How to make the eth1 up and always available for remote access, where eth0 will be used for host to host IPSec VPN

openvpnrhelvpn

I am running Amazon EC2 instance with Red Hat Enterprise Linux, where I have two network interfaces.

Now:

  1. eth0 is currently active having public ip where I am remotely logged in via SSH, to configure VPN (once VPN is done, I won't be able to remotely access this IP and interface anymore)

  2. eth1 is showing down
    (using amazon I have assigned on it with another new public ip but can't ping it nor I can login on it using SSH)

  3. once I have eth1 up and remotely accessible, I have to configure VPN client on eth0 to connect to another remote server

How can I make the eth1 up so that I have remote access on eth1 and eth0 can be dedicated for the VPN IPSec host to host?

[ec2-user@ip-10-0-0-41 ~]$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 0e:29:01:a8:c6:98 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.41/24 brd 10.0.0.255 scope global eth0
    inet6 fe80::c29:1ff:fea8:c698/64 scope link 
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 0e:29:01:a9:6e:32 brd ff:ff:ff:ff:ff:ff

EDIT:

$ system-config-network-tui
eth1 is added as dhcp

$ ifup eth1
Determining IP information for eth1...

EDIT:

$ ssh amazonec2@eth0...public...ip  - fails
$ ssh amazonec2@eth1...public...ip  - allow to login
$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 0e:29:01:a8:c6:98 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.41/24 brd 10.0.0.255 scope global eth0
    inet6 fe80::c29:1ff:fea8:c698/64 scope link 
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 0e:29:01:a9:6e:32 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.110/24 brd 10.0.0.255 scope global eth1
    inet6 fe80::c29:1ff:fea9:6e32/64 scope link 
       valid_lft forever preferred_lft forever

EDIT:

$ yum install openswan
$ cat /etc/ipsec.conf
version 2.0 # conforms to second version of ipsec.conf specification
config setup
    protostack=netkey
    nat_traversal=yes
    virtual_private=
    oe=off
include /etc/ipsec.d/*.conf

$ cat /etc/ipsec.d/test.conf

### Administrator given this to setup
# Phase1: Encryption: AES128 Integrity: MD5 IKE Lifetime: 28800 sec.
# Phase2: Encryption: AES128 Integrity: MD5 IPsec lifetime: 3600 sec.

### Red hat we use Phase 1 and Phase 2 for IPSec 
conn test
    type=tunnel
    authby=secret
    pfs=no
    # Lifetime: 1440 sec
    ike=aes128-md5;modp1024!
    # Lifetime: 3600 sec
    phase2alg=aes128-md5;modp1024
    aggrmode=no    
    left=194.x.x.x
    right=54.x.x.x
    leftsubnet=10.109.0.0/24
    rightsubnet=10.0.0.0/24
    #auto=start

$ service ipsec restart && ipsec auto --add test
ipsec_setup: Stopping Openswan IPsec...
ipsec_setup: Starting Openswan IPsec U2.6.32/K2.6.32-358.6.2.el6.x86_64...
ipsec_setup: /usr/libexec/ipsec/addconn Non-fips mode set in /proc/sys/crypto/fips_enabled
/usr/libexec/ipsec/addconn Non-fips mode set in /proc/sys/crypto/fips_enabled

$ ipsec auto --up test
022 "test": We cannot identify ourselves with either end of this connection.
  • If add works without error then config file is correct the rest is other issues for tunnel.

Best Answer

it Works!

#!/bin/bash
# Version 1.0 - Stable
# --------------------------------------------
# Amazon EC2 instance + VPC + RHEL 6.4 64-bit
# eth0: 10.0.0.108  public ip: 8.8.8.8
# eth1: 10.0.0.27   public ip: 9.9.9.9
# 
# VPN Sever: 2.2.2.2
#

amazonEth0="10.0.0.8"
amazonWan0="8.8.8.8"
vpnServer="2.2.2.2"
hosttoHost=(10.109.0.20/32 10.109.0.21/32 10.109.58.6/32 10.109.59.3/32)
pingHost=(10.109.0.20 10.109.0.21 10.109.58.6 10.109.59.3)

# Step 0
yum -y install openswan

cat > /etc/ipsec.d/secret.secrets << EOF
# Step 1
$vpnServer 0.0.0.0 %any: PSK "123"
EOF

cat > /etc/ipsec.conf << \EOF
# Step 2
version 2.0 # conforms to second version of ipsec.conf specification
config setup
    plutodebug="all"
        plutostderrlog=/var/log/pluto.log
    protostack=netkey
    nat_traversal=no
    virtual_private=
    oe=off
include /etc/ipsec.d/*.conf
EOF

for i in 1 2 3 4
do
cat > /etc/ipsec.d/test$i.conf << EOF
#Step 3
conn test$i
    #auto=start
    type=tunnel
    authby=secret
    pfs=no
    aggrmode=no
    ikelifetime=28800s
    lifetime=3600s
    ike=aes128-md5;modp1024!
    phase2alg=aes128-md5;modp1024
    forceencaps=yes
    left=$amazonEth0
    leftid=$amazonWan0
    leftsourceip=$amazonWan0
    right=$vpnServer
    rightsubnet=${hosttoHost[$i-1]}
EOF
done

### Run me
cat > /tmp/vpn.sh << EOF
#!/bin/bash
service ipsec restart
ipsec auto --add test1
ipsec auto --add test2
ipsec auto --add test3
ipsec auto --add test4

ipsec auto --up test1
ipsec auto --up test2
ipsec auto --up test3
ipsec auto --up test4

ipsec auto --status
ip xfrm policy
ip route show
ping -c 1 ${pingHost[0]}; 
ping -c 1 ${pingHost[1]};
ping -c 1 ${pingHost[2]}; 
ping -c 1 ${pingHost[3]}; 

EOF
chmod +x /tmp/vpn.sh

# Finishing - touch
/tmp/vpn.sh
Related Question