     root    ]  private
|   |-- [-rw------- root     root    ]  <ALGO_IP>.key
|   |-- [-rw------- root     root    ]  <ALGO_IP>_<USER>.key
|   |-- [-rw------- root     root   ]  <USER>.p12
|   `-- [-rw------- root     root    ]  cakey.pem
|-- [drwxr-xr-x root     root    ]  reqs
`-- [drwxr-xr-x root     root    ]  tunnels
    `-- [-rw-r--r-- root     root    ]  remote-access

ipsec.conf:

conn ikev2-<ALGO_IP>
    fragmentation=yes
    rekey=no
    dpdaction=clear
    keyexchange=ikev2
    compress=no
    dpddelay=35s

    ike=aes128gcm16-sha2_256-prfsha256-ecp256
    esp=aes128gcm16-sha2_256-ecp256

    right=<ALGO_IP>
    rightid=<ALGO_IP>
    rightsubnet=0.0.0.0/0
    rightauth=pubkey

    leftsourceip=%config
    leftauth=pubkey
    leftcert=<ALGO_IP>_<USER>.crt
    leftfirewall=yes
    left=%defaultroute

    auto=add

[ebrandell-2]

Thinking it has to be some sort of issue with firewall or NAT rules. :(

[dmwyatt]

I added a bounty. Check the first post in this issue. You can add to the funds by clicking the badge there.

[ebrandell-2]

Added $100 bounty.

[chriseldredge]

I was able to get strongSwan to load the certs and the ecdsa key with some adjustments. I copied ipsesc.conf and ipsec.secrets to /etc/, but in ipsec.conf I changed the leftcert which was in the form of leftcert=xxx.xxx.xxx.xxx_user.crt, to be simply leftcert=user.crt (where "user" is the username of the algo account I'm connecting as).

In ipsec.secrets I made a similar adjustment.

I also changed rightsubnet to be something more specific than 0.0.0.0/0 because I haven't figured out why this seems to lock up all network traffic on the router. I changed it to a more specific private network (172.16.0.0/16) during testing.

After ipsec restart, I can run ipsec listcerts and see this in the output:

pubkey: ECDSA 256 bits, has private key

And ipsec up <connection-name> successfully establishes a connection.

I haven't been able to ping across the tunnel or otherwise do anything useful with it, but at least it seems to authenticate correctly.

/var/log/charon.log is a good place to look if you are having trouble with certs and keys.

[chriseldredge]

Adding this iptables rule enables me to ping/ssh to a private ip address on my algo ec2 instance:

iptables -t nat -I UBNT_VPN_IPSEC_SNAT_HOOK -m policy --pol ipsec --dir out -j ACCEPT

I'll try setting rightsubnet to use a default route later and see if it avoids locking up all network traffic. Feels like I'm getting closer.

[jackivanov]

@chriseldredge @ebcodes
To avoid locking all the network traffic you should configure the routing tables properly or you can modify strongswan.conf in order to use the zero routing table:

Something like this:

charon {
 routing_table = 0
}

[ebrandell-2]

@gunph1ld @chriseldredge
This might also be relevant: https://lists.strongswan.org/pipermail/users/2015-January/007289.html

What you want is a passthrough policy with source and destination being 192.168.1.0/24.
That policy with narrower subnets will take precedence before the policy that is defined by
your "toclient" connection definition.

conn lanbypass
    leftsubnet=192.168.1.0/24
    rightsubnet=192.168.1.0/24
    type=passthrough
    auto=route