Openswan, "server-client" setup

Inside the container, we will use openswan as the IPsec daemon and the standard xl2tpd from the repositories as the L2TP server:

apt-get install openswan xl2tpd

Next, we will configure forwarding and the rest of the network subsystem to ensure proper operation with NAT and VPN:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -j SNAT --to-source <main IP of server>
iptables -A FORWARD -s 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -d 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
for each in /proc/sys/net/ipv4/conf/*; do echo 0 > $each/accept_redirects; echo 0 > $each/send_redirects; done

Let's proceed with configuring the IPsec daemon.

Update the /etc/ipsec.conf configuration file as follows:

config setup
  protostack=netkey
  nat_traversal=yes                          # Enables NAT traversal
  virtual_private=%v4:192.168.1.0/8          # with this option you can add your local IP in NAT
conn L2TP-PSK-NAT
  rightsubnet=vhost:%priv
  also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
  authby=secret                              # Auth with PSK ( preshared key )
  pfs=no
  auto=add                                   
  keyingtries=3
  rekey=no
  ikelifetime=8h
  salifetime=10m
  type=tunnel                                # type of l2tp connection ( tunnel / transport )
  left=11.11.11.11                         # left - is internet IP of l2tp server
  leftprotoport=17/1701
  right=%any                                 # right - is IP of client ( if client NATed , that IP of client is IP in NAT )
  rightprotoport=17/1701

The most important parts of the configuration are commented. It is also important to create the configuration exactly as shown above, preserving the leading spaces for commands that have them, because the daemon associates indented commands with the block defined by the non-indented "conn" directive.

Now, let's set up authorization for IPsec. There are two authentication methods: certificate-based and pre-shared key (PSK). In this example, we will configure PSK authentication in the /etc/ipsec.secrets file:

11.11.11.11 %any: PSK "mykey"

11.11.11.11 is the external IP address of our server
%any is a built-in variable representing any IP address
PSK is the authentication method (RSA can also be used)
"mykey" is the secret key for authentication, which needs to be provided to the client.

Now it's time to configure the L2TP server. It will operate via the PPP protocol.

Update the /etc/xl2tpd/xl2tpd.conf configuration file as follows:

[global]
port = 1701
auth file = /etc/xl2tpd/l2tp-secrets        # auth file with pars login/password for l2tp auth
[lns default]
ip range = 10.0.0.2-10.0.0.200              # range of IP's , that give to clients when auth is good
local ip = 10.0.0.1                        
refuse chap = yes
refuse pap = yes
require authentication = yes
ppp debug = no                                        # debug mode
pppoptfile = /etc/ppp/options.xl2tpd        #  this is ppp options config file
length bit = yes
exclusive = no
assign ip = yes
name = VPN-Server

In this configuration, critical sections are commented out, while the rest are self-explanatory. When configuring the server, comments from the configuration file should be removed.

Configure the L2TP authorization file /etc/xl2tpd/l2tp-secrets. We will allow connections from everyone since L2TP operates via PPP, so we will use PPP authentication.

# Secrets for authenticating l2tp tunnels
# us    them    secret
# *             marko blah2
# zeus          marko   blah
# *     *       interop
*       *       *   # let all , because we use auth with ppp

Next, configure the PPP configuration file requested by our L2TP daemon (/etc/ppp/options.xl2tpd):

refuse-mschap-v2
refuse-mschap
ms-dns 8.8.8.8
ms-dns 8.8.4.4
asyncmap 0
auth
crtscts
idle 1800
mtu 1200
mru 1200
lock
hide-password
local
#debug
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4

If you encounter connectivity or connection issues, uncomment "#debug" for debugging L2TP and check the system log /var/log/syslog for errors.

Configure PPP authorization (/etc/ppp/chap-secrets):

# Secrets for authentication using CHAP
# client        server  secret                  IP addresses
test2   l2tpd   test    *

Login: test2
Server for which this pair is valid for authentication: l2tpd
Password: test
Clients from all IP addresses (*) can connect with this password.

Restart both services:

/etc/init.d/ipsec restart
/etc/init.d/xl2tpd restart

Now, let's verify the correct operation of the IPsec modules inside the container:

ipsec verify

The output of a working IPsec will look something like this:

root@XXX:~# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path                                 [OK]
Linux Openswan U2.6.37-g955aaafb-dirty/K2.6.32-042stab084.10 (netkey)
Checking for IPsec support in kernel                            [OK]
 SAref kernel support                                           [N/A]
 NETKEY:  Testing XFRM related proc values                      [OK]
        [OK]
        [OK]
Checking that pluto is running                                  [OK]
 Pluto listening for IKE on udp 500                             [OK]
 Pluto listening for NAT-T on udp 4500                          [OK]
Checking for 'ip' command                                       [OK]
Checking /bin/sh is not /bin/dash                               [WARNING]
Checking for 'iptables' command                                 [OK]
Opportunistic Encryption Support    

Now, configure the Windows 7 client to connect to our L2TP VPN with IPsec encryption.