VPN: Difference between revisions

From Grid5000
Jump to navigation Jump to search
Line 84: Line 84:


=== Network interfaces configuration ===
=== Network interfaces configuration ===
{{Managed by Puppet|classes=networkg5k|note=}}


  # The DMZ private network interface
=== Iptables configuration ===
  auto eth0
{{Managed by Puppet|classes=iptablesg5k|note=}}
  iface eth0 inet static
    address 192.168.67.14
    netmask 255.255.255.0
    broadcast 192.168.67.255
    post-up ip route add 172.16.0.0/16 via 192.168.67.253
 
  # The DMZ public network interface
  auto eth1
  iface eth1 inet static
    address 194.254.60.14
    netmask 255.255.255.192
    gateway 194.254.60.61
 
  # The VPN network interface, bridged
  auto br-vpn
  iface br-vpn inet static
  address 172.20.0.1
  netmask 255.255.0.0
  bridge-ports eth2 tap0
  pre-up ip tuntap add dev tap0 mode tap


=== OpenVPN configuration ===
=== OpenVPN configuration ===
{{Managed by Puppet|classes=openvpn,openvpng5k|note=}}
{{Managed by Puppet|classes=openvpn,openvpng5k|note=}}


== Dom0 ==
== Dom0 ==
 
{{Managed by Puppet|classes=networkg5k|note=}}
  sudo vconfig add eth3 600
  sudo brctl addbr br-vpn
  sudo brctl addif br-vpn eth3.600
  sudo ifconfig eth3.600 up
  sudo ifconfig br-vpn up
 
 
  # /etc/xen/vpn.cfg
  vif        = [ 'ip=192.168.67.14,mac=00:16:3E:94:30:D7,bridge=br-dmz-priv',
                  'ip=194.254.60.14,mac=00:16:3E:44:4B:FC,bridge=br-dmz-pub',
                  'mac=00:16:3E:A9:B1:26,bridge=br-vpn' ]
 
 
  # /etc/network/interfaces
 
  auto eth1 eth2 eth3
  # eth1 -- production (188)
  iface eth1 inet manual
  # eth2 -- dmz pub (666)
  iface eth2 inet manual
  # eth3 -- dmz priv (667) & vpn (600)
  iface eth3 inet manual
 
  #==================
  # = switch-prod =
  #==================
  auto switch-prod
  iface switch-prod inet static
    address 172.16.143.2
    netmask 255.255.240.0
    gateway 172.16.143.254
    bridge_ports eth1
    bridge_stp off
 
 
  #=======================
  # = dmz public bridge =
  #=======================
  # Interface 7/18 du fastiron (eth2 de srv2)
  auto br-dmz-pub
  iface br-dmz-pub inet manual
        bridge_ports eth2.666
        bridge_stp off
        pre-up /sbin/ifup eth2.666
        post-down /sbin/ifdown eth2.666
 
  #========================
  # = dmz private bridge =
  #========================
  # Interface 7/19 du fastiron (eth3 de srv2)
  auto br-dmz-priv
  iface br-dmz-priv inet manual
      bridge_ports eth3.667
        bridge_stp off
        pre-up /sbin/ifup eth3.667
        post-down /sbin/ifdown eth3.667
 
  #===============
  # = VPN bridge =
  #===============
  # Interface 7/19 du fastiron (eth3 de srv2)
  auto br-vpn
  iface br-vpn inet manual
      bridge_ports eth3.600
        bridge_stp off
        pre-up /sbin/ifup eth3.600
        post-down /sbin/ifdown eth3.600


== Network Equipment ==
== Network Equipment ==


=== On equipment hosting VPN ===
=== On equipment hosting VPN {{Yes}}===


  vlan 600 name VPN by port
  vlan 600 name VPN by port
Line 194: Line 107:
   ip address 172.20.255.254 255.255.0.0
   ip address 172.20.255.254 255.255.0.0


=== On other sites' routers ===
=== On other sites' routers {{No}} ===


   route add 172.20.0.0/16 gw 192.168.4.<VPN_site>
   route add 172.20.0.0/16 gw 192.168.4.<VPN_site>
Line 201: Line 114:
== VPN Client ==
== VPN Client ==


OpenVPN's client.conf file:
{{No}}
 
  client
  remote access.lyon.grid5000.fr 1194
  proto udp
  ca ca.crt
  cert client1.crt
  key client1.key
  #tls-auth ta.key 1
  dev tap

Revision as of 14:23, 8 October 2013

Présentation CT

Principe

  • Connecter des hôtes/réseaux distants "comme si" ils appartiennent au même réseau local
  • Chiffrer / Authentifier tout ce qui passe sur les réseaux publiques
  • Intêret pour G5K
    • S'affranchir de la passerelle SSH
    • Accès au monde extérieur (à un serveur, à un réseau)

Implémentation

  • OpenVPN : Interfaces virtuelles, Linux, portage Windows, SSL, flexible Check.png
  • L2 VPN Check.png
    • Encapsulation de la trame Ethernet (L2) ou paquet IP (L3)
    • Fonctionnement des applications non-IP
  • Réseau VPN VLAN dédié
    • meilleur isolation, pas le VLAN de production
    • besoin de configuration des routeurs G5K Fail.png
  • Encapsulation dans
    • UDP Check.png
    • TCP ? Fail.png

Configuration client

  • addresse IP dans réseau VPN
  • persistence:
    • Par nom de certificat / login Check.png
    • DNS name:
      • vpn1.grid5000.fr, vpn2.grid5000.fr Fail.png
      • <login>.vpn.grid5000.fr ? Fail.png : Besoin de DNS dynamique
  • routes G5K (Golden rules !)
    • 172.16.0.0/16 Check.png
    • 10.0.0.0/8 ? Fail.png
  • Configuratiuon DNS G5K du client Fail.png
  • Authentification Client
    • Génération certificat Client à la demande InProgress.png

Securité

  • Serveur : Idem access nationale Check.png
    • Interfaces:
      • interface DMZ Publique (pour connexion client VPN depuis Internet)
      • interface DMZ Privée (pour administration G5K)
      • interface VLAN VPN, sans adresse IP (pour acheminement sur VLAN VPN)
    • Utilisation des classes puppet DMZ

L2 Ethernet Networks

Some additional VLAN is needed :

  • VPN : Hosts connected to Grid5000 using VPN access use a dedicated VLAN implemented in sophia site. Check.png

Vlan number

VLAN number Usage Name
600 VPN network VPN

L3 IP Networks

Routing policy

The following table gives detail about the routing policy of each L2 VLAN :

Network Routed locally Routed globally
VPN network Check.png Check.png

Addressing plan

About VPN

Site VPN
Sophia 172.20.0.0/16

Need additional route in every gw-site. Fail.png

Configuration

DomU

Network interfaces configuration

Puppet logo.png Managed by Puppet

Classes : networkg5k

Files : {{{files}}}

Note :

Iptables configuration

Puppet logo.png Managed by Puppet

Classes : iptablesg5k

Files : {{{files}}}

Note :

OpenVPN configuration

Puppet logo.png Managed by Puppet

Classes : openvpn,openvpng5k

Files : {{{files}}}

Note :

Dom0

Puppet logo.png Managed by Puppet

Classes : networkg5k

Files : {{{files}}}

Note :

Network Equipment

On equipment hosting VPN Check.png

vlan 600 name VPN by port
 tagged 7/19
 router-interface ve 60

interface ve 60
 port-name VPN
 ip address 172.20.255.254 255.255.0.0

On other sites' routers Fail.png

 route add 172.20.0.0/16 gw 192.168.4.<VPN_site>


VPN Client

Fail.png

Retrieved from "https://www.grid5000.fr/mediawiki/index.php?title=VPN&oldid=48174"