<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"> <article id="IPIP"> <!--$Id$--> <articleinfo> <title>GRE and IPIP Tunnels</title> <authorgroup> <author> <firstname>Tom</firstname> <surname>Eastep</surname> </author> </authorgroup> <pubdate>2003-02-22</pubdate> <copyright> <year>2001</year> <year>2002</year> <year>2003</year> <holder>Thomas M. Eastep</holder> </copyright> <legalnotice> <para>Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of the license is included in the section entitled <quote><ulink url="GnuCopyright.htm">GNU Free Documentation License</ulink></quote>.</para> </legalnotice> </articleinfo> <warning> <para>GRE and IPIP Tunnels are insecure when used over the internet; use them at your own risk</para> </warning> <para>GRE and IPIP tunneling with Shorewall can be used to bridge two masqueraded networks.</para> <para>The simple scripts described in the <citetitle><ulink url="http://ds9a.nl/lartc">Linux Advanced Routing and Shaping HOWTO</ulink></citetitle> work fine with Shorewall. Shorewall also includes a tunnel script for automating tunnel configuration. If you have installed the RPM, the tunnel script may be found in the Shorewall documentation directory (usually /usr/share/doc/shorewall-<version>/).</para> <section> <title>Bridging two Masqueraded Networks</title> <para>Suppose that we have the following situation:</para> <graphic fileref="images/TwoNets1.png" /> <para>We want systems in the 192.168.1.0/24 subnetwork to be able to communicate with the systems in the 10.0.0.0/8 network. This is accomplished through use of the /etc/shorewall/tunnels file, the /etc/shorewall/policy file and the /etc/shorewall/tunnel script that is included with Shorewall.</para> <para>The <quote>tunnel</quote> script is not installed in /etc/shorewall by default -- If you install using the tarball, the script is included in the tarball; if you install using the RPM, the file is in your Shorewall documentation directory (normally /usr/share/doc/shorewall-<version>).</para> <para>In the /etc/shorewall/tunnel script, set the <quote>tunnel_type</quote> parameter to the type of tunnel that you want to create.</para> <example> <title>/etc/shorewall/tunnel</title> <programlisting>tunnel_type=gre</programlisting> </example> <para>On each firewall, you will need to declare a zone to represent the remote subnet. We'll assume that this zone is called <quote>vpn</quote> and declare it in /etc/shorewall/zones on both systems as follows.</para> <table> <title>/etc/shorewall/zones system A & B</title> <tgroup cols="3"> <thead> <row> <entry align="center">ZONE</entry> <entry align="center">DISPLAY</entry> <entry align="center">COMMENTS</entry> </row> </thead> <tbody> <row> <entry>vpn</entry> <entry>VPN</entry> <entry>Remote Subnet</entry> </row> </tbody> </tgroup> </table> <para>On system A, the 10.0.0.0/8 will comprise the <emphasis role="bold">vpn</emphasis> zone. In /etc/shorewall/interfaces:</para> <table> <title>/etc/shorewall/interfaces system A</title> <tgroup cols="4"> <thead> <row> <entry align="center">ZONE</entry> <entry align="center">INTERFACE</entry> <entry align="center">BROADCAST</entry> <entry align="center">OPTIONS</entry> </row> </thead> <tbody> <row> <entry>vpn</entry> <entry>tosysb</entry> <entry>10.255.255.255</entry> <entry></entry> </row> </tbody> </tgroup> </table> <para>In /etc/shorewall/tunnels on system A, we need the following:</para> <table> <title>/etc/shorewall/tunnels system A</title> <tgroup cols="4"> <thead> <row> <entry align="center">TYPE</entry> <entry align="center">ZONE</entry> <entry align="center">GATEWAY</entry> <entry align="center">GATEWAY ZONE</entry> </row> </thead> <tbody> <row> <entry>ipip</entry> <entry>net</entry> <entry>134.28.54.2</entry> <entry></entry> </row> </tbody> </tgroup> </table> <para>This entry in /etc/shorewall/tunnels, opens the firewall so that the IP encapsulation protocol (4) will be accepted to/from the remote gateway.</para> <para>In the tunnel script on system A:</para> <example> <title>tunnel script on system A</title> <programlisting>tunnel=tosysb myrealip=206.161.148.9 (for GRE tunnel only) myip=192.168.1.1 hisip=10.0.0.1 gateway=134.28.54.2 subnet=10.0.0.0/8 </programlisting> </example> <para>Similarly, On system B the 192.168.1.0/24 subnet will comprise the <emphasis role="bold">vpn</emphasis> zone. In /etc/shorewall/interfaces:</para> <table> <title>/etc/shorewall/interfaces system B</title> <tgroup cols="4"> <thead> <row> <entry align="center">ZONE</entry> <entry align="center">INTERFACE</entry> <entry align="center">BROADCAST</entry> <entry align="center">OPTIONS</entry> </row> </thead> <tbody> <row> <entry>vpn</entry> <entry>tosysa</entry> <entry>192.168.1.255</entry> <entry></entry> </row> </tbody> </tgroup> </table> <para>In /etc/shorewall/tunnels on system B, we have:</para> <table> <title>/etc/shorewall/tunnels system B</title> <tgroup cols="4"> <thead> <row> <entry align="center">TYPE</entry> <entry align="center">ZONE</entry> <entry align="center">GATEWAY</entry> <entry align="center">GATEWAY ZONE</entry> </row> </thead> <tbody> <row> <entry>ipip</entry> <entry>net</entry> <entry>206.191.148.9</entry> <entry></entry> </row> </tbody> </tgroup> </table> <para>And in the tunnel script on system B:</para> <example> <title>tunnel script on system B</title> <programlisting>tunnel=tosysa myrealip=134.28.54.2 (for GRE tunnel only) myip=10.0.0.1 hisip=192.168.1.1 gateway=206.191.148.9 subnet=192.168.1.0/24</programlisting> </example> <para>You can rename the modified tunnel scripts if you like; be sure that they are secured so that root can execute them.</para> <para>You will need to allow traffic between the <quote>vpn</quote> zone and the <quote>loc</quote> zone on both systems -- if you simply want to admit all traffic in both directions, you can use the policy file:</para> <table> <title>/etc/shorewall/policy system A & B</title> <tgroup cols="4"> <thead> <row> <entry align="center">SOURCE</entry> <entry align="center">DEST</entry> <entry align="center">POLICY</entry> <entry align="center">LOG LEVEL</entry> </row> </thead> <tbody> <row> <entry>loc</entry> <entry>vpn</entry> <entry>ACCEPT</entry> <entry></entry> </row> <row> <entry>vpn</entry> <entry>loc</entry> <entry>ACCEPT</entry> <entry></entry> </row> </tbody> </tgroup> </table> <para>On both systems, restart Shorewall and run the modified tunnel script with the <quote>start</quote> argument on each system. The systems in the two masqueraded subnetworks can now talk to each other</para> </section> </article>