{"id":4403,"date":"2019-01-06T03:07:12","date_gmt":"2019-01-05T23:07:12","guid":{"rendered":"https:\/\/rakhesh.com\/?p=4403"},"modified":"2019-01-06T03:08:17","modified_gmt":"2019-01-05T23:08:17","slug":"setting-up-ipsec-tunnel-from-opnsense-at-home-to-azure","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/linux-bsd\/setting-up-ipsec-tunnel-from-opnsense-at-home-to-azure\/","title":{"rendered":"Setting up IPsec tunnel from OPNsense at home to Azure"},"content":{"rendered":"

This is mainly based on this<\/a> and this<\/a> blog posts with additional inputs from my router FAQ<\/a> for my router specific stuff.\u00a0<\/p>\n

I have a virtual network in Azure with a virtual network gateway. I want a Site to Site VPN from my home to Azure so that my home VMs can talk to my Azure VMs. I don\u2019t want to do Point to Site as I have previously done as I want all my VMs to be able to talk to Azure instead of setting up a P2S from each of them.\u00a0<\/p>\n

My home setup consists of VMware Fusion running a bunch of VMs, one of which is OPNSense. This is my home gateway – it provides routing between my various VM subnets (I have a few) and acts as DNS resolver for the internal VMs etc. OPNSense has one interface that is bridged to my MacBook so it is not NAT\u2019d behind the MacBook, it has an IP on the same network as the MacBook. I decided to do this as to is easier to port forward from my router to OPNSense.\u00a0<\/p>\n

OPNSense has an internal address of 192.168.1.23. On my router I port forward<\/a> UDP ports 500 & 4500 to this. I also have IPSec Passthrough enabled on the router (that\u2019s not mentioned in the previous link but I came across it elsewhere).\u00a0<\/p>\n

My home VMs are in the 10.0.0.0\/8 address space (in which there are various subnets that OPNSense is aware of). My Azure address space is 172.16.0.0\/16.<\/p>\n

First I created a virtual network gateway in Azure. It\u2019s of the \u201cVpnGw1\u201d SKU. I enabled BGP and set the ASN to 65515 (which is the default). This gateway is in the gateway subnet and has an IP of 172.16.254.254. (I am not using BGP actually, but I set this so I can start using it in future. One of the articles I link to has more instructions).\u00a0<\/p>\n

Next I created a local network gateway with the public IP of my home router and an address space of 10.0.0.0\/8 (that of my VMs). Here too I enabled BGP settings and assigned an ASN of 65501 and set the peer address to be the internal address of my OPNSense router – 192.168.1.23.\u00a0<\/p>\n

Next I went to the virtual network gateway section and in the connections section I created a new site to site (IPsec) connection. Here I have to select the local network gateway I created above, and also create a pre shared key (make up a random passphrase – you need this later).\u00a0<\/p>\n

That\u2019s all on the Azure end. Then I went to OPNSense and under VPN > IPsec > Tunnel Settings I created a new phase 1 entry.\u00a0<\/p>\n

\"NewImage\"<\/p>\n

I think most of it is default. I changed the Key Exchange to \u201cauto\u201d from v2. For \u201cRemote gateway\u201d I filled in my Azure virtual network gateway public IP. Not shown in this screenshot is the pre shared key that I put in Azure earlier. I filled the rest of it thus –\u00a0<\/p>\n

\"NewImage\"<\/p>\n

Of particular note is the algorithms. From the OPNSense logs I noticed that these are the combinations Azure supports –\u00a0<\/p>\n

IKE:AES_CBC_256\/HMAC_SHA1_96\/PRF_HMAC_SHA1\/MODP_1024, IKE:AES_CBC_256\/HMAC_SHA2_256_128\/PRF_HMAC_SHA2_256\/MODP_1024<\/strong>, IKE:AES_CBC_128\/HMAC_SHA1_96\/PRF_HMAC_SHA1\/MODP_1024, IKE:AES_CBC_128\/HMAC_SHA2_256_128\/PRF_HMAC_SHA2_256\/MODP_1024, IKE:3DES_CBC\/HMAC_SHA1_96\/PRF_HMAC_SHA1\/MODP_1024, IKE:3DES_CBC\/HMAC_SHA2_256_128\/PRF_HMAC_SHA2_256\/MODP_1024<\/p>\n

I didn\u2019t know this and so initially I had selected a DH key group size of 2048 and my connections were failing. From the logs I came across the above and changed it to 1024 (the 2048 is still present but it won\u2019t get used as 1024 will be negotiated; I should remove 2048 really, forgot to do it before taking this screenshot and it doesn\u2019t matter anyways). Then highlighted entry is the combination I chose to go with.\u00a0<\/p>\n

After this I created a phase 2 entry. This is where I define my local and remote subnets as seen below:<\/p>\n

\"NewImage\"<\/p>\n

I left everything else at their defaults.\u00a0<\/p>\n

\"NewImage\"<\/p>\n

And that\u2019s it. After that things connected and I could see a status of connected on the Azure side as well as on my OPNSense side under VPN > IPsec > Status Overview (expand the \u201cI\u201d in the Status column for more info). Logs can be seen under VPN > IPsec > Log File in case things don\u2019t work out as expected.\u00a0<\/p>\n

I don\u2019t have any VMs in Azure but as a quick test I was able to ping my Azure gateway on its internal IP address (172.16.254.254) from my local VMs.\u00a0<\/p>\n

Of course a gotcha with this configuration is that when my home public IP changes (as it is a dynamic public IP) this will break. It\u2019s not a big deal for me as I can login to Azure and enter the new public IP in the local network gateway, but I did find this blog post giving a way of automating this<\/a>.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

This is mainly based on this and this blog posts with additional inputs from my router FAQ for my router specific stuff.\u00a0 I have a virtual network in Azure with a virtual network gateway. I want a Site to Site VPN from my home to Azure so that my home VMs can talk to my … Continue reading Setting up IPsec tunnel from OPNsense at home to Azure<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[333,76,196],"tags":[383,849,859],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/4403"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=4403"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/4403\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=4403"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=4403"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=4403"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}