Setup SSL VPN site to site tunnel

Site to site VPNs connect two locations with static public IP addresses and allow traffic to be routed between the two networks. This is most commonly used to connect an organization’s branch offices back to its main office, so branch users can access network resources in the main office.

Before you start

Before starting with the configuration of an OpenVPN SSL tunnel you need to have a working Ixolate installation with a unique LAN IP subnet for each side of your connection (your local network needs to be different than that of the remote network).

Network topology

The schema below describes the situation we are implementing. Two networks (A,B) and a transit network (10.10.8.0/24) to peer both firewalls. We will create a tunnel network 10.1.8.0/24 between both sites.

nwdiag {

span_width = 90; node_width = 180; network A { address = “10.0.8.0/24”; pclana [label=“PC Site An10.0.8.20”,shape=“cisco.pc”]; fwa [shape = “cisco.firewall”, address=“10.0.8.1/24”]; } network Ext { address = “WAN net 10.10.8.0/24”; label = “Tunnel net 10.1.8.0/24”; fwa [shape = “cisco.firewall”, address=“10.10.8.1/24”]; fwb [shape = “cisco.firewall”, address=“10.10.8.2/24”]; } network B { address = “192.168.8.0/24” fwb [shape = “cisco.firewall”, address=“192.168.8.2/24”]; pclanb [label=“PC Site Bn192.168.8.20”,shape=“cisco.pc”]; }

}

Preparations

Trust

In order to setup a tunnel on both ends, we need to configure certificates to warrant trust between both machines. We need a root CA that issues two leaf certificates, one for each site.

Create a certificate chain using the following tutorial:

Setup Self-Signed Certificate Chains

• `Root CA`: SSL VPN CA
• `Leaf Certificate - Type Server - Site B`: Set the Common Name to the FQDN of this machine.
• `Leaf Certificate - Type Client - Site A`: Set the Common Name to the username.

The root CA issues the leaf certificates directly; we do not need an intermediate CA.

Static keys

We create a static key and define it’s use in VPN › OpenVPN › Instances › Static Keys, for this example select auth as mode and click the gear button to generate one. Provide a description for this key.

Prepare Site A

• Copy the public part of the certificate authority to the firewall at Site A (use the download button and copy the contents into a new CA on this host)
• Copy the public and private part of the client certificate into a new one on Site A
• Copy the contents of the static key to a new entry and select the same type

Create a server instance (Site B)

Now the generic setup is done, we can configure a new server type instance via VPN › OpenVPN › Instances

Note 1

Leave empty to bind to all addresses assigned to this machine or use a loopback address combined with a Destination NAT (Port Forward) when the external address is not static.

Note 2

The network(s) served by this openvpn instance, after startup routes will be created. In order to bind the network to the correct client a Client Specific Overwrite is also needed.

Hit the apply button when the instance is configured and add a client specific overwrite in VPN › OpenVPN › Client Specific Overrides

Note 1

The remote network bound to this common name, without this entry the traffic will not be routed between hosts.

Next go to Firewall › Rules › WAN and add a rule to allow traffic on port 1194/UDP from the other host. At minimum we should add a rule similar to this one:

Finally we are going to allow traffic on the tunnel itself by adding a rule to Firewall › Rules › OpenVPN, for this example we keep it simple and add one to allow all, in which case we can save the defaults when adding a rule.

Create a client instance (Site A)

With the server in place it’s time to setup the client on Ixolate, for this we go to VPN › OpenVPN › Instances and add a new instance using the following settings.

Test connectivity

Use the VPN: OpenVPN: Connection Status page to watch the status of both server and client, when passing traffic over the link on both ends the counters should increase.

Now try to ping from Site A (10.0.8.20) to Site B (192.168.8.20).