Roadwarrior Scene Strongswan- 아이폰 설정

Raspberry Pi에서 Stringswan을 사용하여 로드워리어 클라이언트 시나리오 VPN을 설정하려고 합니다.

서버 구성은 다음과 같습니다.

pi@raspberrypi:~ $ sudo cat /etc/ipsec.conf
# ipsec.conf - strongSwan IPsec configuration file

config setup
  uniqueids=never
  charondebug="cfg 2, dmn 2, ike 2, net 2"

conn %default
  auto=add
  keyexchange=ikev2
  ike=aes128-sha256-ecp256
  esp=aes128-sha256-ecp256
  dpdaction=clear
  dpddelay=300s
  dpdtimeout = 5s
  forceencaps=yes
  fragmentation=yes
  keyingtries=5
  rekey=yes
  left=%any
  leftfirewall=yes
  leftid=MYDNSNAME
  leftsubnet=0.0.0.0/0
  leftcert=vpnGatewayCert.pem
  leftsendcert=always
  mobike=yes
  right=%any
  rightdns=1.1.1.1,1.0.0.1
  rightsourceip=192.168.122.101/24 ## LOCAL IP RANGE FOR VPN CONNECTED DEVICES
  type=tunnel

conn IKEv2
  rightauth=pubkey

include /var/lib/strongswan/ipsec.conf.inc

또한 비밀을 다음과 같이 수정했습니다.

nano /etc/ipsec.secrets


# This file holds shared secrets or RSA private keys for authentication.

# RSA private key for this host, authenticating it to any other host
# which knows the public part.

# this file is managed with debconf and will contain the automatically created $
include /var/lib/strongswan/ipsec.secrets.inc

: ECDSA vpnGatewayKey.pem

또한 Raspberry Pi에 CA를 생성하고 Strongswan 인증서를 생성했으며 다음 명령을 사용하여 클라이언트 인증서 번들 .p12 파일을 생성했습니다.

cd /etc/ipsec.d/
#creating CA Key
ipsec pki --gen --type ecdsa --size 521  --outform pem > private/CA_strongswanKey.pem
chmod 600 private/CA_strongswanKey.pem

#creating CA certificate
ipsec pki --self --ca --lifetime 3650 --in private/CA_strongswanKey.pem --type ecdsa --dn "C=CH, O=strongSwan, CN=strongSwan Root CA" --outform pem > cacerts/CA_strongswanCert.pem


#creating server key
ipsec pki --gen --type ecdsa --size 521 --outform pem > private/vpnGatewayKey.pem
chmod 600 private/vpnGatewayKey.pem

#creating serverCert
ipsec pki --pub --in private/vpnGatewayKey.pem --type ecdsa | \
        ipsec pki --issue --lifetime 730 \
        --cacert cacerts/CA_strongswanCert.pem \
        --cakey private/CA_strongswanKey.pem \
        --dn "C=CH, O=strongSwan, CN=MYDNSNAME" \
        --san MYDNSNAME \
        --flag serverAuth --flag ikeIntermediate \
        --outform pem > certs/vpnGatewayCert.pem


#Client Key
ipsec pki --gen --type ecdsa --size 521 --outform pem > private/ClientKey.pem
chmod 600 private/ClientKey.pem

#Client cert
ipsec pki --pub --in private/ClientKey.pem --type ecdsa | \
        ipsec pki --issue --lifetime 730 \
        --cacert cacerts/CA_strongswanCert.pem \
        --cakey private/CA_strongswanKey.pem \
        --dn "C=CH, O=strongSwan, CN=Client Key" \
        --san Client_Key \
        --outform pem > certs/ClientCert.pem


#Exporting client bundle
openssl pkcs12 -export -inkey private/ClientKey.pem \
        -in certs/ClientCert.pem -name "Client's VPN Certificate" \
        -certfile cacerts/CA_strongswanCert.pem \
        -caname "strongSwan Root CA" \
        -out Client.p12

이제 포트 500과 4500이 Raspberry Pi로 올바르게 전달되는지 확인했습니다. 이전 단계에서 만든 .p12 파일을 iPhone에 다운로드하고 프로필로 가져왔습니다. 또한 IPsec 게이트웨이 서버를 신뢰하도록 vpnGatewayCert.pem 및 CA_strongswanCert.pem을 iPhone으로 가져왔습니다!

iPhone을 VPN에 연결하려고 하면 iPhone에 오류가 발생합니다. Strongswan의 로그에서 나는 이것을 보았습니다:

Sep 29 16:18:45 raspberrypi charon: 13[IKE] received end entity cert "C=CH, O=strongSwan, CN=Client Key"
Sep 29 16:18:45 raspberrypi charon: 13[CFG] looking for peer configs matching 192.168.123.101[myDNSNAME]...94.109.49.167[10.218.49.167]
Sep 29 16:18:45 raspberrypi charon: 13[CFG]   candidate "IKEv2", match: 20/1/28 (me/other/ike)
Sep 29 16:18:45 raspberrypi charon: 13[CFG] selected peer config 'IKEv2'
Sep 29 16:18:45 raspberrypi charon: 13[IKE] no trusted RSA public key found for '10.218.49.167'
Sep 29 16:18:45 raspberrypi charon: 13[IKE] processing INTERNAL_IP4_ADDRESS attribute
Sep 29 16:18:45 raspberrypi charon: 13[IKE] processing INTERNAL_IP4_NETMASK attribute
Sep 29 16:18:45 raspberrypi charon: 13[IKE] processing INTERNAL_IP4_DHCP attribute
Sep 29 16:18:45 raspberrypi charon: 13[IKE] processing INTERNAL_IP4_DNS attribute
Sep 29 16:18:45 raspberrypi charon: 13[IKE] processing INTERNAL_IP6_ADDRESS attribute
Sep 29 16:18:45 raspberrypi charon: 13[IKE] processing INTERNAL_IP6_DHCP attribute
Sep 29 16:18:45 raspberrypi charon: 13[IKE] processing INTERNAL_IP6_DNS attribute
Sep 29 16:18:45 raspberrypi charon: 13[IKE] processing (25) attribute
Sep 29 16:18:45 raspberrypi charon: 13[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
Sep 29 16:18:45 raspberrypi charon: 13[IKE] peer supports MOBIKE
Sep 29 16:18:45 raspberrypi charon: 13[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
Sep 29 16:18:45 raspberrypi charon: 13[NET] sending packet: from 192.168.123.101[4500] to 94.109.49.167[28920] (80 bytes)
Sep 29 16:18:45 raspberrypi charon: 04[NET] sending packet: from 192.168.123.101[4500] to 94.109.49.167[28920]
Sep 29 16:18:45 raspberrypi charon: 13[IKE] IKE_SA IKEv2[3] state change: CONNECTING => DESTROYING