Things I'd do if I ever have time

Wish list

Please help a man further his career by donating expensive hardware. Cash works too.

OpenBSD IPsec Site-to-Site Quickstart Guide

Published: 09/05/2009

So the CEO is asking you to do "more with less." The budget is slashed, the staff over-worked. Your only solution is free crypto ... because offerings from Cisco, Juniper, Check Point, and the other big boys aren't cheap.

The following instructions are based on (the free) OpenBSD 4.5 release and designed to get you up and running as quickly as possible by copying and pasting everything. All admins are lazy, or at least they should be.

This article assumes a basic company network scenario with two offices which need to be connected by a site-to-site IPsec tunnel across the Internet. Each gateway has two interfaces. The internal is referred to as "dc0" and external as "dc1." For the sake of simplicity, "Office 1" has an addressing scheme based on "1" and "Office 2" is based on "2" (shown in the diagram below).

These VPN gateways are not assumed here to be the main front-facing firewall (default gateway) which LAN clients use to get out to the Internet. Instead, they are dedicated soley for site-to-site traffic relaying and encryption.

While the gateways do not require two interfaces, if they are connected directly to the Internet, then enabling the firewall (pf) is highly recommended for obvious reasons.

Anything in red from this point forward should be replaced by values reflecting your own networks.

Office 1 Gateway Configuration

   More Information

Office 2 Gateway Configuration

   More Information

A Few Final Steps...

   More Information

Congratulations, your 15 minutes are up.

Installing OpenBSD from CD media should take less than 10 minutes. Configuring it to do IPsec tunneling should take another 5. If your copying / pasting skills are strong, then you should already be exchanging RIAA-approved MP3 files with your impatient co-workers at the other office. Tell the boss you'll need to spend the rest of the day fine-tuning the firewall rules, then go to your private fridge and break out a cold one.

Go back to the main articles list.