Introduction

This is Part 4 of the series of articles about setting up site-to-site VPN between on premise LAN and Azure. Here you can learn how to install and configure strongSwan.

If you missed the Part 3 please check it out here:

Site-to-Site VPN between on premise network and Azure using DD_WRT and Entware / StrongSwan – part 3 of 5

Install strongSwan

From Wikipedia: “strongSwan is a complete IPsec implementation for Linux 2.6, 3.x, and 4.x kernels. The focus of the project is on strong authentication mechanisms using X.509public key certificates and optional secure storage of private keys on smartcards through a standardized PKCS#11 interface.”

To install in on the router do this:

Use putty to telnet to the router and then run this command:

opkg list *strongswan*

You need to capture the list of modules in order to install them all. I just copied the information from the screen and pasted it in a text file and then split the modules in several opkg install commands:

opkg install strongswan strongswan-charon strongswan-ipsec strongswan-libtls strongswan-mod-addrblock strongswan-mod-aes strongswan-mod-af-alg strongswan-mod-agent strongswan-mod-attr strongswan-mod-attr-sql strongswan-mod-blowfish strongswan-mod-ccm strongswan-mod-cmac strongswan-mod-constraints strongswan-mod-coupling strongswan-mod-ctr

opkg install strongswan-mod-curl strongswan-mod-curve25519 strongswan-mod-des strongswan-mod-dhcp strongswan-mod-dnskey strongswan-mod-duplicheck strongswan-mod-eap-identity strongswan-mod-eap-md5 strongswan-mod-eap-mschapv2 strongswan-mod-eap-radius strongswan-mod-eap-tls strongswan-mod-farp strongswan-mod-fips-prf strongswan-mod-gcm strongswan-mod-gcrypt strongswan-mod-gmp

opkg install strongswan-mod-gmpdh strongswan-mod-ha strongswan-mod-hmac strongswan-mod-kernel-libipsec strongswan-mod-kernel-netlink strongswan-mod-ldap strongswan-mod-led strongswan-mod-load-tester strongswan-mod-md4 strongswan-mod-md5 strongswan-mod-mysql strongswan-mod-nonce strongswan-mod-openssl strongswan-mod-pem strongswan-mod-pgp strongswan-mod-pkcs1

opkg install strongswan-mod-pkcs11 strongswan-mod-pkcs12 strongswan-mod-pkcs7 strongswan-mod-pkcs8 strongswan-mod-pubkey strongswan-mod-random strongswan-mod-rc2 strongswan-mod-resolve strongswan-mod-revocation strongswan-mod-sha1 strongswan-mod-sha2 strongswan-mod-smp strongswan-mod-socket-default strongswan-mod-socket-dynamic strongswan-mod-sql strongswan-mod-sqlite

opkg install strongswan-mod-sshkey strongswan-mod-stroke strongswan-mod-test-vectors strongswan-mod-unity strongswan-mod-updown strongswan-mod-vici strongswan-mod-whitelist strongswan-mod-x509 strongswan-mod-xauth-eap strongswan-mod-xauth-generic strongswan-mod-xcbc strongswan-pki strongswan-scepclient strongswan-swanctl

Configure strongSwan

The configuration file of strongSwan is located at /opt/etc/strongswan.conf

Open the file in a text editor and override the content with the following text:

# strongswan.conf - strongSwan configuration file
#
# Refer to the strongswan.conf(5) manpage for details
#
# Configuration changes should be made in the included files
# Verbosity levels
# -1: Absolutely silent
# 0: Very basic auditing logs, (e.g. SA up/SA down)
# 1: Generic control flow with errors, a good default to see whats going on
# 2: More detailed debugging control flow
# 3: Including RAW data dumps in Hex
# 4: Also include sensitive material in dumps, e.g. keys
charon {
        load_modular = yes
        plugins {
                include strongswan.d/charon/*.conf
        }
        filelog {
                /opt/tmp/charon.log {
                        time_format = %b %e %T
                        append = no
                        default = 0 # in case troubleshoot is required switch this to 2
                }
                stderr {
                        ike = 0 # in case troubleshoot is required switch this to 2
                        knl = 0 # in case troubleshoot is required switch this to 3
                        ike_name = yes
                }
        }
        syslog {
                # enable logging to LOG_DAEMON, use defaults
                daemon {
                }
                # minimalistic IKE auditing logging to LOG_AUTHPRIV
                auth {
                        default = 0 # in case troubleshoot is required switch this to 2
                        ike = 0 # in case troubleshoot is required switch this to 2
                }
        }
}
include strongswan.d/*.conf

Configure the router firewall

Add these rules to the router firewall (Administration -> Commands -> Save Firewall):

iptables -t filter -A INPUT -p udp --dport 500 -j ACCEPT
iptables -t filter -A INPUT -p udp --dport 4500 -j ACCEPT
iptables -t filter -A INPUT -p esp -j ACCEPT

Reboot the router in order to apply the firewall rules.

This concludes the installation and configuration of the strongSwan.

In the last part we are going to use the Azure RM Portal to deploy a site-to-site template and configure the IPSec on the router. This is the last step and after that you will have a working site-to-site VPN connection from your home network to Azure:

Site-to-Site VPN between on premise network and Azure using DD_WRT and Entware / StrongSwan – part 5 of 5

Introduction

This is Part 2 of the series of articles about setting up site-to-site VPN between on premise LAN and Azure. If you missed the Part 1 please check it out here:

Site-to-Site VPN between on premise network and Azure using DD_WRT and Entware / StrongSwan – part 1 of 5

In Part you you will find out how to replace the T-Mobile firmware with DD-WRT

Flash Asus T-Mobile Cellspot with DD-WRT

I used the instructions from Asus T-Mobile Cellspot. The main problem was that there were too many external links to follow and too many edits / way to do a certain thing. With so much information you can get lost. My goal is to give you a streamlined process to follow – the same that I followed and that worked for me.

The overall process is as follows:

1. Download tools and firmwares
2. Downgrade the actual firmware
3. Backup the CFE (Common Firmware Environment)
4. Patch the CFE (change the MAC addresses and the secret code numbers)
5. Flash the patched CFE
6. Install Merlin firmware
7. Install DD-WRT firmware

Downgrading the CFE and the firmware is required in order to “unlock” the router. Without this it will not allow you to flash a third-party firmware like Merlin or DD-WRT.

I am not sure why Merlin was installed before DD-WRT. I followed the instructions and it worked.

Download tools and firmwares

The original article has link to a .rar file that has the tools. I ended up not using some of them (the HEX editor for example). Because of that I compiled my own tmo2ac68u.zip file that has the tools and firmwares I used. Download the file by clicking the link above. Unzip it. It should look like this:

Downgrade the firmware

You need to flash the older firmware found in 02. T-Mobile Firmware folder. Do the following:

1. Connect a cable to the Ethernet port of your computer. The other end connect to one of the LAN ports of the router. LAN ports are yellow.
   I made the assumption your computer has an Ethernet port. If not – find one that has – you need to be connected with a cable:
   
   
   You also need to set a static API address for your Ethernet adapter as shown below:
   
2. Disable Wi-Fi. This is to prevent any IP conflict in case the router and your LAN are on the same sub-net.
3. Place the router into “recovery mode” by doing the following:
   1. Turn off router with push button
   2. Press and hold reset button
   3. Turn on router with push button
   4. Release reset button when power light flashes slowly
      NOTE: This can be tricky. I was not able to get the power light to flash. I had to try several time and also to use WPS button as described here: Recovery Mode Flashing Instructions
4. Use browser to go to router homepage (192.168.29.1 for T-Mobile). You should see something like this:

5. Click Browse and select TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx file from 02. T-Mobile Firmware folder.
6. Click Upload.
7. Perform NVRAM reset by doing:
* Power off the router
* Hold the WPS Button
* Power on the router and keep the WPS pressed for 10-15 seconds
* Reboot and allow 5 minutes to rebuild NVRAM variables.

Backup the CFE

Go to the router homepage (http://192.168.29.1). Enable telnet by navigating: Administration -> System -> Enable Telnet=Yes -> click ‘Apply’

You have to back up the original CFE to a USB stick. The files are small so any size should work, Make sure is is formatted as FAT32.

1. Plug the USB to your computer and copy the following files from “01. CFE & Tools” folder:mtd-write
   rt-ac68u_1.0.2.0_us.bin
   cfe.exe
2. Rename rt-ac68u_1.0.2.0_us.bin to new_cfe.bin
3. Remove safely (eject) the USB from your computer and connect it to the black (USB2.0) port on the back of the router: Run putty.exe from “01. CFE & Tools” folder and connect to 192.18.29.1 on port 23.
4. Login with username admin and password password providing you did not change the default ones.
5. Save existing CFE onto USB stick:

   cat /dev/mtd0 > /tmp/mnt/USB_NAME/original_cfe.bin

   Replace USB_NAME with USB flash drive name:
   
   

6. Wait 10 seconds and remove the flash drive from the router

Patch the CFE

1. Plug the USB to your computer and verify you have the following file present:
   mtd-write
   new_cfe.bin
   original_cfe.bin
   cfe.exe
2. Run cfe.exe. This will read the MAC  addresses and the secret code number from original_cfe.bin and will save it in new_cfe.bin
   You should see a message that says the process completed successfully. If you don’t see it try to do it manually as described under Section 5 here.
3. Eject the USB drive from your computer and connect it to the USB 2.0 port on the router.

Flash the patched CFE

1. Wait 15 seconds and perform NVRAM reset (see above for how to do it in case you forgot).
   NOTE: This is the part that I was not sure if needed but I followed it. NVRAM reset disabled the telnet and restored the default username and password. This is something to pay attention for. Please, enable telnet again.
2.  Use putty to connect to the router at to 192.18.29.1 on port 23 and run this commands:

   cd /tmp/mnt/USB_NAME/
   mtd-write -i new_cfe.bin -d boot
   

   Again – replace the USB_NAME with the name of your usb drive

3.   Wait 15 seconds and reboot the router by typing this command:reboot <Enter>
4.  Wait until the router is completely rebooted (2-3 minutes to be safe) and perform NVRAM reset (see above for how to do it in case you forgot).
5.  The NVRAM reset should disable the telnet. Please, enable it again and connect to the router
6. Verify the version of the CFE by running this command:nvram get bl_version <Enter>It should show 1.0.2.0

Install Merlin firmware

1. Place router in recovery mode
2. Flash Merlin firmware from “03. Merlins Firmare” folder via the CFE Webserver recovery mode
3. Perform NVRAM reset

Install DD-WRT firmware

1. Enable Telnet and connect to the router
   NOTE: After flashing Merlin the IP address of the router changed from 192.168.29.1 to 192.168.1.1. I had to change my static address from 192.18.29.2 to 192.18.1.2 to be able to connect via telnet.
2. Go to Administration -> Firmware Upgrade and flash the Brainslayer version of DD-WRT fount in 04. DD-WRT Firmware\01. BrainSlayer folder.
3. Enable Telnet and connect with putty
4. Run these to clean the NVRAM and reboot:

   clear nvram
   erase nvram
   reboot
   

5. Use the web interface and go to Administration -> Firmware upgrade  and flash the Kong version of DD-WRT found in 04. DD-WRT Firmware\02. Kong folder
6. Perform NVRAM reset by doing:
   * Power off the router
   * Hold the WPS Button
   * Power on the router and keep the WPS pressed for 10-15 seconds
   * Reboot and allow 5 minutes to rebuild NVRAM variables.

That’s it ! In the next part we are going to install Entware-ng:

Site-to-Site VPN between on premise network and Azure using DD_WRT and Entware / StrongSwan – part 3 of 5

Introduction

This article describes how to set up a site-to-site VPN between a home network and Azure using a consumer-grade wireless router.

Once completed this will allow you to access the resources (virtual machines, databases, etc. ) in Azure as if they were part of your  home LAN. You can also access the resources on your network at home from Azure.

The following diagram shows what the site-to-site VPN will look like at the end:

Credit

This article is based on work other people did before me and a would like to give them credit for this. Here are the main sources I used:

Asus RT-AC68U
Asus T-Mobile Cellspot

The two links above and all the other resources linked from there helped me to successfully replace the T-Mobile firmware and replace it with DD-WRT.

ON-PREMISES SITE 2 SITE VPN WITH AZURE USING TOMATO SHIBBY MOD (ENTWARE-NG AND STRONGSWAN SETUP) – PART 1

Viorel’s article helped me a great deal while installing Entware-NG and configuring strongSwan. In his set-up he uses Tomato Shibby Mod, so if you are using this instead of DD-WRT make sure to check it out.

One bite at a time

This whole process can be divided in several steps and I will create a separate posts for each of it. Here I will give the high level overview.

In order to set up a site-to-site VPN with Azure you need a “VPN Device” that can act as a VPN gateway in your on premise network. It can be a hardware device – for example Barracuda NextGen Firewall F-series  or a software – Routing and Remote Access Service (RRAS) that comes with Windows Server 2012 R2.

The specialized hardware VPN devices can be expensive. Windows Server license plus a machine to run it on is also expensive. Luckily there is another way – you can use an inexpensive router to achieve the same goal. You may be even lucky to use your existing router if it meets certain requirements.

You router need to support IPsec and IKEv2 . If the stock firmware does not support it you may be able to install alternative firmware that does or install additional software like strongSwan. This is what I did.

I did not want to mess up my existing network, so I decided to buy a new router to play with. I picked a T-Mobile branded router that is actually the same as ASUS RT-AC68U but is just half the price.

Once you get the router the rest of the process is roughly as follows:

1. Get rid of the T-Mobile firmware. You want to do this because it is locked and does not allow you to flash non-tmobile firmwares.
2. Install DD-WRT. This is an alternative firmware which I have been using for some time. It allows you to install strongSwan
3. Install Entware-ng-3x and strngSwan.
4. Configure the site-to-site VPN

Please, read the second part where I describe how to replace the T-Mobile firmware with DD-WRT:

Site-to-Site VPN between on premise network and Azure using DD_WRT and Entware / StrongSwan – part 2 of 5