install-libreswan-xl2tpd-ipsec-vpn-remote-access-on-aws-ec2_aws_linux_ami_201409

install-libreswan-xl2tpd-ipsec-vpn-remote-access-on-aws-ec2_aws_linux_ami_201409

#!/bin/sh
#
# Shell script for installation and setup of L2TP/IPsec VPN tunnel in remote access
# mode.  Remote access mode allaows individual users to login using username/password
# and be allocated IP on the private network.  Uses shared secret (PSK) and username/password
# in file (ppp chap-secret) for authentication.  VPN software is libreswan + xl2tpd + pppd.
#
# This should work on linux systems that are RHEL based.
#
# To install directly from this gist, you can curl the "raw" version and pipe that to
# "bash -s" while also defining the environment variables:
#
#     curl -s https://gist.githubusercontent.com/rogerbush8/.../raw/.../...whatever... |
#         PSK="a secret" USER=roger PW=pa55word LOW_IP=10.1.48.5 HIGH_IP=10.1.63.254 bash -s
#
# This script creates a first username and password for vpn login in /etc/ppp/chap-secrets file.
# Additional username/pw entries may be added without restarting ipsec or xl2tpd.  Note
# the DNS is setup for AWS 10.1.0.2, which works well for Private Network when using
# Route 53 Private Hosted Zones.
#
# Assumes VPN network is 10.0.0.0/8 (see iptables *nat* routing rule)
#
# I've used this successfully in the following scenario:  Setup a VPN tunnel for remote access
# with VPN in public subnet (AWS VPC), administering a pool of IPs in private subnet.
#
# Helpful debugging (server-side):
#
#     $ /etc/init.d/xl2tpd restart
#     $ /etc/init.d/ipsec restart
#     $ tail -f /var/log/secure : see messages on restart
#     $ tail -f /var/log/messages : 
#     $ ipsec version : printout version info
#     $ ipsec verify : check config and kernel properties
# 
# Helpful debugging (Mac OSX client-side):
#   
#     $ route -n get some_ip : shows gateway for some_ip (for IPs on private, should be VPN IP)
#     $ nslookup some_ip : should work for private IPs if DNS is right and Route 53 private hosted zone setup.
#     $ netstat -nr : shows all the routes.
#     $ ping some_ip : N.B. you must enable ICMP traffic on your private network.
# 
# Original post by Thomas Sarlandie: 
# http://www.sarfata.org/posts/setting-up-an-amazon-vpn-server.md
#
# Copyright (C) 2014 Lin Song
# Based on the work of Thomas Sarlandie (Copyright 2012)
#
# This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 
# Unported License: http://creativecommons.org/licenses/by-sa/3.0/
#
# Attribution required: please include my name in any derivative and let me
# know how you have improved it! 
 
if [ "$(uname)" = "Darwin" ]; then
    echo "DO NOT run this script on your Mac! It should only be run on a newly-created EC2 instance"
    echo "or other Dedicated Server / VPS, after you have modified it to set the variables below."
    echo "Please see detailed instructions at the URLs in the comments."
    exit 1
fi
 
# Define these variables.  You may either pass these in as variables to the script
# or directly replace them here.

IPSEC_PSK=$PSK                     # shared secret
VPN_USER=$USER                     # first chap username
VPN_PASSWORD=$PW                   # first chap password
IP_POOL_RANGE_LOW_IP=$LOW_IP       # low ip of pool of ips - on AWS the first 4 IPs, and last IP of a subnet are reserved.
IP_POOL_RANGE_HIGH_IP=$HIGH_IP     # high ip of pool of ips

  
# Important Notes:
# For Windows users, a registry change is required to allow connections
# to a VPN server behind NAT. Refer to section "Error 809" on this page:
# https://kb.meraki.com/knowledge_base/troubleshooting-client-vpn
 
# iPhone/iOS users may need to replace this line in ipsec.conf:
# "rightprotoport=17/%any" with "rightprotoport=17/0".
 
# If using Amazon EC2, these ports must be open in the security group of
# your VPN server: UDP ports 500 & 4500, and TCP port 22 (optional, for SSH).
 
# In Amazon EC2, these two variables will be found automatically
# For all other servers, you MUST replace them with the actual IPs!
# If your server only has a public IP, use that IP on both lines
# Get public IP: dig +short myip.opendns.com @resolver1.opendns.com
# Get private IP: ifconfig eth0 | grep "inet addr" | awk -F: '{print $2}' | awk '{print $1}'

PUBLIC_IP=$(wget -q -O - 'http://169.254.169.254/latest/meta-data/public-ipv4')
PRIVATE_IP=$(wget -q -O - 'http://169.254.169.254/latest/meta-data/local-ipv4')
 
# Install necessary packages
yum -y update
yum -y install libreswan --enablerepo=epel
yum -y install xl2tpd --enablerepo=epel


# Prepare various config files
cat > /etc/ipsec.conf <<EOF
version 2.0
config setup
  dumpdir=/var/run/pluto/
  protostack=netkey
  nat_traversal=yes
  virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10
  # oe=off
  # nhelpers=0
  # interfaces=%defaultroute

include /etc/ipsec.d/*.conf
EOF
 
mkdir /etc/ipsec.d

cat > /etc/ipsec.d/vpnpsk.conf <<EOF
conn vpnpsk
  connaddrfamily=ipv4
  auto=add
  left=$PRIVATE_IP
  leftid=$PUBLIC_IP
  leftsubnet=$PRIVATE_IP/32
  leftnexthop=%defaultroute
  leftprotoport=17/1701
  rightprotoport=17/%any
  right=%any
  rightsubnetwithin=0.0.0.0/0
  forceencaps=yes
  authby=secret
  pfs=no
  type=transport
  auth=esp
  ike=3des-sha1,aes-sha1
  phase2alg=3des-sha1,aes-sha1
  rekey=no
  keyingtries=5
  dpddelay=30
  dpdtimeout=120
  dpdaction=clear
 
  nat-keepalive=yes
EOF
 
cat > /etc/ipsec.secrets <<EOF
$PUBLIC_IP %any : PSK "$IPSEC_PSK"
EOF
 
cat > /etc/xl2tpd/xl2tpd.conf <<EOF
[global]
port = 1701
ipsec saref = yes 

[lns default]
ip range = ${IP_POOL_RANGE_LOW_IP}-${IP_POOL_RANGE_HIGH_IP}
local ip = $PRIVATE_IP
require chap = yes
refuse pap = yes
require authentication = yes
name = l2tpd
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
EOF
 
cat > /etc/ppp/options.xl2tpd <<EOF
ipcp-accept-local
ipcp-accept-remote
ms-dns 10.1.0.2
noccp
auth
crtscts
idle 1800
mtu 1280
mru 1280
lock
connect-delay 5000
proxyarp
debug
logfile /var/log/ppp.log
# lcp-echo-failure 10
# lcp-echo-interval 60
EOF

 
cat > /etc/ppp/chap-secrets <<EOF
# Secrets for authentication using CHAP
# client server secret IP addresses
$VPN_USER l2tpd $VPN_PASSWORD *
EOF
 
/bin/cp -f /etc/sysctl.conf /etc/sysctl.conf.old-$(date +%Y-%m-%d-%H:%M:%S)
cat > /etc/sysctl.conf <<EOF
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.default.rp_filter = 0
net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
kernel.randomize_va_space = 1
net.core.wmem_max=12582912
net.core.rmem_max=12582912
net.ipv4.tcp_rmem= 10240 87380 12582912
net.ipv4.tcp_wmem= 10240 87380 12582912
EOF
 
# Routing rules for forwarding packets to network beyond our new VPN gateway.

/bin/cp -f /etc/iptables.rules /etc/iptables.rules.old-$(date +%Y-%m-%d-%H:%M:%S)
cat > /etc/iptables.rules <<EOF
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:ICMPALL - [0:0]
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp --icmp-type 255 -j ICMPALL
-A INPUT -p udp --dport 67:68 --sport 67:68 -j ACCEPT
-A INPUT -p tcp --dport 22 -j ACCEPT
-A INPUT -p udp -m multiport --dports 500,4500 -j ACCEPT
-A INPUT -p udp --dport 1701 -m policy --dir in --pol ipsec -j ACCEPT
-A INPUT -p udp --dport 1701 -j DROP
-A INPUT -j DROP
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -i eth+ -o ppp+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ppp+ -o eth+ -j ACCEPT
-A FORWARD -j DROP
-A ICMPALL -p icmp -f -j DROP 
-A ICMPALL -p icmp --icmp-type 0 -j ACCEPT
-A ICMPALL -p icmp --icmp-type 3 -j ACCEPT
-A ICMPALL -p icmp --icmp-type 4 -j ACCEPT
-A ICMPALL -p icmp --icmp-type 8 -j ACCEPT
-A ICMPALL -p icmp --icmp-type 11 -j ACCEPT
-A ICMPALL -p icmp -j DROP
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.0.0.0/8 -o eth+ -j SNAT --to-source $PRIVATE_IP
COMMIT
EOF

 
# Set to automatic start
chkconfig ipsec on
chkconfig xl2tpd on

if [ ! -f /etc/ipsec.d/cert8.db ] ; then
 echo > /var/tmp/libreswan-nss-pwd
 /usr/bin/certutil -N -f /var/tmp/libreswan-nss-pwd -d /etc/ipsec.d
 /bin/rm -f /var/tmp/libreswan-nss-pwd
fi
 

/sbin/sysctl -p
/bin/chmod 600 /etc/ipsec.secrets /etc/ppp/chap-secrets
/sbin/iptables-restore < /etc/iptables.rules

# use iptable service to save a copy of rules to /etc/sysconfig/iptables
# for startup (see /etc/rc0.d/K92iptables)

service iptables save


# turn off rp_filter

echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter

 
/etc/init.d/ipsec restart
/etc/init.d/xl2tpd restart

# Display some results
ipsec verify
ipsec version