From aa14bbcd4bb2f64c7c1811120492917e012daec5 Mon Sep 17 00:00:00 2001 From: "David M. Syzdek" Date: Wed, 11 May 2022 01:12:44 -0800 Subject: renaming VPN project --- notes/projects/strongswan/lecvpn.md | 96 -------------- notes/projects/strongswan/mgmtvpn.md | 129 ------------------ notes/projects/strongswan/vpn-notes.md | 235 --------------------------------- notes/projects/vpn/lecvpn.md | 96 ++++++++++++++ notes/projects/vpn/mgmtvpn.md | 129 ++++++++++++++++++ notes/projects/vpn/vpn-notes.md | 235 +++++++++++++++++++++++++++++++++ 6 files changed, 460 insertions(+), 460 deletions(-) delete mode 100644 notes/projects/strongswan/lecvpn.md delete mode 100644 notes/projects/strongswan/mgmtvpn.md delete mode 100644 notes/projects/strongswan/vpn-notes.md create mode 100644 notes/projects/vpn/lecvpn.md create mode 100644 notes/projects/vpn/mgmtvpn.md create mode 100644 notes/projects/vpn/vpn-notes.md (limited to 'notes') diff --git a/notes/projects/strongswan/lecvpn.md b/notes/projects/strongswan/lecvpn.md deleted file mode 100644 index 18cbafe..0000000 --- a/notes/projects/strongswan/lecvpn.md +++ /dev/null @@ -1,96 +0,0 @@ - -LEC VPN Subnets -=============== - - * 172.25.242.64/26 - NWC LEC Mgmt VPN Subnet - - 172.25.242.64/29 - Servers - - 172.25.242.72/29 - User Pool - - 172.25.242.80/28 - Site to Site Pool - - 172.25.242.96/27 - Reserved - - * 172.25.243.64/26 - CWC LEC Mgmt VPN Subnet - - 172.25.243.64/29 - Servers - - 172.25.243.72/29 - User Pool - - 172.25.243.80/28 - Site to Site Pool - - 172.25.243.96/27 - Reserved - - * 2001:4948:0:2::d170:a012/127 - NWC P2P - * 2001:4948:0:2::d170:a010/127 - CWC P2P - * fdac:4aca:1cf6:188::/64 - NWC Servers (VRRP) - * fdac:4aca:1cf6:18a::/64 - CWC Servers (VRRP) - - -LEC VPN Service Addresses -=============== - - * lecvpndev.acsalaska.net (NWC) - - Address: 209.112.160.0 - - Address: 2001:4948:d:0::189 - - * lecvpn.acsalaska.net (CWC) - - Address: 209.112.160.1 - - Address: 2001:4948:d:0::187 - - * lecvpn.nwc.acsalaska.net. (NWC) - - Address: 209.112.160.6 - - Address: 2001:4948:d:0::188 - - * lecvpn.cwc.acsalaska.net. (CWC) - - Address: 209.112.160.7 - - Address: 2001:4948:d:0::18a - - -LEC VPN Servers -=============== - - * NWC Cluster - * lecvpn20.prv.nwc - - Hypervisor: xen62.prv.nwc/xen63.prv.nwc - - Specs: 2 vcpu; 4096 MB RAM; Pool-node2; - - Network: eth1.2088 - - Network: eth1.2089 172.25.242.65/29 via 172.25.242.70 - - Network: eth1.2089 fdac:4aca:1cf6:188::65/64 - - * lecvpn21.prv.nwc - - Hypervisor: xen63.prv.nwc/xen62.prv.nwc - - Specs: 2 vcpu; 4096 MB RAM; Pool-node2; - - Network: eth1.2088 - - Network: eth1.2089 172.25.242.66/29 via 172.25.242.70 - - Network: eth1.2089 fdac:4aca:1cf6:188::66/64 - - * lecvpnvrrp20.prv.nwc - - Network: eth1.2088 209.112.160.17/31 via 209.112.160.16 - - Network: eth1.2088 2001:4948:0:2::d170:a011/127 - - Network: eth1.2089 172.25.242.69/29 - - Network: eth1.2089 fdac:4aca:1cf6:188::69/64 - - * CWC Cluster - * lecvpn30.prv.cwc - - Hypervisor: xen16.prv.cwc/xen17.prv.cwc - - Specs: 2 vcpu; 4096 MB RAM; Pool-node1; - - Network: eth1.2088 - - Network: eth1.2089 172.25.243.65/29 via 172.25.243.70 - - Network: eth1.2089 fdac:4aca:1cf6:18a::65/64 - - * lecvpn31.prv.cwc - - Hypervisor: xen17.prv.cwc/xen16.prv.cwc - - Specs: 2 vcpu; 4096 MB RAM; Pool-node1; - - Network: eth1.2088 - - Network: eth1.2089 172.25.243.66/29 via 172.25.243.70 - - Network: eth1.2089 fdac:4aca:1cf6:18a::66/64 - - * lecvpnvrrp30.prv.cwc - - Network: eth1.2088 209.112.160.19/31 via 209.112.160.18 - - Network: eth1.2088 2001:4948:0:2::d170:a013/127 - - Network: eth1.2089 172.25.243.69/29 - - Network: eth1.2089 fdac:4aca:1cf6:18a::69/64 - - -Configuration URLs -================== - - * https://configs.prv.acsalaska.net/pub/configs/vpn/lec/firewall.git - * https://configs.prv.acsalaska.net/pub/configs/vpn/lec/keepalived.git - * https://configs.prv.acsalaska.net/pub/configs/vpn/strongswan.git - * https://configs.prv.acsalaska.net/pub/configs/vpn/swanctl.git - diff --git a/notes/projects/strongswan/mgmtvpn.md b/notes/projects/strongswan/mgmtvpn.md deleted file mode 100644 index a7773b6..0000000 --- a/notes/projects/strongswan/mgmtvpn.md +++ /dev/null @@ -1,129 +0,0 @@ -Equipment Management VPN Infrastructure -======================================= - -Networks and VLANs ------------------- - - * VLAN - - Public Subnet: MGMT_VPN / 2086 - - Private Subnet: MGMT_VPN / 2087 - - * Networks - - 10.0.50.128/27 Equipment Management VPN Servers - - 10.0.50.128/28 Equipment Management VPN Servers (NWC) - - 10.0.50.144/28 Equipment Management VPN Servers (CWC) - - - 209.112.160.56/29 Service Addresses - - - 209.112.160.64/28 Public Uplinks - - 209.112.160.64/29 Public Uplinks (NWC) - - 209.112.160.72/29 Public Uplinks (CWC) - - - 2001:4948:d::90/124 Service Addresses - - - 2001:4948:d:90::/63 Public Uplinks - - 2001:4948:d:90::/64 Public Uplinks (NWC) - - 2001:4948:d:91::/64 Public Uplinks (CWC) - - - fdac:4aca:1cf6:90::/63 VRRP Network - - fdac:4aca:1cf6:90::/64 VRRP Network (NWC) - - fdac:4aca:1cf6:91::/64 VRRP Network (CWC) - - -Service Addresses ------------------ - - * mgmtvpn1.nwc.acsalaska.net - - Address: 209.112.160.56 - - Address: 2001:4948:d::90/128 - - * mgmtvpn2.nwc.acsalaska.net - - Address: 209.112.160.57 - - Address: 2001:4948:d::91/128 - - * mgmtvpn1.cwc.acsalaska.net - - Address: 209.112.160.60 - - Address: 2001:4948:d::94/128 - - * mgmtvpn2.cwc.acsalaska.net - - Address: 209.112.160.61 - - Address: 2001:4948:d::95/128 - - -Routers -------- - - * mx1.nwc - - xe-11/3/1.2086: 209.112.160.70/29 - - xe-11/3/1.2086: 2001:4948:d:90::1/64 - - xe-11/3/1.2087: 10.0.50.142/28 - - * mx1.cwc - - xe-11/3/1.2086: 209.112.160.78/29 - - xe-11/3/1.2086: 2001:4948:d:91::1/64 - - xe-11/3/1.2087: 10.0.50.158/28 - - -VRRP Addresses --------------- - - * NWC Cluster - * mgmtvpnvrrp20.prv.nwc - - Network: eth1.2086 209.112.160.65/29 via 209.112.160.70 - - Network: eth1.2086 2001:4948:d:90::65/64 via 2001:4948:d:90::1 - - Network: eth1.2087 10.0.50.141/28 - - Network: eth1.2087 fdac:4aca:1cf6:90::141/64 - - * mgmtvpnvrrp21.prv.nwc - - Network: eth1.2086 209.112.160.66/29 via 209.112.160.70 - - Network: eth1.2086 2001:4948:d:90::66/64 via 2001:4948:d:90::1 - - Network: eth1.2087 10.0.50.140/28 - - Network: eth1.2087 fdac:4aca:1cf6:90::140/64 - - * CWC Cluster - * mgmtvpnvrrp30.prv.cwc - - Network: eth1.2086 209.112.160.73/29 via 209.112.160.78 - - Network: eth1.2086 2001:4948:d:91::73/64 via 2001:4948:d:91::1 - - Network: eth1.2087 10.0.50.157/28 - - Network: eth1.2087 fdac:4aca:1cf6:91::157/64 - - * mgmtvpnvrrp31.prv.cwc - - Network: eth1.2086 209.112.160.74/29 via 209.112.160.78 - - Network: eth1.2086 2001:4948:d:91::74/64 via 2001:4948:d:91::1 - - Network: eth1.2087 10.0.50.156/28 - - Network: eth1.2087 fdac:4aca:1cf6:91::156/64 - - -Servers -------- - - * NWC Cluster - * mgmtvpn20.prv.nwc - - Hypervisor: xen62.prv.nwc/xen63.prv.nwc - - Specs: 2 vcpu; 4096 MB RAM; Pool-node1; - - Network: eth1.2086 n/a - - Network: eth1.2087 10.0.50.129/28 via 10.0.50.142 - - Network: eth1.2087 fdac:4aca:1cf6:90::129/64 - - * mgmtvpn21.prv.nwc - - Hypervisor: xen63.prv.nwc/xen62.prv.nwc - - Specs: 2 vcpu; 4096 MB RAM; Pool-node1; - - Network: eth1.2086 n/a - - Network: eth1.2087 10.0.50.130/28 via 10.0.50.142 - - Network: eth1.2087 fdac:4aca:1cf6:90::130/64 - - * CWC Cluster - * mgmtvpn30.prv.cwc - - Hypervisor: xen17.prv.cwc/xen16.prv.cwc - - Specs: 2 vcpu; 4096 MB RAM; Pool-node1; - - Network: eth1.2086 n/a - - Network: eth1.2087 10.0.50.145/28 via 10.0.50.158 - - Network: eth1.2087 fdac:4aca:1cf6:91::145/64 - - * mgmtvpn31.prv.cwc - - Hypervisor: xen16.prv.cwc/xen17.prv.cwc - - Specs: 2 vcpu; 4096 MB RAM; Pool-node1; - - Network: eth1.2086 n/a - - Network: eth1.2087 10.0.50.146/28 via 10.0.50.158 - - Network: eth1.2087 fdac:4aca:1cf6:91::146/64 - diff --git a/notes/projects/strongswan/vpn-notes.md b/notes/projects/strongswan/vpn-notes.md deleted file mode 100644 index 387cd67..0000000 --- a/notes/projects/strongswan/vpn-notes.md +++ /dev/null @@ -1,235 +0,0 @@ -ISP VPN Servers -=============== - -Resources -========= - - * [How to Set Up an IKEv2 VPN Server with StrongSwan on Ubuntu 18.04](https://www.digitalocean.com/community/tutorials/how-to-set-up-an-ikev2-vpn-server-with-strongswan-on-ubuntu-18-04-2) - - -Oustanding Tasks/Issues -======================= - - [ ] Determine whether to allow multiple sessions - [x] Allocate 10.0.10.0/x for Strongswan VPN servers - [ ] Test with Let's Encrypt certificates - [ ] RADIUS integration - [ ] RADIUS configs for VPN - [ ] SQL IP Pool for VPN - [ ] Local LDAP cache - [ ] IPsec/L2TP Support - [-] Configurations - [x] Git sync firewall - [x] Git sync keepalived - [ ] Git sync strongswan - [ ] Git sync swanctl - [-] VPN Infrastructure - [x] CWC Servers - [x] Service IP Addresses - [x] Admin VPN Pool - [x] User VPN Pool - [x] Admin Public NAT - [x] User Public NAT - [ ] production configs - [ ] NWC Servers - [x] Service IP Addresses - [x] Admin VPN Pool - [x] User VPN Pool - [x] Admin Public NAT - [x] User Public NAT - [ ] production configs - [ ] Lab Servers - [ ] Service IP Addresses - [ ] Admin VPN Pool - [ ] User VPN Pool - [ ] Admin Public NAT - [ ] User Public NAT - [ ] production configs - [ ] SSH Bastion Infrastructure - [ ] CWC Servers - [ ] Move to private VPN subnet - [ ] Move to public VPN subnet - [ ] Add service addresses - [ ] NWC Servers - [ ] Move to private VPN subnet - [ ] Move to public VPN subnet - [ ] Add service addresses - [ ] Write documentation - [ ] MacOS Setup - [ ] Apple iOS Setup - [ ] Android Setup - [ ] Ubuntu Setup - [ ] CentOS Setup - [ ] Windows 10 Setup - [-] Test VPN on supported clients - [x] MacOS (built-in) - [x] Apple (built-in) - [x] Android (strongswan app) - [x] Ubuntu (Network Manager) - [ ] CentOS (Network Manager) - [ ] Windows 10 - - -Configurations -============== - - * [Firewall Rules](https://configs.prv.nwc.acsalaska.net/pub/configs/vpn/ipeng/firewall.git/about/) - * [Keepalived Configurations](https://configs.prv.nwc.acsalaska.net/pub/configs/vpn/ipeng/keepalived.git/about/) - * [Strongswan Configurations](https://configs.prv.nwc.acsalaska.net/pub/configs/vpn/ipeng/strongswan.git/about/) - * [Swanctl Configurations](https://configs.prv.nwc.acsalaska.net/pub/configs/vpn/ipeng/swanctl.git/about/) - - -Notes -===== - -Charon ------- - -Starting the daemon: - - ipsec start - swanctl --load-all - - -Stopping the daemin: - - ipsec stop - - -VPN Settings -============ - - * VPN Type: IKEv2 - * Server Address: vpn.cwc.acsalaska.net - * Remote ID: vpn.acsalaska.net - * Username: syzdek - * Password: XXXXXXXX - * Server Cert: http://certs.acsalaska.net/certs/akcom-ipeng-vpnCA.pem - - -Networking -========== - - * VLAN - - VPN Internal: ISP_VPN / 2080 - - VPN Public: ISP_VPN / 2081 - - * Networks - - 10.0.10.0/24 ISP VPN Admin Pools - - 10.0.10.0/26 Redback @home DSL - - 10.0.10.64/26 ISP Cisco VPN3000 Pool (vpn1) - - 10.0.10.128/26 ISP VPN/Strongswan Admin Pool (NWC) - - 10.0.10.192/26 ISP VPN/Strongswan Admin Pool (CWC) - - - 10.0.48.192/27 ISP VPN/Strongswan Test Pools - - - 10.0.49.192/27 ISP VPN/Strongswan Servers Private - - 10.0.49.192/28 ISP VPN/Strongswan Servers Private (NWC) - - 10.0.49.208/28 ISP VPN/Strongswan Servers Private (CWC) - - - 10.0.59.128/25 ISP VPN/Strongswan User Pools - - 10.0.59.128/26 ISP VPN/Strongswan User Pool (NWC) - - 10.0.59.192/26 ISP VPN/Strongswan User Pool (CWC) - - - 209.112.142.48/28 ISP VPN/Strongswan Servers Public - - 209.112.142.48/29 ISP VPN/Strongswan Servers Public (NWC) - - 209.112.142.56/29 ISP VPN/Strongswan Servers Public (CWC) - - - 209.112.156.200/30 ISP VPN/Strongswan Admin NAT - - 209.112.156.200/31 ISP VPN/Strongswan Admin NAT (NWC) - - 209.112.156.202/31 ISP VPN/Strongswan Admin NAT (CWC) - - -Hosts -===== - -Virtual Addresses ------------------ - - * Service addresses - - 209.112.142.10 - vpn.nwc.acsalaska.net - - 209.112.142.11 - vpn.cwc.acsalaska.net - - 209.112.142.12 - vpn.acsalaska.net - - 209.112.142.13 - vpntest.lab.acsalaska.net - - * User NAT IP Addresses - - 209.112.142.52 - usrnat1.vpnvrrp20.nwc.acsalaska.net. - - 209.112.142.53 - usrnat1.vpnvrrp20.nwc.acsalaska.net. - - 209.112.142.60 - usrnat1.vpnvrrp30.cwc.acsalaska.net. - - 209.112.142.61 - usrnat1.vpnvrrp30.cwc.acsalaska.net. - - * Admin NAT IP Addresses - - 209.112.156.200 - admnat1.vpnvrrp20.nwc.acsalaska.net - - 209.112.156.201 - admnat2.vpnvrrp20.nwc.acsalaska.net - - 209.112.156.202 - admnat1.vpnvrrp30.cwc.acsalaska.net - - 209.112.156.203 - admnat2.vpnvrrp30.cwc.acsalaska.net - - -Routers -------- - - * mx1.nwc - - xe-11/3/1.2080: 10.0.49.206/28 - - xe-11/3/1.2081: 209.112.142.54/29 - - * mx1.cwc - - xe-11/3/1.2080: 10.0.49.222/28 - - xe-11/3/1.2081: 209.112.142.62/29 - - -VRRP Groups ------------ - - * vpntestvrrp20.prv.lab - - Parent: vpntest20.prv.lab/vpntest21.prv.lab - - Network: VLAN 2080: 10.0.49.203/28 GW 10.0.49.206 - - * vpntestvrrp20.lab - - Parent: vpntest20.prv.lab/vpntest21.prv.lab - - Network: VLAN 2081: 209.112.142.51/29 GW 209.112.142.54 - - * vpnvrrp20.prv.nwc - - Parent: vpn20.prv.nwc/vpn21.prv.nwc - - Network: VLAN 2080: 10.0.49.205/28 GW 10.0.49.206 - - * vpnvrrp20.nwc - - Parent: vpn20.prv.nwc/vpn21.prv.nwc - - Network: VLAN 2081: 209.112.142.49/29 GW 209.112.142.54 - VLAN 2081: 209.112.142.52/29 - VLAN 2081: 209.112.142.53/29 - - * vpnvrrp30.prv.cwc - - Parent: vpn30.prv.cwc/vpn31.prv.cwc - - Network: VLAN 2080: 10.0.49.213/28 GW 10.0.49.222 - - * vpnvrrp30.cwc - - Parent: vpn30.prv.cwc/vpn31.prv.cwc - - Network: VLAN 2081: 209.112.142.58/29 GW 209.112.142.62 - VLAN 2081: 209.112.142.60/29 - VLAN 2081: 209.112.142.61/29 - - -Servers -------- - - * vpn20.prv.nwc - - Alias: vpn20.mwc.acsalaska.net - - Parent: xen62.prv.nwc/xen63.prv.nwc - - Network: VLAN 2080: 10.0.49.196/28 GW 10.0.49.206 - - * vpn21.prv.nwc - - Alias: vpn21.nwc.acsalaska.net - - Parent: xen63.prv.nwc/xen62.prv.nwc - - Network: VLAN 2080: 10.0.49.197/28 GW 10.0.49.206 - - * vpn30.prv.cwc - - Alias: vpn30.cwc.acsalaska.net - - Parent: xen18.prv.cwc/xen19.prv.cwc - - Network: VLAN 2080: 10.0.49.212/28 GW 10.0.49.222 - - * vpn31.prv.cwc - - Alias: vpn31.cwc.acsalaska.net - - Parent: xen19.prv.cwc/xen18.prv.cwc - - Network: VLAN 2080: 10.0.49.213/28 GW 10.0.49.222 - - diff --git a/notes/projects/vpn/lecvpn.md b/notes/projects/vpn/lecvpn.md new file mode 100644 index 0000000..18cbafe --- /dev/null +++ b/notes/projects/vpn/lecvpn.md @@ -0,0 +1,96 @@ + +LEC VPN Subnets +=============== + + * 172.25.242.64/26 - NWC LEC Mgmt VPN Subnet + - 172.25.242.64/29 - Servers + - 172.25.242.72/29 - User Pool + - 172.25.242.80/28 - Site to Site Pool + - 172.25.242.96/27 - Reserved + + * 172.25.243.64/26 - CWC LEC Mgmt VPN Subnet + - 172.25.243.64/29 - Servers + - 172.25.243.72/29 - User Pool + - 172.25.243.80/28 - Site to Site Pool + - 172.25.243.96/27 - Reserved + + * 2001:4948:0:2::d170:a012/127 - NWC P2P + * 2001:4948:0:2::d170:a010/127 - CWC P2P + * fdac:4aca:1cf6:188::/64 - NWC Servers (VRRP) + * fdac:4aca:1cf6:18a::/64 - CWC Servers (VRRP) + + +LEC VPN Service Addresses +=============== + + * lecvpndev.acsalaska.net (NWC) + - Address: 209.112.160.0 + - Address: 2001:4948:d:0::189 + + * lecvpn.acsalaska.net (CWC) + - Address: 209.112.160.1 + - Address: 2001:4948:d:0::187 + + * lecvpn.nwc.acsalaska.net. (NWC) + - Address: 209.112.160.6 + - Address: 2001:4948:d:0::188 + + * lecvpn.cwc.acsalaska.net. (CWC) + - Address: 209.112.160.7 + - Address: 2001:4948:d:0::18a + + +LEC VPN Servers +=============== + + * NWC Cluster + * lecvpn20.prv.nwc + - Hypervisor: xen62.prv.nwc/xen63.prv.nwc + - Specs: 2 vcpu; 4096 MB RAM; Pool-node2; + - Network: eth1.2088 + - Network: eth1.2089 172.25.242.65/29 via 172.25.242.70 + - Network: eth1.2089 fdac:4aca:1cf6:188::65/64 + + * lecvpn21.prv.nwc + - Hypervisor: xen63.prv.nwc/xen62.prv.nwc + - Specs: 2 vcpu; 4096 MB RAM; Pool-node2; + - Network: eth1.2088 + - Network: eth1.2089 172.25.242.66/29 via 172.25.242.70 + - Network: eth1.2089 fdac:4aca:1cf6:188::66/64 + + * lecvpnvrrp20.prv.nwc + - Network: eth1.2088 209.112.160.17/31 via 209.112.160.16 + - Network: eth1.2088 2001:4948:0:2::d170:a011/127 + - Network: eth1.2089 172.25.242.69/29 + - Network: eth1.2089 fdac:4aca:1cf6:188::69/64 + + * CWC Cluster + * lecvpn30.prv.cwc + - Hypervisor: xen16.prv.cwc/xen17.prv.cwc + - Specs: 2 vcpu; 4096 MB RAM; Pool-node1; + - Network: eth1.2088 + - Network: eth1.2089 172.25.243.65/29 via 172.25.243.70 + - Network: eth1.2089 fdac:4aca:1cf6:18a::65/64 + + * lecvpn31.prv.cwc + - Hypervisor: xen17.prv.cwc/xen16.prv.cwc + - Specs: 2 vcpu; 4096 MB RAM; Pool-node1; + - Network: eth1.2088 + - Network: eth1.2089 172.25.243.66/29 via 172.25.243.70 + - Network: eth1.2089 fdac:4aca:1cf6:18a::66/64 + + * lecvpnvrrp30.prv.cwc + - Network: eth1.2088 209.112.160.19/31 via 209.112.160.18 + - Network: eth1.2088 2001:4948:0:2::d170:a013/127 + - Network: eth1.2089 172.25.243.69/29 + - Network: eth1.2089 fdac:4aca:1cf6:18a::69/64 + + +Configuration URLs +================== + + * https://configs.prv.acsalaska.net/pub/configs/vpn/lec/firewall.git + * https://configs.prv.acsalaska.net/pub/configs/vpn/lec/keepalived.git + * https://configs.prv.acsalaska.net/pub/configs/vpn/strongswan.git + * https://configs.prv.acsalaska.net/pub/configs/vpn/swanctl.git + diff --git a/notes/projects/vpn/mgmtvpn.md b/notes/projects/vpn/mgmtvpn.md new file mode 100644 index 0000000..a7773b6 --- /dev/null +++ b/notes/projects/vpn/mgmtvpn.md @@ -0,0 +1,129 @@ +Equipment Management VPN Infrastructure +======================================= + +Networks and VLANs +------------------ + + * VLAN + - Public Subnet: MGMT_VPN / 2086 + - Private Subnet: MGMT_VPN / 2087 + + * Networks + - 10.0.50.128/27 Equipment Management VPN Servers + - 10.0.50.128/28 Equipment Management VPN Servers (NWC) + - 10.0.50.144/28 Equipment Management VPN Servers (CWC) + + - 209.112.160.56/29 Service Addresses + + - 209.112.160.64/28 Public Uplinks + - 209.112.160.64/29 Public Uplinks (NWC) + - 209.112.160.72/29 Public Uplinks (CWC) + + - 2001:4948:d::90/124 Service Addresses + + - 2001:4948:d:90::/63 Public Uplinks + - 2001:4948:d:90::/64 Public Uplinks (NWC) + - 2001:4948:d:91::/64 Public Uplinks (CWC) + + - fdac:4aca:1cf6:90::/63 VRRP Network + - fdac:4aca:1cf6:90::/64 VRRP Network (NWC) + - fdac:4aca:1cf6:91::/64 VRRP Network (CWC) + + +Service Addresses +----------------- + + * mgmtvpn1.nwc.acsalaska.net + - Address: 209.112.160.56 + - Address: 2001:4948:d::90/128 + + * mgmtvpn2.nwc.acsalaska.net + - Address: 209.112.160.57 + - Address: 2001:4948:d::91/128 + + * mgmtvpn1.cwc.acsalaska.net + - Address: 209.112.160.60 + - Address: 2001:4948:d::94/128 + + * mgmtvpn2.cwc.acsalaska.net + - Address: 209.112.160.61 + - Address: 2001:4948:d::95/128 + + +Routers +------- + + * mx1.nwc + - xe-11/3/1.2086: 209.112.160.70/29 + - xe-11/3/1.2086: 2001:4948:d:90::1/64 + - xe-11/3/1.2087: 10.0.50.142/28 + + * mx1.cwc + - xe-11/3/1.2086: 209.112.160.78/29 + - xe-11/3/1.2086: 2001:4948:d:91::1/64 + - xe-11/3/1.2087: 10.0.50.158/28 + + +VRRP Addresses +-------------- + + * NWC Cluster + * mgmtvpnvrrp20.prv.nwc + - Network: eth1.2086 209.112.160.65/29 via 209.112.160.70 + - Network: eth1.2086 2001:4948:d:90::65/64 via 2001:4948:d:90::1 + - Network: eth1.2087 10.0.50.141/28 + - Network: eth1.2087 fdac:4aca:1cf6:90::141/64 + + * mgmtvpnvrrp21.prv.nwc + - Network: eth1.2086 209.112.160.66/29 via 209.112.160.70 + - Network: eth1.2086 2001:4948:d:90::66/64 via 2001:4948:d:90::1 + - Network: eth1.2087 10.0.50.140/28 + - Network: eth1.2087 fdac:4aca:1cf6:90::140/64 + + * CWC Cluster + * mgmtvpnvrrp30.prv.cwc + - Network: eth1.2086 209.112.160.73/29 via 209.112.160.78 + - Network: eth1.2086 2001:4948:d:91::73/64 via 2001:4948:d:91::1 + - Network: eth1.2087 10.0.50.157/28 + - Network: eth1.2087 fdac:4aca:1cf6:91::157/64 + + * mgmtvpnvrrp31.prv.cwc + - Network: eth1.2086 209.112.160.74/29 via 209.112.160.78 + - Network: eth1.2086 2001:4948:d:91::74/64 via 2001:4948:d:91::1 + - Network: eth1.2087 10.0.50.156/28 + - Network: eth1.2087 fdac:4aca:1cf6:91::156/64 + + +Servers +------- + + * NWC Cluster + * mgmtvpn20.prv.nwc + - Hypervisor: xen62.prv.nwc/xen63.prv.nwc + - Specs: 2 vcpu; 4096 MB RAM; Pool-node1; + - Network: eth1.2086 n/a + - Network: eth1.2087 10.0.50.129/28 via 10.0.50.142 + - Network: eth1.2087 fdac:4aca:1cf6:90::129/64 + + * mgmtvpn21.prv.nwc + - Hypervisor: xen63.prv.nwc/xen62.prv.nwc + - Specs: 2 vcpu; 4096 MB RAM; Pool-node1; + - Network: eth1.2086 n/a + - Network: eth1.2087 10.0.50.130/28 via 10.0.50.142 + - Network: eth1.2087 fdac:4aca:1cf6:90::130/64 + + * CWC Cluster + * mgmtvpn30.prv.cwc + - Hypervisor: xen17.prv.cwc/xen16.prv.cwc + - Specs: 2 vcpu; 4096 MB RAM; Pool-node1; + - Network: eth1.2086 n/a + - Network: eth1.2087 10.0.50.145/28 via 10.0.50.158 + - Network: eth1.2087 fdac:4aca:1cf6:91::145/64 + + * mgmtvpn31.prv.cwc + - Hypervisor: xen16.prv.cwc/xen17.prv.cwc + - Specs: 2 vcpu; 4096 MB RAM; Pool-node1; + - Network: eth1.2086 n/a + - Network: eth1.2087 10.0.50.146/28 via 10.0.50.158 + - Network: eth1.2087 fdac:4aca:1cf6:91::146/64 + diff --git a/notes/projects/vpn/vpn-notes.md b/notes/projects/vpn/vpn-notes.md new file mode 100644 index 0000000..387cd67 --- /dev/null +++ b/notes/projects/vpn/vpn-notes.md @@ -0,0 +1,235 @@ +ISP VPN Servers +=============== + +Resources +========= + + * [How to Set Up an IKEv2 VPN Server with StrongSwan on Ubuntu 18.04](https://www.digitalocean.com/community/tutorials/how-to-set-up-an-ikev2-vpn-server-with-strongswan-on-ubuntu-18-04-2) + + +Oustanding Tasks/Issues +======================= + + [ ] Determine whether to allow multiple sessions + [x] Allocate 10.0.10.0/x for Strongswan VPN servers + [ ] Test with Let's Encrypt certificates + [ ] RADIUS integration + [ ] RADIUS configs for VPN + [ ] SQL IP Pool for VPN + [ ] Local LDAP cache + [ ] IPsec/L2TP Support + [-] Configurations + [x] Git sync firewall + [x] Git sync keepalived + [ ] Git sync strongswan + [ ] Git sync swanctl + [-] VPN Infrastructure + [x] CWC Servers + [x] Service IP Addresses + [x] Admin VPN Pool + [x] User VPN Pool + [x] Admin Public NAT + [x] User Public NAT + [ ] production configs + [ ] NWC Servers + [x] Service IP Addresses + [x] Admin VPN Pool + [x] User VPN Pool + [x] Admin Public NAT + [x] User Public NAT + [ ] production configs + [ ] Lab Servers + [ ] Service IP Addresses + [ ] Admin VPN Pool + [ ] User VPN Pool + [ ] Admin Public NAT + [ ] User Public NAT + [ ] production configs + [ ] SSH Bastion Infrastructure + [ ] CWC Servers + [ ] Move to private VPN subnet + [ ] Move to public VPN subnet + [ ] Add service addresses + [ ] NWC Servers + [ ] Move to private VPN subnet + [ ] Move to public VPN subnet + [ ] Add service addresses + [ ] Write documentation + [ ] MacOS Setup + [ ] Apple iOS Setup + [ ] Android Setup + [ ] Ubuntu Setup + [ ] CentOS Setup + [ ] Windows 10 Setup + [-] Test VPN on supported clients + [x] MacOS (built-in) + [x] Apple (built-in) + [x] Android (strongswan app) + [x] Ubuntu (Network Manager) + [ ] CentOS (Network Manager) + [ ] Windows 10 + + +Configurations +============== + + * [Firewall Rules](https://configs.prv.nwc.acsalaska.net/pub/configs/vpn/ipeng/firewall.git/about/) + * [Keepalived Configurations](https://configs.prv.nwc.acsalaska.net/pub/configs/vpn/ipeng/keepalived.git/about/) + * [Strongswan Configurations](https://configs.prv.nwc.acsalaska.net/pub/configs/vpn/ipeng/strongswan.git/about/) + * [Swanctl Configurations](https://configs.prv.nwc.acsalaska.net/pub/configs/vpn/ipeng/swanctl.git/about/) + + +Notes +===== + +Charon +------ + +Starting the daemon: + + ipsec start + swanctl --load-all + + +Stopping the daemin: + + ipsec stop + + +VPN Settings +============ + + * VPN Type: IKEv2 + * Server Address: vpn.cwc.acsalaska.net + * Remote ID: vpn.acsalaska.net + * Username: syzdek + * Password: XXXXXXXX + * Server Cert: http://certs.acsalaska.net/certs/akcom-ipeng-vpnCA.pem + + +Networking +========== + + * VLAN + - VPN Internal: ISP_VPN / 2080 + - VPN Public: ISP_VPN / 2081 + + * Networks + - 10.0.10.0/24 ISP VPN Admin Pools + - 10.0.10.0/26 Redback @home DSL + - 10.0.10.64/26 ISP Cisco VPN3000 Pool (vpn1) + - 10.0.10.128/26 ISP VPN/Strongswan Admin Pool (NWC) + - 10.0.10.192/26 ISP VPN/Strongswan Admin Pool (CWC) + + - 10.0.48.192/27 ISP VPN/Strongswan Test Pools + + - 10.0.49.192/27 ISP VPN/Strongswan Servers Private + - 10.0.49.192/28 ISP VPN/Strongswan Servers Private (NWC) + - 10.0.49.208/28 ISP VPN/Strongswan Servers Private (CWC) + + - 10.0.59.128/25 ISP VPN/Strongswan User Pools + - 10.0.59.128/26 ISP VPN/Strongswan User Pool (NWC) + - 10.0.59.192/26 ISP VPN/Strongswan User Pool (CWC) + + - 209.112.142.48/28 ISP VPN/Strongswan Servers Public + - 209.112.142.48/29 ISP VPN/Strongswan Servers Public (NWC) + - 209.112.142.56/29 ISP VPN/Strongswan Servers Public (CWC) + + - 209.112.156.200/30 ISP VPN/Strongswan Admin NAT + - 209.112.156.200/31 ISP VPN/Strongswan Admin NAT (NWC) + - 209.112.156.202/31 ISP VPN/Strongswan Admin NAT (CWC) + + +Hosts +===== + +Virtual Addresses +----------------- + + * Service addresses + - 209.112.142.10 - vpn.nwc.acsalaska.net + - 209.112.142.11 - vpn.cwc.acsalaska.net + - 209.112.142.12 - vpn.acsalaska.net + - 209.112.142.13 - vpntest.lab.acsalaska.net + + * User NAT IP Addresses + - 209.112.142.52 - usrnat1.vpnvrrp20.nwc.acsalaska.net. + - 209.112.142.53 - usrnat1.vpnvrrp20.nwc.acsalaska.net. + - 209.112.142.60 - usrnat1.vpnvrrp30.cwc.acsalaska.net. + - 209.112.142.61 - usrnat1.vpnvrrp30.cwc.acsalaska.net. + + * Admin NAT IP Addresses + - 209.112.156.200 - admnat1.vpnvrrp20.nwc.acsalaska.net + - 209.112.156.201 - admnat2.vpnvrrp20.nwc.acsalaska.net + - 209.112.156.202 - admnat1.vpnvrrp30.cwc.acsalaska.net + - 209.112.156.203 - admnat2.vpnvrrp30.cwc.acsalaska.net + + +Routers +------- + + * mx1.nwc + - xe-11/3/1.2080: 10.0.49.206/28 + - xe-11/3/1.2081: 209.112.142.54/29 + + * mx1.cwc + - xe-11/3/1.2080: 10.0.49.222/28 + - xe-11/3/1.2081: 209.112.142.62/29 + + +VRRP Groups +----------- + + * vpntestvrrp20.prv.lab + - Parent: vpntest20.prv.lab/vpntest21.prv.lab + - Network: VLAN 2080: 10.0.49.203/28 GW 10.0.49.206 + + * vpntestvrrp20.lab + - Parent: vpntest20.prv.lab/vpntest21.prv.lab + - Network: VLAN 2081: 209.112.142.51/29 GW 209.112.142.54 + + * vpnvrrp20.prv.nwc + - Parent: vpn20.prv.nwc/vpn21.prv.nwc + - Network: VLAN 2080: 10.0.49.205/28 GW 10.0.49.206 + + * vpnvrrp20.nwc + - Parent: vpn20.prv.nwc/vpn21.prv.nwc + - Network: VLAN 2081: 209.112.142.49/29 GW 209.112.142.54 + VLAN 2081: 209.112.142.52/29 + VLAN 2081: 209.112.142.53/29 + + * vpnvrrp30.prv.cwc + - Parent: vpn30.prv.cwc/vpn31.prv.cwc + - Network: VLAN 2080: 10.0.49.213/28 GW 10.0.49.222 + + * vpnvrrp30.cwc + - Parent: vpn30.prv.cwc/vpn31.prv.cwc + - Network: VLAN 2081: 209.112.142.58/29 GW 209.112.142.62 + VLAN 2081: 209.112.142.60/29 + VLAN 2081: 209.112.142.61/29 + + +Servers +------- + + * vpn20.prv.nwc + - Alias: vpn20.mwc.acsalaska.net + - Parent: xen62.prv.nwc/xen63.prv.nwc + - Network: VLAN 2080: 10.0.49.196/28 GW 10.0.49.206 + + * vpn21.prv.nwc + - Alias: vpn21.nwc.acsalaska.net + - Parent: xen63.prv.nwc/xen62.prv.nwc + - Network: VLAN 2080: 10.0.49.197/28 GW 10.0.49.206 + + * vpn30.prv.cwc + - Alias: vpn30.cwc.acsalaska.net + - Parent: xen18.prv.cwc/xen19.prv.cwc + - Network: VLAN 2080: 10.0.49.212/28 GW 10.0.49.222 + + * vpn31.prv.cwc + - Alias: vpn31.cwc.acsalaska.net + - Parent: xen19.prv.cwc/xen18.prv.cwc + - Network: VLAN 2080: 10.0.49.213/28 GW 10.0.49.222 + + -- cgit v1.2.3