IPSec SSL VPN p2p tunnel w/o Hardware

[RabbieBurns]

I want to make an IPSec point to point tunnel between 2 sites, but only one site has a router capable of IPSec VPN, and its not possible to replace the hardware at the other end for another few months. Is there a firewall (software) appliance type thing that I can run in a VM that will do the p2p IPSec and routing between the networks? Smoothwall free perhaps?

[SYNACK]

Do they have a windows server at each end, it has routign and VPN server/endpoint features baked in, it's a little more work setting it up without ISA/TMG/UAG but it can be done. Depending on the router it may be able to talk to a windows endpoint. I think that untangle dists have something like this but if you have the tools already another box may be excessive for a few months.

[RabbieBurns]

yes theres a windows 2008R2 at each end. Using Raas is an option but i thought it might be easier using ipsec? Would ISA/TMG/UAG make it easier? Can install one of them (which is the latest?) if its easier than trying to do it straight with windows.

 

its a Netgear DG834GT Adsl with the DGTeam custom firmware at one end, and a TPLink thing at the other end which does have IPSec build in. I was planning on just using another TPLink at the Netgear end when I finally get on site in October.

[SYNACK]

You can configure the Windows server as an IPsec or SSL VPN endpoint. TMG/UAG are the latest ones, UAG is the big one (univied access gateway) that handles all sorts of remote stuff, TMG (threat managment gateway) is the ISA replacement which has been discontinued and its features rolled in to server 2012 or UAG. TMG is a bit iffy and UAG is a nuclear bomb so it would probably be easiest to just use the built in windows tools to enable routing and create a tunnel between the two.

 

Untangle, Inc. in a VM at each end should do the job using openvpn in a usable gui appliance type form factor as opposed to the generic text based version where you may be eaten by a gru.

 

Personally for just a tunnel I'd just set it up under the existing systems unless you want to segreagate the systems and have lots of overhead room for an extra VM on each end and whatever additional pipeing required.

[RabbieBurns]

Cool cheers, Ill just use windows. Thanks

[RabbieBurns]

is there a step by step (aka idiots guide) to do it with windows server 2008R2?

[SYNACK]

Umm, there does not appear to be any complete easy ones around for R2. there is the stuff below:

 

Tutorial How to Install VPN Server 2008 R2 - YouTube

NSFW language

 

 

Site to Site VPN Windows Server 2008 R2

 

Basicly you want to setup NPS on both sides and set up the servers with a couple of interfaces, set them up for both routing and remote access then setup a dial on demand tunnel for the respective remote subnets then setup the static routes to match them.

 

You'll need to do that stuff with another solution too but doing it step by step like this will probably give you a much better idea of how it all works.

 

Here's an EG thread that may be helpful:

http://www.edugeek.net/forums/windows-server-2008-r2/63113-setup-vpn-access-2008r2.html

 

and another MS one

http://technet.microsoft.com/en-us/library/ff687867(v=ws.10).aspx

Edited August 17, 2012 by SYNACK

[RabbieBurns]

OK, I have made some progress, basically stumbled blindly not really sure what I have done.

 

I have managed to get 2008R2-Scotland to connect to 2008R2-Sydney, the PPP interface gets an IP from Sydney.

I can ping from 2008R2-Scotland to the Sydney network

I cannot ping from any other Scotland Client to Sydney

 

I cannot ping to Scotland from anywhere in Sydney.

I can ping the Sydney IP on the PPP interface of 2008R2-Scotland

 

So the connection seems OK but I need to sort the routing both ways.

 

(and also what port(s) are requrored for RRAS as I have put 2008R2-Sydney in DMZ atm)

[SYNACK]

Sounds like you're making good progress, if the tunnel is up and able to exchange pings the next step is to verify that routing is working propperly. Set a client pc's default gateway to the internal RRaS server internal interface to make sure that routing is enabled from internal to the tunnel.

 

You can then move to figuring out how you want to handle the routing, you may need to either put a route from your main router to the RRAS server in or pass all routable traffic via the RRAS server before it hits the gateway router.

 

As to the ports it depends on the protocol you are using and on the gateway firewalls as you probably want to enable those protocols only to and from the appropriate endpoints on the internet.

[RabbieBurns]

setting the 2008r2-scotland machine as the default gateway on other clients doesnt work.

 

Adding a static route in the gateway to point to 2008r2-scotland doesnt work either.

 

Is there any other static routes i need to configure on 2008R2-Scotland?

 

This is the routing table on 2008r2-scotland:

 

IPv4 Route Table
==========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metri
         0.0.0.0          0.0.0.0      192.168.2.1     192.168.2.45    26
   60.123.123.23  255.255.255.255      192.168.2.1     192.168.2.45
       127.0.0.0        255.0.0.0         On-link         127.0.0.1    30
       127.0.0.1  255.255.255.255         On-link         127.0.0.1    30
 127.255.255.255  255.255.255.255         On-link         127.0.0.1    30
     192.168.2.0    255.255.255.0         On-link      192.168.2.45    26
    192.168.2.45  255.255.255.255         On-link      192.168.2.45    26
   192.168.2.164  255.255.255.255         On-link     192.168.2.164    30
   192.168.2.255  255.255.255.255         On-link      192.168.2.45    26
     192.168.3.0    255.255.255.0    192.168.3.112    192.168.3.111    26
   192.168.3.111  255.255.255.255         On-link     192.168.3.111    26
       224.0.0.0        240.0.0.0         On-link         127.0.0.1    30
       224.0.0.0        240.0.0.0         On-link      192.168.2.45    26
       224.0.0.0        240.0.0.0         On-link     192.168.2.164    30
       224.0.0.0        240.0.0.0         On-link     192.168.3.111    26
 255.255.255.255  255.255.255.255         On-link         127.0.0.1    30
 255.255.255.255  255.255.255.255         On-link      192.168.2.45    26
 255.255.255.255  255.255.255.255         On-link     192.168.2.164    30
 255.255.255.255  255.255.255.255         On-link     192.168.3.111    26
==========================================================================

 

From that, 60.123.123.123 is the WAN IP of Sydney, 192.168.3.0/24 is the sydney local net, 192.168.3.111 and 192.168.3.112 are the p2p Ip addresses.

 

I can ping 192.168.3.111 from all scotlnad clients when I add the static route pointing to 2008R2-Scotland to the main degault gw. Cant ping 192.168.3.112 though.

 

I have added a static route in the RAS part of the 2008R2-Scotland which is the reason that machine can ping the remote network, but it doesnt seem to work for other local Scotland clients:

 

[RabbieBurns]

Also, do i need to replicate the setup at the other end to get Sydney talking to Scotland?

[SYNACK]

Do both of the boxes have the routing role installed as well as VPN

 

How to configure Windows 2008 Server IP Routing

Configuring Windows 2008 R2 AD Multi Site with Routing and Route Access Configuration for the lab « SMTP Port 25

How do I make my Server 2008 (or R2) a router? - Welcome to the US SMB&D TS2 Team Blog - Site Home - TechNet Blogs

 

I'd be tempted to have a seporate ip network just for the tunnel like 192.168.4.1 and .2 just to isolate stuff a bit more routing wise and yes, with the different tunnel you would need to replicate the setup. You'd want the different IPs on the tunnel just to make sure that it always hits the VPN and opens the tunnel. It may work the other way but the seporate link network is more commonly used - in the cisco world at least.

[SYNACK]

Oh and as to the ping, it is probably because the remote side had no route back to the local network, you could try adding a static route for the scotland subnet on the sydney side so that it knows where to pass packets back to as IP is end to end, each step must know a way to get back to where it needs to go.

[RabbieBurns]

Certainly when I have used OpenVPN it uses a separate network for sure. Ill give those links a read at work in the morning, thanks

 

I have installed the role on both yes. Ill try with a separate network just now - i just left it as the default which was DHCP.

[RabbieBurns]

Aha i figured it out. I changed the metric in the static route in RAS to 3 rather than the default 256 and it works.

 

Also replicated the setup in sydney. I can now ping from my laptop here to the scotland network.

 

That was pretty easy actually now I understand whats going on. Thanks for your help SYNACK.

[SYNACK]

Cool, glad it worked, just found this http://examples.oreilly.de/english_examples/9780735625167/cd_contents/Bonus%2520Material/Network%2520Access%2520Protection/C13624221.pdf which is a book chapter that seems to go quite indepth on the different options and their advantages/disadvantages if your interested.

[RabbieBurns]

thanks, i think more reading is required for sure. I disconnected and reconnected and now now pings are working. Also, before I disconnected even though pings were OK no other protocol was communicating either way.

[RabbieBurns]

this was working fine since my last post, both subnets talking to each other..

 

But about 3 weeks ago it stopped working. I can dial from siteA to site B and it will connect, but while it is connected site B cannot dial and connect to site A.

 

If i disconnect site A from B, then B will dial and connect to A. I don't understand what has changed. Also routing seems to have stopped as clients on A cant contact B when A is connected to B (although I think that only worked when both sites were connected to each other so might be why)

 

In the event logs, it looks like it establishes the connection but then it immediately drops.

[RabbieBurns]

any ideas?

 

this is the event log that appears after the entry about successfull connection:

 

Log Name:      Application
Source:        RasClient
Date:          23/10/2012 3:19:16 PM
Event ID:      20227
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      sydney.domain.co.uk
Description:
CoId={F1F408A7-4514-4930-91D3-50161AE4582A}: The user SYSTEM dialed a connection named To Glasgow which has failed. The error code returned on failure is 800.
Event Xml:

 
   
   20227
   2
   0
   0x80000000000000
   
   198578
   Application
   sydney.domain.co.uk
   
 
 
   {F1F408A7-4514-4930-91D3-50161AE4582A}
   SYSTEM
   To Glasgow
   800
 

[SYNACK]

any ideas?

 

this is the event log that appears after the entry about successfull connection:

 

 

Could be something to do with NPS, are the certs all up to scratch and the times synced across the sites, can you connect to the tunnel locally from a client inside the router from each site.

 

Domain Authentication Without Certificates

[RabbieBurns]

it wasnt using certs it was just using pptp i think. The times were out of sync, thats the first thing i fixed a few weeks ago after i noticed had stopped working but it didnt start working again so i thought it must be something else.

 

how do i create a dun in windows 7 to test cant find it :embarrassed:

[SYNACK]

it wasnt using certs it was just using pptp i think. The times were out of sync, thats the first thing i fixed a few weeks ago after i noticed had stopped working but it didnt start working again so i thought it must be something else.

 

how do i create a dun in windows 7 to test cant find it :embarrassed:

 

Network and sharing centre > connect to a network > connect to a network at my workplace (VPN) > etc.

 

[RabbieBurns]

A win7 client in sydney can connect to glasgow, even if glasgow server is already connected to sydney

A 2008r2 with just a dial up connection client in glasgow cannot connect to sydney at all

 

I dont have a win7 client in gla to test with just yet but ill make a VM to test with whenever I get a chance.

 

I might try just rebooting both servers at both ends see if that fixes anything.

 

The only other thing I can think of is I had to change the adsl modem/router at the sydney end recently and it may co-incide with when this stopped working. I have forwarded the 1723 or whatver the pptp port is exactly the same way the old one was so i dont know if that will be related just figured it is worth mentioning.

[SYNACK]

A win7 client in sydney can connect to glasgow, even if glasgow server is already connected to sydney

A 2008r2 with just a dial up connection client in glasgow cannot connect to sydney at all

 

I dont have a win7 client in gla to test with just yet but ill make a VM to test with whenever I get a chance.

 

I might try just rebooting both servers at both ends see if that fixes anything.

 

The only other thing I can think of is I had to change the adsl modem/router at the sydney end recently and it may co-incide with when this stopped working. I have forwarded the 1723 or whatver the pptp port is exactly the same way the old one was so i dont know if that will be related just figured it is worth mentioning.

 

It's not just 1723, there is also the GRE protocol which is not even on a port so the modem needs to support it going both ways and it needs to be passed through. VPN passthrough is usually an option but depending on how dodgey the software is it may only be one way or only support one tunnel to one location before crashing and needing a reset (Consumer grade Dynalink and some Netgear). The network stack in them literally binds up the mapping and any further connections break till the modem itself is rebooted.

 

So it could easily be the modem as PPTP is quite an old protocol and uses the routers stack quite heavily for passthrough hence other options like SSL or IPsec are both more secure and more reliable if many times more complicated.

[Geoff]

Also watch out if the router has VPN support enabled on itself. It may hold onto the ports and/or filter GRE even if you disable it.