Enterprise VPNs: IPsec (strongSwan) and OpenVPN
You build IKEv2/IPsec with strongSwan and certificate-based VPNs with OpenVPN, and solve problems with site-to-site links to other vendors.
Level 301 · 17 lessons · 15 practice labs
Lessons
IPsec concepts
- IPsec architecture: IKE, ESP, AH
- The IKEv2 handshake and SAs
- Tunnel and transport mode
- Crypto proposals and mismatches
- Short task: decode the negotiation from an IKE log
strongSwan
- A pre-shared key tunnel with strongSwan
- Authenticating with certificates
- NAT traversal and UDP 4500
- Route-based IPsec: XFRM interfaces
- IPsec troubleshooting: swanctl and ip xfrm
- Short task: link two offices with IPsec
OpenVPN
- A PKI for OpenVPN with easy-rsa
- Setting up an OpenVPN server
- Client profiles and certificate revocation
- Pushing routes and DNS to clients
- Short task: revoke the certificate of a stolen laptop
Wrap-up
- Capstone: a hybrid VPN for HQ, branch and remote staff
Practice labs
- NO_PROPOSAL_CHOSEN: the proposals do not match: Find the crypto proposal mismatch between two strongSwan ends in the logs, settle both sides on a strong common proposal and show the IKE SA established.
- Right secret, wrong identity: Work out from the logs the identity (ID) mismatch behind AUTH_FAILED in a tunnel whose pre-shared key is correct, fix it and show the tunnel up with swanctl.
- IKE is up, the child SA is not: Find the traffic-selector mismatch rejecting the CHILD SA while the IKE SA is up on Pinecrest Bank’s branch tunnel, align both ends on the same subnets and show protected traffic in the counters.
- The tunnel is up, traffic escapes to the internet: Show branch traffic being caught by the masquerade rule and leaving unencrypted although the tunnel is up, add the NAT exemption and prove it with ESP packets.
- Move from a shared secret to certificates: Change an office-to-office tunnel running on a pre-shared key to authenticate with certificates from the lab CA, and show an end with a certificate from the wrong CA being rejected.
- The branch behind NAT cannot connect: Use a capture to find why the tunnel of a branch moved behind NAT comes up but passes nothing (UDP 4500, filtered ESP, encapsulation), fix it and show traffic both ways.
- Which traffic is really encrypted?: Read "ip xfrm state" and "ip xfrm policy" to show in a table which subnet pairs are protected and which one’s counters never grow.
- No tunnel change for every new subnet: Convert a policy-based tunnel to a route-based one using an XFRM interface, and show a new subnet going through the tunnel by adding only a route.
- Backup takes over when the primary tunnel drops: Arrange Windy Ridge Energy’s two route-based tunnels over two links so traffic moves to the backup when the primary dies (DPD, route metrics), and measure the switchover time by cutting the link.
- The client cannot connect: certificate verify failed: Find from the logs why an OpenVPN client fails certificate verification (wrong CA file or expired certificate), fix it with easy-rsa and show the connection.
- Connected, but no file server: Solve connected clients being unable to reach the internal subnet and internal names by pushing routes and DNS from the server, fix the return path on the server side too, and show access by name from a client.
- The contractor may reach one server only: Give the contractor client a fixed address on Oakmere Studios’s OpenVPN server, allow it only one server in the firewall, and test staff and contractor access side by side.
- Nobody can reach the VPN this morning: Find from the logs the expired revocation list rejecting every client at once, renew it and show a revoked certificate is still refused.
- Five ready profiles for five staff: Write a script that issues certificates for a given staff list and builds a single-file client profile for each, and show it by connecting with one of the profiles.
- Remote staff cannot reach the branch: In a network where head office and branch use IPsec and remote staff use OpenVPN, find why a remote worker cannot reach a branch server (pushed routes, traffic selectors, return path), fix it and show end-to-end access.
About this course
You build IKEv2/IPsec with strongSwan and certificate-based VPNs with OpenVPN, and solve problems with site-to-site links to other vendors.
What you will learn
- IPsec concepts
- strongSwan
- OpenVPN
- Wrap-up
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.