VPN example: [IPv4 and IPv6] IPv6 address Auto-configuration over IPsec, Bridge (Virtual Ethernet over IPsec), One-armed, Behind a NAT/NAPT and EAP (Rockhopper client) / certificate (PKCS#12/X.509, Rockhopper gateway).


The following image shows example network for this scenario.

Ubuntu is installed on VPN Gateway(Bridge/Remote Accss Server), Remote Access Client, Internal host/Internal DNS server, Router1(Source NAPT), Router2(Destination NAPT or Port Forwarding) and Router3(A default gateway for protected network).

Rockhopper VPN software is installed on Remote Access Client and VPN Gateway. VPN is connected between these two nodes. VPN Gateway works as a bridge between Remote Access Client and protected network(LAN, 192.168.0.0/24 and 2001:db8::/64) and is configured as a one-armed gateway.

IPv6 address Auto-configuration over IPsec is enabled for VPN Gateway and Remote Access Client. For Non-Rockhopper clients like Windows VPN clients, an IPv6 address pool is also configured as usual.

IPv6 Router Advertisement is configured for Router3.

EAP-MSCHAPv2 is used as an authentication method for Remote Access Client and RSA-Signature(certificate) is used for VPN Gateway.

Remote Access Client and VPN Gateway are located behind a NAT(NAPT). Router1 and Router2 provide NAT/NAPT(Network Address Port Translation) service or Port Forwarding service for them.

Though the following configuration is for bridging, you can apply similar configuration for a Routing-based VPN confinguration.

sample0

rhpvif10 on Remote Access Client and VPN Gateway: A virtual interface(a Tunnel/TAP interface) to access internal network. "10" is the VPN realm ID. This interface is automatically created by Rockhopper VPN service and configured not by system tools like ifconfig command but by Rockhopper Web console.

br0 on VPN Gateway: A bridge interface linking eth0 and rhpvif10 interfaces as ports. This interface is managed by brctl command in the bridge-utils package. You need to manually link eth0 with br0 by brctl command, while rhpvif10 is automatically linked with br0 by Rockhopper VPN service.

eth0 and/or eth1 on each host: Real interfaces to access physical network.


A VPN realm is a security domain for group members to share the same security policy and VPN configuration. For instance, you can define the VPN realm "10" for a sales team and the other VPN realm "20" for a developing team.



Advance preparation:


- VPN Gateway(gateway1.example.com):
# sudo brctl addbr br0
# sudo brctl addif eth0
# sudo ip addr add 192.168.0.100/24 brd + dev br0
# sudo ip -6 addr add 2001:db8::100/64 dev br0

# sudo ip route add default via 192.168.0.10
# sudo ip -6 route add default via 2001:db8::10
Please see also "man 8 brctl" for more details to setup a bridge interface.
If you manually setup a bridge interface after configuring Rockhopper, please restart Rockhopper like this:
# sudo /etc/init.d/rockhopper restart
or
# sudo systemctl restart rockhopper

- Router1(Port Forwarding):
# sudo ip addr add 10.0.0.1/24 brd + dev eth0
# sudo ip -6 addr add 2001:db8:10::1/64 dev eth0
# sudo ip addr add 192.168.0.10/24 brd + dev eth1
# sudo ip -6 addr add 2001:db8::10/64 dev eth1
# sudo sysctl net.ipv4.ip_forward=1
# sudo sysctl net.ipv6.conf.all.forwarding=1

Forward packets destinated to 10.0.0.1:500(Router1) to 192.168.0.100:500(VPN Gateway).
# sudo iptables -t nat -A PREROUTING -p udp --dst 10.0.0.1 --dport 500 -j DNAT --to-destination 192.168.0.100:500
Forward packets destinated to 10.0.0.1:4500(Router1) to 192.168.0.100:4500(VPN Gateway).
# sudo iptables -t nat -A PREROUTING -p udp --dst 10.0.0.1 --dport 4500 -j DNAT --to-destination 192.168.0.100:4500

Forward packets destinated to [2001:db8:10::1]:500(Router1) to [2001:db8::1]:500(VPN Gateway).
# sudo ip6tables -t nat -A PREROUTING -p udp --dst 2001:db8:10::1 --dport 500 -j DNAT --to-destination [2001:db8::100]:500
Forward packets destinated to [2001:db8:10::1]:4500(Router1) to [2001:db8::1]:4500(VPN Gateway).
# sudo ip6tables -t nat -A PREROUTING -p udp --dst 2001:db8:10::1 --dport 4500 -j DNAT --to-destination [2001:db8::100]:4500

- Router2(Source NAPT):
# sudo ip addr add 10.0.0.10/24 brd + dev eth0
# sudo ip -6 addr add 2001:db8:10::10/64 dev eth0
# sudo ip addr add 192.168.2.1/24 brd + dev eth1
# sudo ip -6 addr add 2001:db8:2::1/64 dev eth1
# sudo sysctl net.ipv4.ip_forward=1
# sudo sysctl net.ipv6.conf.all.forwarding=1

Exec NAPT for packets from private network(192.168.2.0/24).
# sudo iptables -t -nat -A POSTROUTING -o eth0 -j MASQUERADE --random -s 192.168.2.0/24

Exec NAPT for packets from private network(2001:db8:2::/64).
# sudo ip6tables -t -nat -A POSTROUTING -o eth0 -j MASQUERADE --random -s 2001:db8:2::/64

If you need DHCPv4 and IPv6 Router Advertisement services, install Dnsmasq and radvd for example.
# sudo apt-get install radvd
# sudo touch /etc/radvd.conf
# sudo vi /etc/radvd.conf
interface eth1
{
  AdvSendAdvert on;
  MaxRtrAdvInterval 60;
  prefix 2001:0db8:2::/64 { };
};
# sudo /etc/init.d/radvd restart
or
# sudo systemctl restart radvd

- Router3(A default gateway for protected network.):
# sudo ip addr add 192.168.0.1/24 brd + dev eth0
# sudo ip -6 addr add 2001:db8::1/64 dev eth0
# sudo ip addr add 192.168.1.1/24 brd + dev eth1
# sudo ip -6 addr add 2001:db8:1::1/64 dev eth1
# sudo ip addr add 192.168.x.1/24 brd + dev eth2
# sudo ip -6 addr add 2001:db8:x::1/64 dev eth2
# sudo sysctl net.ipv4.ip_forward=1
# sudo sysctl net.ipv6.conf.all.forwarding=1

Install radvd for IPv6 address Auto-configuration through a VPN connection.
# sudo apt-get install radvd
# sudo touch /etc/radvd.conf
# sudo vi /etc/radvd.conf
interface eth0
{
  AdvSendAdvert on;
  MaxRtrAdvInterval 60;
  prefix 2001:0db8::/64 { };
};
# sudo /etc/init.d/radvd restart
or
# sudo systemctl restart radvd

- Internal host/Internal DNS server:
# sudo ip addr add 192.168.0.101/24 brd + dev eth0
# sudo ip -6 addr add 2001:db8::101/64 dev eth0

Above configuration will be lost after you restart your computer. To setup permanent configuration, you can edit /etc/network/interface like this. This is an example for VPN Gateway(gateway1.example.com) on Ubuntu.

- /etc/network/interfaces (Ubuntu)
auto eth0
iface eth0 inet manual
up ip link set dev eth0 promisc on

auto br0
iface br0 inet static
address 192.168.0.100
network 192.168.0.0
netmask 255.255.255.0
gateway 192.168.0.10
broadcast 192.168.0.255
bridge_ports eth0
bridge_stp off
bridge_maxwait 10

iface br0 inet6 static
address 2001:db8::100
netmask 64
gateway 2001:db8::10


- PKCS#12 and PEM files:

   - VPN Gateway(Bridge): gateway1.example.com.p12 (PKCS#12)
   - CA: TestCa-cacert.pem (X.509, PEM/Base64-encoding)

   The certificate(X.509) for VPN Gateway includes a subjectAltName(Host name/FQDN).
   - gateway1.example.com (Host name/FQDN)

See also "Documents/Tips: Managing certificates by XCA" to create the PKCS#12 file.


Configure VPN:


VPN Gateway(gateway1.example.com):

  1. Open Rockhopper Web console on http://127.0.0.1:32501 (by default) by Firefox.
  2. Login with administrator's name and password (by default, admin and secret).
  3. If VPN Configuration tab is not shown, uncheck Hide configuration tabs checkbox.
  4. Add a new VPN realm.

    - VPN Configuration[Tab] > Edit VPN Realm(Save, Add, etc.)[Left-Tree]: Click this tree node and show Edit VPN Realm(Save, Add, Remove, or Load) pane.

    - Click Add VPN Realm button.

    - Add a VPN Realm[Dialog]: Enter the following, then click OK button.

    Realm ID: 10
    Realm Name: "Example VPN"
    Description: "Config for Example VPN."
    Mode: Bridge

  5. Setup VPN Interface.

    - VPN Configuration[Tab] > VPN Realms[Left-Tree] > 10:Example VPN(Bridge)[Left-Tree]
    > VPN Interface[Left-Tree]: Click this tree node and show VPN Tunnel/TAP Interface pane.

    - Enter or select the following.

    Internal Address Type: Unnumbered(for bridging)
    Linked Bridge Name: br0

    - If Remote Access Client communicates with hosts on other subnets like 192.168.1.0/24, enter the following router's addresses. VPN Gateway will forward decrypted packets destinated to other subnets to the router(192.168.0.1 and 2011:db8::1).

    Internal Gateway's Address (optional) > IPv4: 192.168.0.1
    Internal Gateway's Address (optional) > IPv6: 2001:db8::1

  6. Setup Network Interface.

    - VPN Configuration[Tab] > VPN Realms[Left-Tree] > 10:Example VPN(Bridge)[Left-Tree]
    > Network Interface[Left-Tree]: Click this tree node and show Network Interface pane.

    - Uncheck Use default route and enter the followings.
        Primary interface:
          - Name: Select br0 as a source interface and IPv4 and IPv6.

    - Uncheck Destination NAT Address (MOBIKE Responder) and enter the followings.
        Primary interface:
          Dest NAT IPv4 Address: 10.0.0.1 (Router1's global address[eth0])
          Dest NAT IPv6 Address: 2001:db8:10::1 (Router1's global address[eth0])

       By the above settings, a remote client is notified of a Router1's global address as a MOBIKE additional address.

  7. Setup Service.

    - VPN Configuration[Tab] > VPN Realms[Left-Tree] > 10:Example VPN(Bridge)[Left-Tree]
    > Service[Left-Tree]: Click this tree node and show Service pane.

    - Network Deployment: Select Hub(Concentrator) Node.

    - Remote Configuration(IKEv2): Select Remote Configuration Server.

    - Authentication Method for remote peers: Check EAP (Extensible Authentication Protocol) Clients. [Version 0.2.b1-021 -]

    - EAP Server: Select EAP-MSCHAPv2.

    - Default EAP Server: Check Enable.

  8. Setup Remote Config Server.

    - VPN Configuration[Tab] > VPN Realms[Left-Tree] > 10:Example VPN(Bridge)[Left-Tree]
    > Service[Left-Tree] > Remote Config Server[Left-Tree]:

    Click this tree node and show Remote Config Server(IKEv2) pane.

  9. Setup Remote Config Server - Internal Address Pool.

    - Remote Config Server(IKEv2)[Pane] > Internal Address Pool[Tab]:
    Click Add Address Pool button.

    - Add a New Address Pool[Dialog]: Enter the following, then click OK button.

    Address Type: IPv4 Address Range
    IPv4 Address Range: 192.168.0.20 - 192.168.0.30

    Similarly, add the following for IPv6. [Optional]

    Address Type: IPv6 Address Range
    IPv6 Address Range: 2001:db8::20 - 2001:db8::2a

  10. Setup Remote Config Server - Internal Route Map.

    - Remote Config Server(IKEv2)[Pane] > Internal Route Map[Tab]:
    Enter the following as Internal router's addresses.

    Gateway Address > IPv4: 192.168.0.1
    Gateway Address > IPv6: 2001:db8::1

    - Click Add Destination Network button.
    Add a New Internal Route[Dialog]: Enter the following, then click OK button.

    IP Version: IPv4
    Destination IPv4 Network: 192.168.1.0
    Netmask: 255.255.255.0

    Similarly, add the following internal route for IPv6.

    IP Version: IPv6
    Destination IPv6 Network: 2001:db8:1::
    Prefix: 64

  11. Setup Remote Config Server - Internal Route Map. [Optional]

    - Remote Config Server(IKEv2)[Pane] > Internal Route Map[Tab]:

    Check Allow link-local ICMPv6 for Router Solicitation(RS) and Advertisement(RA).

    By checking the above setting, traffic selectors allowing link-local ICMPv6(RA/RS) are automatically added for Windows VPN clients. By receiving RA through a VPN tunnel, the VPN client configures it as a default route.

    See also Connecting a Windows 7/8/10 VPN Client with Rockhopper.

  12. Setup Remote Config Server - Internal DNS.

    - Remote Config Server(IKEv2)[Pane] > Internal DNS[Tab]:
    Enter the following as an Internal DNS server's addresses.

    DNS Server's Address > IPv4: 192.168.0.101
    DNS Server's Address > IPv6: 2001:db8::101

  13. Setup Remote Config Server - Options.

    - Remote Config Server(IKEv2)[Pane] > Options[Tab]:

    Check Allow IPv6 address Auto-configuration for remote clients. (Rockhopper's private extension).

  14. Setup My Key Store.

    - VPN Configuration[Tab] > VPN Realms[Left-Tree] > 10:Example VPN(Bridge)[Left-Tree] > My Key Store[Left-Tree]:
    Click this tree node and show My Key Store pane.

    - Enter the following.

    Authentication Method: RSA Signature(RSA-Sig)
    My ID Type: auto
    Imported Key Format: PKCS#12 - File
    PKCS#12 file(*.p12): gateway1.example.com.p12
    RSA Private Key's Password: himitsu

  15. Setup Peers' Key Store.

    - VPN Configuration[Tab] > VPN Realms[Left-Tree] > 10:Example VPN(Bridge)[Left-Tree] > Peers' Key Store[Left-Tree]:
    Click this tree node and show Peers Key Store pane.

    - Click Add Peer's Key/Password button.

    - Add a New Peer's Key[Dialog]: Enter the following, then click "OK" button.

    Peer ID Type: EAP-MSCHAPv2: User Name
    Peer ID: alice
    Pre-Shared Key(PSK)/Password: 1234567890

  16. Setup Child SA Settings. [Optional]

    - VPN Configuration[Tab] > VPN Realms[Left-Tree] > 10:Example VPN(Bridge)[Left-Tree] > Child SA Settings[Left-Tree]:
    Click this tree node and show Child SA Detailed Settings pane.

    Check Enable ESP's UDP-encapsulation for IPv6 NAT-T after receiving a UDP-encapsulated packet from a remote peer(non-Rockhopper).

    See also Connecting a Windows 7/8/10 VPN Client with Rockhopper.

  17. Save this realm's configuration.

    - VPN Configuration[Tab] > Edit VPN Realm(Save, Add, etc.)[Left-Tree]: Click this tree node and show Edit VPN Realm(Save, Add, Remove, or Load) pane.

    - Click Save Configuration button.




Remote Access Client(remoteclient1.example.com):


- Version: 0.2.b1-021 or later


  1. Open Rockhopper Web console on http://127.0.0.1:32501 (by default) by Firefox.
  2. Login with administrator's name and password (by default, admin and secret).
  3. If VPN Configuration tab is not shown, uncheck Hide configuration tabs checkbox.
  4. Add a new VPN realm.

    - VPN Configuration[Tab] > Edit VPN Realm(Save, Add, etc.)[Left-Tree]: Click this tree node and show Edit VPN Realm(Save, Add, Remove, or Load) pane.

    - Click Add VPN Realm button.
    Add a VPN Realm[Dialog]: Enter the following, then click OK button.

    Realm ID: 10
    Realm Name: "Example VPN"
    Description: "Config for Example VPN."
    Mode: Remote Client

  5. Setup Destination.

    - VPN Configuration[Tab] > VPN Realms[Left-Tree] > 10:Example VPN(Remote Client)[Left-Tree] > Destination[Left-Tree]: Click this tree node and show Destination (Concentrator / Gateway) pane.

    - Enter the following. This expects a public DNS server to provide both IPv4 and IPv6 addresses for gateway1.example.com (Router1's global addresses). Also, you can edit /etc/hosts file.

    Destination Address: Host Name(FQDN) and gateway1.example.com


    Of course, you can specify an VPN Gateway's IPv4 or IPv6 address (Actually, it is a Router1's public IPv4 or IPv6 address).


  6. Setup My Key Store.

    - VPN Configuration[Tab] > VPN Realms[Left-Tree] > 10:Example VPN(Remote Client)[Left-Tree]
    > My Key Store[Left-Tree]: Click this tree node and show My Key Store pane.

    - Enter the following.

    Authentication Method: EAP-MSCHAPv2

  7. Setup CA Certificate/CRL.

    - VPN Configuration[Tab] > VPN Realms[Left-Tree] > 10:Example VPN(Remote Client)[Left-Tree]
    > CA Certificate/CRL[Left-Tree]:
    Click this tree node and show CA Certificate/Certificate Revocation List(CRL) pane.

    - Enter the following.

    Imported Certificate/CRL Format: PEM(Base64-encoding) - File
    CA Certificates(X.509, *.pem): TestCA-cacert.pem

  8. Save this realm's configuration.

    - VPN Configuration[Tab] > Edit VPN Realm(Save, Add, etc.)[Left-Tree]:
    Click this tree node and show Edit VPN Realm(Save, Add, Remove, or Load) pane.

    - Click Save Configuration button.


- Advanced Settings


  1. Open Rockhopper Web console on http://127.0.0.1:32501 (by default) by Firefox.
  2. Login with administrator's name and password (by default, admin and secret).
  3. If VPN Configuration tab is not shown, uncheck Hide configuration tabs checkbox.
  4. Add a new VPN realm.

    - VPN Configuration[Tab] > Edit VPN Realm(Save, Add, etc.)[Left-Tree]: Click this tree node and show Edit VPN Realm(Save, Add, Remove, or Load) pane.

    - Click Add VPN Realm button.
    Add a VPN Realm[Dialog]: Enter the following, then click OK button.

    Realm ID: 10
    Realm Name: "Example VPN"
    Description: "Config for Example VPN."
    Mode: Remote Client


    - Check Advanced Settings. (Version: 0.2.b1-021 or later)


  5. Setup VPN Interface.

    - VPN Configuration[Tab] > VPN Realms[Left-Tree] > 10:Example VPN(Remote Client)[Left-Tree]
    > VPN Interface[Left-Tree]: Click this tree node and show VPN Tunnel/TAP Interface pane.

    - Enter the following.

    Internal Address Type: Auto(IKEv2 Configuration)

    Check Enable IPv6 address Auto-configuration. (Rockhopper's private extension).

  6. Setup Network Interface.

    - VPN Configuration[Tab] > VPN Realms[Left-Tree] > 10:Example VPN(Remote Client)[Left-Tree]
    > Network Interface[Left-Tree]: Click this tree node and show Network Interface pane.

    - Check Use default route.
    or
    - Uncheck Use default route and enter the followings.
        Primary interface:
          - Name: Select eth0 as a source interface.

  7. Setup Service.

    - VPN Configuration[Tab] > VPN Realms[Left-Tree] > 10:Example VPN(Remote Client)[Left-Tree]
    > Service[Left-Tree]: Click this tree node and show Service pane.

    - Network Deployment: Select Spoke Node/Other.

    - Remote Configuration(IKEv2): Select Remote Access Client.

  8. Setup My Key Store.

    - VPN Configuration[Tab] > VPN Realms[Left-Tree] > 10:Example VPN(Remote Client)[Left-Tree]
    > My Key Store[Left-Tree]: Click this tree node and show My Key Store pane.

    - Enter the following.

    Authentication Method: EAP-MSCHAPv2

  9. Setup Peers.

    - VPN Configuration[Tab] > VPN Realms[Left-Tree] > 10:Example VPN(Remote Client)[Left-Tree]
    > Peers[Left-Tree]: Click this tree node and show Peers pane.

    - Click Add Peer button.
    Add a New Peer[Dialog]: Enter the following, then click OK button.

    Peer ID Type: IKEv2: Host Name(FQDN)
    Peer ID: gateway1.example.com

  10. Setup the Peer's information.

    - VPN Configuration[Tab] > VPN Realms[Left-Tree] > 10:Example VPN(Remote Client)[Left-Tree]
    > Peers[Left-Tree] > gateway1.example.com(FQDN)[Left-Tree]:
    Click this tree node and show Peer: gateway1.example.com(FQDN) pane.

    - Enter the following.

    Peer's Address: IPv6 and 2001:db8:10::1 (Router1's global address[eth0])
    Secondary IP Address: IPv4 and 10.0.0.1 (Router1's global address[eth0])

    This peer's Network Deployment: Hub(Concentrator) Node

  11. Setup CA Certificate/CRL.

    - VPN Configuration[Tab] > VPN Realms[Left-Tree] > 10:Example VPN(Remote Client)[Left-Tree]
    > CA Certificate/CRL[Left-Tree]:
    Click this tree node and show CA Certificate/Certificate Revocation List(CRL) pane.

    - Enter the following.

    Imported Certificate/CRL Format: PEM(Base64-encoding) - File
    CA Certificates(X.509, *.pem): TestCA-cacert.pem

  12. Save this realm's configuration.

    - VPN Configuration[Tab] > Edit VPN Realm(Save, Add, etc.)[Left-Tree]:
    Click this tree node and show Edit VPN Realm(Save, Add, Remove, or Load) pane.

    - Click Save Configuration button.



Connecting VPN:


  1. Open VPN client's Web console on http://127.0.0.1:32501 (by default) by Firefox.
  2. Login with administrator's name and password (by default, admin and secret).
  3. Top [Tab] > 10:Example VPN[Left-Tree] > gateway1.example.com(FQDN)[Left-Tree]:
    Click this tree node and show 10: gateway1.example.com(FQDN) pane.
  4. Click Connect button and open the EAP Authentication dialog.
  5. Enter a user name (alice) and a password and then push OK button.


Back to Top