OpenWRT as client, No Traffic through Tunnel #549
Comments
|
OpenWRT is a mess. You need to fix your NAT rules in *nat POSTROUTING and SNAT the connections to the assigned virtual IP. You also need to configure the updown script to set up the SNAT and tear it down. The configuration itself is also a mess and the tunnel fails open. The proper way to do it is to use auto=route, but that doesn't work with "virtual" IPs yet. |
|
Oh man, didn't realize OpenWRT was considered client unsupported, actually thought it was the defacto test device/case... Any recommendations on a device that could be used to place between router and connection as a VPN egress? Alternatively, any recommendations of VPN that could run nicely on OpenWRT? It would be nice to see it working on OpenWRT but I currently do not understand enough about the postrouting, SNAT, and updown script to properly put together a fix (unless someone has some decent pointers in that regard). |
|
I would suggest buy an EdgeRouter and use this PR as a starting point. The actual changes I made in there are pretty straightforward. This will be the the easiest way for whole-network IPSEC at this point. |
|
On 21.05.2017 04:23, Kirat Pandya wrote:
easiest way for whole-network IPSEC at this point.
Only because the configuration is already prewritten. EdgeRouter suffers
from the same conceptual defects as OpenWRT in regards to support
for polciy based IPsec.
…--
GPG Key ID: 0x63EC6658
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658
|
|
@Thermi - if anything - I had to disable SNAT for LAN clients to route over the tunnel. EdgeOS brings up the tunnel and keeps it up. Also I am using auto=route. VirtualIP support is still lacking though. What other products would you suggest to solve this scenario in a reasonable price range? |
|
As you know, OpenWRT is free and routers are cheap. I don't know how much an EdgeRouter costs.
I don't know of any product that solves this (in a reasonable price range) that can be extended by the user.
Sure, you could find used Juniper SRXs, but the firmware is crap and it's proprietary. And probably costs too much, still.
Support for "virtual" IPs with auto=route can be implemented when we fix route installation. It shouldn't be too much work,
I think.
…On 21.05.2017 22:55, Kirat Pandya wrote:
@Thermi <https://github.com/thermi> - if anything - I had to disable SNAT for LAN clients to route over the tunnel. EdgeOS brings up the tunnel and keeps it up. Also I am using auto=route.
VirtualIP support is still lacking though.
What other products would you suggest to solve this scenario in a reasonable price range?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub <#549 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ADcJQdPh3irPR5KzuKA6oCqWsSEmyfoSks5r8KTBgaJpZM4Naeac>.
--
GPG Key ID: 0x63EC6658
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658
|
|
The EdgeRouter X is $50 and the EdgeRouter Lite is $100. Both support IPsec HW offload (100s of Mb/s throughput) for AES256+sha128/256 - assuming you are willing to downgrade ciphers from GCM. https://help.ubnt.com/hc/en-us/articles/115006567467-EdgeRouter-Hardware-Offloading-Explained The other advantage over OpenWRT is that you get updates on a regular basis as opposed to having to wait for a maintainer to release another build for your particular router. I have no affiliation with Ubiquity Networks - I just think they make a great product for the price. |
|
With EdgeOS, you are dependent on the goodwill of the company making it.
With OpenWRT, you can do anything you want and upgrade anything. You're never forced
to wait for maintainers to do things. You can cross compile and build packages yourself.
AES-GCM is very much prefered over AES-CBC with HMAC-SHA256. (sha128 doesn't exist. only sha1, sha256, sha384 and sha512, where the latter three use SHA2.)
…On 21.05.2017 23:07, Kirat Pandya wrote:
The EdgeRouter X is $50 and the EdgeRouter Lite is $100. Both support IPsec HW offload (100s of Mb/s throughput) for AES256+sha128/256 - assuming you are willing to downgrade ciphers from GCM.
https://help.ubnt.com/hc/en-us/articles/115006567467-EdgeRouter-Hardware-Offloading-Explained
The other advantage over OpenWRT is that you get updates on a regular basis as opposed to having to wait for a maintainer to release another build for your particular router.
I have no affiliation with Ubiquity Networks - I just think they make a great product for the price.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub <#549 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ADcJQXrvwe08k4TyBexTeBxNhqREuVIdks5r8Kd-gaJpZM4Naeac>.
--
GPG Key ID: 0x63EC6658
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658
|
|
I don't want to get in to the Free vs proprietary debate here. For me, compiling my router firmware is a bridge too far. At that point I'd just deploy a pfsense box but that is a whole other project. IMO, Ubiquiti, being one of the fastest growing SMB/rural ISP networking vendors, is incentivized enough to give me well tested updates, promptly. I am not dependent on their goodwill per se. @WaterNS, if you want something working now, EdgeRouter X/Lite are 2 "appliance" options - you have to chose between the points @Thermi and I are debating. Re: Ciphers - In my case, my primary concern is my keeping my ISP out so AES-CBC + HMAC-SHA256 is good enough. Its a fair tradeoff for me to actually get > 150Mb/s IPSec throughput (vs 30 Mb/s without HW offload). Each client on my LAN that supports GCM tunnels is given separate a NATed route out to maintain its own direct tunnel to Algo. The router tunnel is for all other the non-IPSec HW in my house like my IOT devices, media streamers etc. sha128 - yeah I meant sha1 - flubbed it. |
|
So I do like the idea of being able to purchase something like an EdgeRouter X/Lite and have a fairly well "supported" hardware device. I've ran my own PfSense, Monowall, unTangle, etc etc etc - there is absolutely something to be said about somewhat simplified (albeit often with limitations) but functioning solution - all the formers felt like running Hackintosh vs the real thing (sneeze wrong way in its direction beyond light weight load and it has a mini heart attack). Things like TomatoUSB, OpenWRT builds maintained by community members, have been a happy medium with regards to unlocking more advanced capabilities but NOT forcing one to delve into cross compiling firmwares and debugging. To Thermi's point, OpenWRT actually has a somewhat decent package system that doesn't force someone create own packages/firmwares and adding packages can be done via Where it (currently) begins to fall apart for Edge Router at the moment is:
Whats not clear to me is what exactly is the defacto supported client device implementation. Is it a raspberry Pi running ubuntu variant? An Apple device? So far, the Apple devices seem to have the top level of support - the generated mobileconfigs seem to work a charm (and much props for that). I had thought OpenWRT was the defacto ideal client based on the readme and everything else was trying to mimic what is achievable there but turns out to not be current case. Hopefully, none of the above is taken as criticism of either thoughts - There has been a lot of work and effort contributed and I do not wish any of my words to be taken in a way that would discourage furthering the journey. My hope is what can come is a well support option for whole network scenario. I'm thinking OpenWRT might be the answer here, but I will gladly consider Edge Router if the firmware supports latest/highest standards. |
|
OpenWRT IS the answer here, but you'll have to fix some firewall rules there to make it work (and preferably stop using LUCI to manage the firewall, because it's not aware of IPsec and tunnels). |
|
On server side I have Algo on Digital Ocean and client side OpenWrt on TpLink. I couldn't make it work with strongswan but it worked like a charm with wireguard. See https://openwrt.org/docs/guide-user/services/vpn/wireguard/client |
OS / Environment
OSX 10.12.4 - runs algo scripts
DigitalOcean - algo node set up here
Clients:
Summary of the problem
Algo appears to set up properly.
Testing with the Mac client (using the provided .mobileconfig) is a success: Whoer.net shows expected DigitalOcean IP.
Testing with OpenWRT client results in what appears to be a successful connection, but not traffic appears to be routed through the IPSec tunnel.
Steps to reproduce the behavior
(once working, possible Wiki entry for OpenWRT client?)
Setup Algo instance:
Prep the OpenWRT with required packages
Send over the algo generated bits:
Configure OpenWRT client with Algo bits:
The way of deployment (cloud or local)
Cloud (digitalocean)
Expected behavior
curl ipinfo.io/ipon OpenWRT router show Algo instance IP)Actual behavior
OpenWRT ssh session:
Computer connected to OpenWRT router:
Full log
cat
/etc/ipsec.confipsec start --noforkipsec startipsec statusallThe text was updated successfully, but these errors were encountered: