IPIP IPsec VPN tunnel between Linux machine and Mikrotik behind NAT provider

Linux: Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-91-generic x86_64)

• Eth0 1.1.1.1/32 external IP
• ipip-ipsec0 192.168.0.1/30 will be our tunnel

Miktoik: CCR 1009, RouterOS 6.46.5

• Eth0 10.0.0.2/30 internal IP from the provider. The provider's external NAT IP is dynamic.
• ipip-ipsec0 192.168.0.2/30 will be our tunnel

We will set up an IPsec tunnel on a Linux machine using racoon. I will not describe the details, there is a good article у vvpoloskin.

Install the required packages:

sudo install racoon ipsec-tools

We configure racoon, it will conditionally act as an ipsec server. Since mikrotik in main mode cannot transmit an additional client identifier, and the external ip address through which it connects to Linux is dynamic, it will not work to use a preshared key (password authorization), since the password must be matched either with the ip address of the connecting host, or with identifier.

We will use authorization by RSA keys.

The racoon daemon uses RSA keys, while mikrotik uses PEM keys. If you generate keys with the plainrsa-gen utility that comes with racoon, then you will not be able to convert the public key for Mikrotika to PEM format with it - it only converts in one direction: PEM to RSA. The key generated by plainrsa-gen could not be read by either openssl or ssh-keygen, so they will also fail to convert.

We will generate a PEM key with openssl and then convert it for racoon with plainrsa-gen:

#  Генерируем ключ
openssl genrsa -out server-name.pem 1024
# Извлекаем публичный ключ
openssl rsa -in server-name.pem -pubout > server-name.pub.pem
# Конвертируем
plainrsa-gen -i server-name.pem -f server-name.privet.key
plainrsa-gen -i server-name.pub.pem -f server-name.pub.key

We put the received keys in the folder: /etc/racoon/certs/server. Do not forget to set the owner of the user on whose behalf the racoon daemon is launched (usually root) to 600 rights.

I will describe the mikrotik setting when connecting via WinBox.

Upload the server-name.pub.pem key to mikrotik: Menu "Files" - "Upload".

Open the section "IP" - "IP sec" - tab "Keys". Now we generate the keys - the “Generate Key” button, then we export the mikrotika public key “Expor Pub. Key", you can download it from the "Files" section, right-click on the file - "Download".

We import the racoon public key, “Import”, in the drop-down list of the “File name” field, look for the server-name.pub.pem we loaded earlier.

mikrotik public key needs to be converted

plainrsa-gen -i mikrotik.pub.pem -f mikrotik.pub.key

and put it in the /etc/racoon/certs folder without forgetting the owner and rights.

racoon config with comments: /etc/racoon/racoon.conf

log info; # Уровень логирования, при отладке используем Debug или Debug2.

listen {

    isakmp 1.1.1.1 [500]; # Адрес и порт, на котором будет слушать демон.
    isakmp_natt 1.1.1.1 [4500]; # Адрес и порт, на котором будет слушать демон для клиентов за NAT.
    strict_address; # Выполнять обязательную проверку привязки к указанным выше IP.
}

path certificate "/etc/racoon/certs"; # Путь до папки с сертификатами.

remote anonymous { # Секция, задающая параметры для работы демона с ISAKMP и согласования режимов с подключающимися хостами. Так как IP, с которого подключается Mikrotik, динамический, то используем anonymous, что разрешает подключение с любого адреса. Если IP у хостов статический, то можно указать конкретный адрес и порт.

    passive on; # Задает "серверный" режим работы демона, он не будет пытаться инициировать подключения.
    nat_traversal on; # Включает использование режима NAT-T для клиентов, если они за NAT. 
    exchange_mode main; # Режим обмена параметрами подключения, в данном случае ---согласование.
    my_identifier address 1.1.1.1; # Идентифицируем наш linux хост по его ip адресу.
    certificate_type plain_rsa "server/server-name.priv.key"; # Приватный ключ сервера.
    peers_certfile plain_rsa "mikrotik.pub.key"; # Публичный ключ Mikrotik.

    proposal_check claim; # Режим согласования параметров ISAKMP туннеля. Racoon будет использовать значения подключающегося хоста (инициатора) для срока действия сессии                   и длины ключа, если его срок действия сессии больше, или длина его ключа короче, чем у инициатора. Если срок действия сессии короче, чем у инициатора, racoon использует собственное значение срока действия сессии и будет отправлять сообщение RESPONDER-LIFETIME.
    proposal { # Параметры ISAKMP туннеля.

        encryption_algorithm aes; # Метод шифрования ISAKMP туннеля.
        hash_algorithm sha512; # Алгоритм хеширования, используемый для ISAKMP туннеля.
        authentication_method rsasig; # Режим аутентификации для ISAKMP туннеля - по RSA ключам.
        dh_group modp2048; # Длина ключа для алгоритма Диффи-Хеллмана при согласовании ISAKMP туннеля.
        lifetime time 86400 sec; Время действия сессии.
    }

    generate_policy on; # Автоматическое создание ESP туннелей из запроса, пришедшего от подключающегося хоста.
}

sainfo anonymous { # Параметры ESP туннелей, anonymous - указанные параметры будут использованы как параметры по умолчанию. Для разных клиентов, портов, протоколов можно              задавать разные параметры, сопоставление происходит по ip адресам, портам, протоколам.

    pfs_group modp2048; # Длина ключа для алгоритма Диффи-Хеллмана для ESP туннелей.
    lifetime time 28800 sec; # Срок действия ESP туннелей.
    encryption_algorithm aes; # Метод шифрования ESP туннелей.
    authentication_algorithm hmac_sha512; # Алгоритм хеширования, используемый для аутентификации ESP туннелей.
    compression_algorithm deflate; # Сжимать передаваемые данные, алгоритм сжатия предлагается только один.
}

mikrotik config

We return to the section "IP" - "IPsec"

Profiles Tab
Parameter
Value

Name
At your discretion (default default)

Hash Algorithm
sha512

Encryption Algorithm
aes-128

D.H. Group
modp2048

Proposhal_check
claim

Lifetime
1d 00:00:00

NAT Traversal
true (tick)

DPD
120

DPD maximum failure
5

Peers tab
Parameter
Value

Name
At your discretion (hereinafter MyPeer)

Address
1.1.1.1 (IP linux machines)

Local address
10.0.0.2 (IP WAN interface mikrotik)

Profile
default

Exchange Mode
main

passive
false

Send INITIAL_CONTACT
true

Proposal Tab
Parameter
Value

Name
At your discretion (hereinafter MyPeerProposal)

Auth. Algorithms
sha512

Encr. Algorithms
aes-128-cbc

Lifetime
08:00:00

PFS Group
modp2048

Identities tab
Parameter
Value

Peer
MyPeer

Atuh. method
rsa key

Key
mikrotik.privet.key

remote key
server-name.pub.pem

Policy Template Group
default

Notrack Chain
is empty

My ID Type
auto

Remote ID Type
auto

Match By
remote id

Mode Configuration
is empty

Generate Policy
No.

Policies - General Tab
Parameter
Value

Peer
MyPeer

Tunnels
true

src. Address
192.168.0.0/30

Dest. address
192.168.0.0/30

Protocol
255 (all)

template
false

Policies - Action Tab
Parameter
Value

Action
encrypt

Level
require

IPsec Protocols
esp

Proposal
MyPeerProposal

Most likely, you, like me, have snat / masquerade configured on the WAN interface, this rule needs to be adjusted so that outgoing ipsec packets go to our tunnel:
Go to the "IP" - "Firewall" section.
Tab "NAT", open our snat/masquerade rule.

Advanced tab
Parameter
Value

IPsec Policy
out: none

Restarting the racoon daemon

sudo systemctl restart racoon

If racoon does not start when restarting, then there is an error in the config, in the syslog racoon displays information about the line number in which the error was found.

The racoon daemon, when the OS boots, starts before raising the network interfaces, and we specified the strict_address option in the listen section, it is necessary to add the racoon unit to the systemd file
/lib/systemd/system/racoon.service, to the [Unit] section, After=network.target line.

Now our ipsec tunnels should go up, we look at the output:

sudo ip xfrm policy

src 192.168.255.0/30 dst 192.168.255.0/30 
    dir out priority 2147483648 
    tmpl src 1.1.1.1 dst "IP NAT через который подключается mikrotik"
        proto esp reqid 0 mode tunnel
src 192.168.255.0/30 dst 192.168.255.0/30 
    dir fwd priority 2147483648 
    tmpl src "IP NAT через который подключается mikrotik" dst 1.1.1.1
        proto esp reqid 0 mode tunnel
src 192.168.255.0/30 dst 192.168.255.0/30 
    dir in priority 2147483648 
    tmpl src "IP NAT через который подключается mikrotik" dst 1.1.1.1
        proto esp reqid 0 mode tunnel

If the tunnels are not up, see syslog, or journalctl -u racoon.

Now you need to configure L3 interfaces so that traffic can be routed. There are different options, we will use IPIP, since mikrotik supports it, I would use vti, but, unfortunately, it has not yet been implemented in mikrotik. It differs from IPIP in that it can additionally encapsulate multicast and put labels (fwmark) on packets by which they can be filtered in iptables and iproute2 (policy-based routing). If you need maximum functionality, then, for example, GRE. But do not forget that for additional functionality we pay a big overhead.

Translation of a good overview of tunnel interfaces can be viewed here.

On Linux:

# Создаем интерфейс
sudo ip tunnel add ipip-ipsec0 local 192.168.255.1 remote 192.168.255.2 mode ipip
# Активируем
sudo ip link set ipip-ipsec0 up
# Назначаем адрес
sudo ip addr add 192.168.255.1/30 dev ipip-ipsec0

Now you can add routes for networks for mikrotik

sudo ip route add A.B.C.D/Prefix via 192.168.255.2

In order for our interface and routes to rise after a reboot, we need to describe the interface in /etc/network/interfaces and add routes in post-up there, or write everything in one file, for example, /etc/ipip-ipsec0.conf and pull it through post-up, don't forget about file owner, permissions and make it executable.

Under the cut is an example file

#!/bin/bash
ip tunnel add ipip-ipsec0 local 192.168.255.1 remote 192.168.255.2 mode ipip
ip link set ipip-ipsec0 up
ip addr add 192.168.255.1/30 dev ipip-ipsec0

ip route add A.B.C.D/Prefix via 192.168.255.2

On Mikrotik:

Section "Interfaces", add a new interface "IP tunnel":

Tab "IP tunnel" - "General"
Parameter
Value

Name
At your discretion (hereinafter referred to as IPIP-IPsec0)

MTU
1480 (if not specified, then mikrotik starts cutting mtu to 68)

Local address
192.168.0.2

remote address
192.168.0.1

IPsec Secret
Deactivate the field (otherwise a new Peer will be created)

keepalive
Deactivate the field (otherwise the interface will be constantly turned off, since mikrotika has some kind of its own format for these packages and does not work with linux)

DSCP
Inherit

Don't Fragment
No.

Clamp TCP MSS
true

Allow Fast Path
true

Section "IP" - "Addresses", add the address:

Parameter
Value

Address
192.168.0.2/30

Interface
IPIP-IPsec0

Now you can add routes on the network behind the linux machine, when adding a route, gateway will be our IPIP-IPsec0 interface.

PS

Since our linux server is transit, it makes sense to set the Clamp TCP MSS parameter for ipip interfaces on it:

create a file /etc/iptables.conf with the following content:

*mangle
-A POSTROUTING -o ipip+ -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
COMMIT

and in /etc/network/interfaces
post-up iptables-restore < /etc/iptables.conf

On the network behind mikrotik, nginx works for me (ip 10.10.10.1), we make it available from the Internet, add it to /etc/iptables.conf:

*nat
-A PREROUTING -d 1.1.1.1/32 -p tcp -m multiport --dports 80,443 -j DNAT --to-destination 10.10.10.1
#На mikrotik, в таблице mangle, надо добавить правило route с назначением 192.168.0.1 для пакетов с адресом источника 10.10.10.1 и портов 80, 443.

# Так же на linux работает OpenVPN сервер 172.16.0.1/24, для клиентов которые используют подключение к нему в качестве шлюза даем доступ в интернет
-A POSTROUTING -s 172.16.0.0/24 -o eth0 -j SNAT --to-source 1.1.1.1
COMMIT 

Don't forget to add the appropriate permissions to iptables if you have packet filters enabled.

Be healthy!

Source: habr.com