Roadwarrior IPSec Revisitec

Roadwarrior IPSec Revisitec

[Tom Rymes]

[-- Attachment #1: Type: text/plain, Size: 1729 bytes --]

Folks, I just revisited the IPSec roadwarrior configuration mess today, and I am hoping that I might be able to help in getting things squared away on that front. Configuring tunnels is a complete PITA for modern clients, and it pushes a lot of people over to OpenVPN because “IPSec is too complicated.” 

To summarize the current status, the Roadwarrior configs written by IPFire do not work with modern clients, and include outdated and deprecated IPSec settings. Combine that with the fact that each client seems to need its own unique combination of settings, and you get a big mess.

So, my thought was to modify the vpnmain.cgi script such that it provides multiple options when creating tunnels. Currently, it asks if you want to create:

- Host-to-Net Tunnel (Roadwarrior)
- Net-to-Net Tunnel

To replace this, I am envisioning:

- Host-to-Net Tunnel - Windows Client
- Host-to-Net Tunnel - MacOS Client
- Host-to-Net Tunnel - iOS Client
- Host-to-Net Tunnel - Android Client
- Net-To Net Tunnel

This would be a good start, but I am hoping to eventually be able to have the WUI write out the config such that one tunnel could service all clients (which is not easily achieved just yet). This would eliminate the need to have multiple types of roadwarrior setups. Checkboxes in the configuration page could be used to enable and disable different client OSes, as doing so can improve security (by disabling weaker ciphers, mostly).

Once the WUi is modified to actually write out a config that works with modern clients, then I was thinking that creation of Windows install scripts and Apple Configuration Profiles would be a really nice feature if possible.

Does anyone have any input?

Tom

Re: Roadwarrior IPSec Revisitec

[Tom Rymes]

[-- Attachment #1: Type: text/plain, Size: 2301 bytes --]

I forgot to mention that I revisited my earlier wiki example for creating a MacOS Roadwarrior configuration. I was able to fix bad photos, eliminate some errors and bad information, and generally clean things up a bit. 

https://wiki.ipfire.org/configuration/services/ipsec/example_configuration-_roadwarrior_with_macos

As you can see, it’s a pretty ugly process, and needlessly complex.

Please chime in if you have suggestions.

Tom

> On Dec 9, 2018, at 8:20 PM, Tom Rymes <trymes(a)rymes.com> wrote:
> 
> Folks, I just revisited the IPSec roadwarrior configuration mess today, and I am hoping that I might be able to help in getting things squared away on that front. Configuring tunnels is a complete PITA for modern clients, and it pushes a lot of people over to OpenVPN because “IPSec is too complicated.” 
> 
> To summarize the current status, the Roadwarrior configs written by IPFire do not work with modern clients, and include outdated and deprecated IPSec settings. Combine that with the fact that each client seems to need its own unique combination of settings, and you get a big mess.
> 
> So, my thought was to modify the vpnmain.cgi script such that it provides multiple options when creating tunnels. Currently, it asks if you want to create:
> 
> - Host-to-Net Tunnel (Roadwarrior)
> - Net-to-Net Tunnel
> 
> To replace this, I am envisioning:
> 
> - Host-to-Net Tunnel - Windows Client
> - Host-to-Net Tunnel - MacOS Client
> - Host-to-Net Tunnel - iOS Client
> - Host-to-Net Tunnel - Android Client
> - Net-To Net Tunnel
> 
> This would be a good start, but I am hoping to eventually be able to have the WUI write out the config such that one tunnel could service all clients (which is not easily achieved just yet). This would eliminate the need to have multiple types of roadwarrior setups. Checkboxes in the configuration page could be used to enable and disable different client OSes, as doing so can improve security (by disabling weaker ciphers, mostly).
> 
> Once the WUi is modified to actually write out a config that works with modern clients, then I was thinking that creation of Windows install scripts and Apple Configuration Profiles would be a really nice feature if possible.
> 
> Does anyone have any input?
> 
> Tom

Re: Roadwarrior IPSec Revisitec

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 1083 bytes --]

Hey Tom,

I am also quite frustrated about this. IPsec as a protocol is working well, but getting client support working is indeed a PITA.

However, this will be a huge job to get it to work better. There are loads of hacks around and I am not sure what has been tested as working and what now.

Right now, I am using OpenVPN for RW and IPsec for N2N connections. Although OpenVPN has other issues, this is working quite well across multiple clients, but always requires additional software to be installed.

I would propose the following process: I would prefer to implement this in IPFire 3 first. That does not help much with running this right now, but it is a good playing ground to build this properly and experiment. Loads of work has already been put into that.

However, my time is very limited at the moment and unfortunately I am very busy dealing with loads of other things in this project. Therefore progress has been … slow. So everyone who can contribute and help out so that more free time is available will be greatly appreciated of course.

-Michael