Configure VPN Gateway - Revision history

Dlk at 12:44, 31 December 2019

2019-12-31T12:44:26Z

Dlk: /* Adjust the MTU on the network systems that will use this connection */

2014-12-05T17:24:26Z

Adjust the MTU on the network systems that will use this connection

Dlk: /* Configure static routes on my default router that direct intranet traffic to the VPN gateway */

2014-12-05T17:20:29Z

Configure static routes on my default router that direct intranet traffic to the VPN gateway

Dlk: /* Configure static routes on my default router that direct intranet traffic to the VPN gateway */

2014-12-05T17:12:28Z

Configure static routes on my default router that direct intranet traffic to the VPN gateway

Dlk at 17:05, 5 December 2014

2014-12-05T17:05:22Z

Dlk: /* Create a systemctl script to start and stop the VPN connection */

2014-12-05T17:04:46Z

Create a systemctl script to start and stop the VPN connection

Dlk: /* Adjust the MTU on the network systems that will use this connection */

2014-12-05T17:02:06Z

Adjust the MTU on the network systems that will use this connection

Dlk: /* Configure static routes on my default router that direct intranet traffic to the VPN gateway */

2014-12-05T17:00:47Z

Configure static routes on my default router that direct intranet traffic to the VPN gateway

Dlk: /* Configure static routes on my default router that direct intranet traffic to the VPN gateway */

2014-12-05T16:59:41Z

Configure static routes on my default router that direct intranet traffic to the VPN gateway

Dlk: /* Configure static routes on my default router that direct intranet traffic to the VPN gateway */

2014-12-05T16:58:22Z

Configure static routes on my default router that direct intranet traffic to the VPN gateway

@@ Line 18: / Line 18: @@
 This means that I need to set a bunch of static routes on the LRT214, the same bunch of routes that openclient sets up on the gateway machine when it establishes the VPN connection.
+[[Category: Networking]]
 The only facility for setting static routes on the LRT214 is to use a forms-based UI to enter them one at a time.  Ouch!  So I hacked together the setVPNStaticRoutes script.  It queries the routes table on the gateway machine and then constructs a forms submit HTTP POST that sets all of the static routes that I need on the LRT214 in one go.

@@ Line 26: / Line 26: @@
 The MTU of the VPN connection is 1355.  With my other systems set to 1500, the connection does not function properly - pings work, but web pages don't fully render, Notes cannot replicate, etc. To fix this I used the "ip" command to change the MTU temporarily and the system network settings to make it permanent.  This I do have to do individually on every machine that will access the intranet.
-To set MTU on the fly - ip link set dev eth0 mtu 1300
+To set MTU on the fly on a Linux system: ip link set dev eth0 mtu 1300
 ==Files==
 The software/ibm-cisco-vpn folder on fileserver contains all the files mentioned here.

← Older revision		Revision as of 17:20, 5 December 2014
Line 20:		Line 20:

	The only facility for setting static routes on the LRT214 is to use a forms-based UI to enter them one at a time. Ouch! So I hacked together the setVPNStaticRoutes script. It queries the routes table on the gateway machine and then constructs a forms submit HTTP POST that sets all of the static routes that I need on the LRT214 in one go.		The only facility for setting static routes on the LRT214 is to use a forms-based UI to enter them one at a time. Ouch! So I hacked together the setVPNStaticRoutes script. It queries the routes table on the gateway machine and then constructs a forms submit HTTP POST that sets all of the static routes that I need on the LRT214 in one go.
		+
		+	TODO: It probably makes sense to incorporate this process into the ibm-cisco-vpn script on the gateway. There's a cookie-based authentication piece for the LRT214 that I'm not 100% sure about. That would need to be worked out to see if the cookie value is stable over time. If this was possible then it would eliminate the need to manually check the routes list periodically and update the static routes in the LRT214 manually.

	==Adjust the MTU on the network systems that will use this connection==		==Adjust the MTU on the network systems that will use this connection==

@@ Line 19: / Line 19: @@
 This means that I need to set a bunch of static routes on the LRT214, the same bunch of routes that openclient sets up on the gateway machine when it establishes the VPN connection.
-The only facility for setting static routes on the LRT214 is to use a forms-based UI to enter them one at a time.  Ouch!  So I hacked together the setVPNStaticRoutes script.  It queries the routes table on the gateway machine and then constructs a forms submit POST that sets all of the static routes that I need on the LRT214 in one go.
+The only facility for setting static routes on the LRT214 is to use a forms-based UI to enter them one at a time.  Ouch!  So I hacked together the setVPNStaticRoutes script.  It queries the routes table on the gateway machine and then constructs a forms submit HTTP POST that sets all of the static routes that I need on the LRT214 in one go.
 ==Adjust the MTU on the network systems that will use this connection==

← Older revision		Revision as of 17:05, 5 December 2014
Line 1:		Line 1:
−	When I moved my edge router onto commercial hardware, replacing a custom-configured Linux box, I lost the ability to connect my whole network to the intranet through a VPN. Here's how I restored that connectivity.	+	When I moved my edge router onto commercial hardware, replacing a custom-configured Linux box, I lost the ability to connect my whole network to the intranet through a VPN tunnel. Here's how I restored that connectivity.

	==Install VPN software on a "gateway" system on my network==		==Install VPN software on a "gateway" system on my network==

@@ Line 6: / Line 6: @@
 ===Create a systemctl script to start and stop the VPN connection===
-I created the /usr/local/bin/ibm-cisco-vpn script on the gateway machine to control openconnect and /usr/lib/systemd/system/ibm-cisco-vpn.service to define it to systemctl.
+I created the /usr/local/bin/ibm-cisco-vpn script on the gateway machine to control openconnect and /usr/lib/systemd/system/ibm-cisco-vpn.service to define it to systemctl.  The ibm-cisco-script also handles the iptables-based configuration setup for NAT routing through the VPN tunnel.
 ===Modified the nameserver configuration on the gateway system===

@@ Line 17: / Line 17: @@
 I use a Belkin/Linksys LRT214 router as the default router for my network and as my gateway to the internet.  I want it to be able to route traffic that's meant for the intranet over to the intranet gateway machine.  That way I don't have to set up routes on every machine in the network, they can just keep on using the same default router they always have and it will know how to route their traffic.
-This means that I need to set a bunch of static routes on the LRT214 to do this, the same bunch of routes that openclient sets up on the gateway machine when it establishes the VPN connection.
+This means that I need to set a bunch of static routes on the LRT214, the same bunch of routes that openclient sets up on the gateway machine when it establishes the VPN connection.
 The only facility for setting static routes on the LRT214 is to use a forms-based UI to enter them one at a time.  Ouch!  So I hacked together the setVPNStaticRoutes script.  It queries the routes table on the gateway machine and then constructs a forms submit POST that sets all of the static routes that I need on the LRT214 in one go.

@@ Line 15: / Line 15: @@
 ==Configure static routes on my default router that direct intranet traffic to the VPN gateway==
-I use a Belkin/Linksys LRT214 router as the default router for my network and as my gateway to the internet.  I want it to be able to route traffic that's meant for the intranet on the to intranet gateway machine.  That way I don't have to set routes on each machine in the network, they can keep on using the same default router they always have.
+I use a Belkin/Linksys LRT214 router as the default router for my network and as my gateway to the internet.  I want it to be able to route traffic that's meant for the intranet over to the intranet gateway machine.  That way I don't have to set up routes on every machine in the network, they can just keep on using the same default router they always have and it will know how to route their traffic.
 This means that I need to set a bunch of static routes on the LRT214 to do this, the same bunch of routes that openclient sets up on the gateway machine when it establishes the VPN connection.