With IPv6 there is no more NAT. All your machines have end-to-end connections to their destination. It’s taken for granted the implied security that NAT provides, by preventing incoming connections. There’s also no longer a need to use a VPN, if I want to connect to my work PC I merely use it’s publicly available IPv6 address.
So what we need is a good (default deny) firewall policy to start with, but then we have the problem of encryption without using a VPN. This is where IPSec comes in, providing end-to-end encryption at the packet level. That way we can then happily use normally unencrypted protocols securely. We can also harden already encrypted protocols (SSH, RDP).
First thing we need to do is install “racoon” and “ipsec-tools” on both machines we wish to securely communicate between, in my case my Lubuntu 11.10 laptop and a Ubuntu 11.04 Server VPS. These two machines have the following IPv6 addresses (anonymized):
Laptop 2604:xxxx:xxx::500 VPS 2607:xxxx:xxx::f49
To install the relevant packages on Debian based systems:
#sudo apt-get install ipsec-tools racoon
Then I need to edit “/etc/ipsec-tools.conf” to tell each machine I expect IPSec to be used to/from a certain IPv6 address, on my laptop it looks like this:
#!/usr/sbin/setkey -f flush; spdflush; spdadd ::0/0 2607:xxxx:xxx::f49 any -P out ipsec esp/transport//require ah/transport//require; spdadd 2607:xxxx:xxx::f49 ::0/0 any -P in ipsec esp/transport//require ah/transport//require;
So any IP on my laptop (::0/0) to my VPS outgoing, then my VPS to any IP on my laptop (::0/0) incoming. Then same on the VPS but switching the IP:
#!/usr/sbin/setkey -f flush; spdflush; spdadd ::0/0 2604:xxxx:xxx::500 any -P out ipsec esp/transport//require ah/transport//require; spdadd 2604:xxxx:xxx::500 ::0/0 any -P in ipsec esp/transport//require ah/transport//require;
Then we need to configure the level of encryption and key exchange we use on both machines. These settings must match exactly or key exchange and encryption will fail. These settings are defined in “/etc/racoon/racoon.conf”. The man pages have information on the algorithms you can use, in my case I’ve gone for “uber paranoid” settings like this:
# Author: Mike Lovell
# Modified: 2011-08-16
path pre_shared_key "/home/mikelovell/.ipsec/config/keys.txt";
remote anonymous
{
exchange_mode main;
lifetime time 12 hour;
proposal
{
encryption_algorithm aes;
hash_algorithm sha512;
authentication_method pre_shared_key;
dh_group modp4096;
}
}
sainfo anonymous
{
pfs_group modp4096;
lifetime time 12 hour;
encryption_algorithm rijndael, aes;
authentication_algorithm hmac_sha512;
compression_algorithm deflate;
}
I store my IPSec keys inside “/home”, which is encrypted (mounted on boot) on my machines – You’re probably best keeping your keys in “/etc/racoon/keys.txt”. In here you need to put the destination IP along with a password to use to communicate – To generate the password I always use “apg -a 1 -m 128″, here’s what the file might look like on the laptop:
2607:xxxx:xxx::f49 not_a_good_password!
And on the VPS:
2604:xxxx:xxx::500 not_a_good_password!
All that’s left to do now is restart the IPSec service and racoon, make sure you have another way into your machine (not via IPv6) before you do this – If something doesn’t work you don’t want to be locked out!
#sudo /etc/init.d/setkey restart #sudo /etc/init.d/racoon restart
Once you’ve done that on both machines as soon as you establish a new connection (anything, try a ping6) you should see IPSec successfully negotiate in your syslog:
initiate new phase 1 negotiation: 2604:xxxx:xxx::500[500]<=>2607:xxxx:xxx::f49[500] begin Identity Protection mode. received Vendor ID: DPD ISAKMP-SA established 2604:xxxx:xxx::500[500]-2607:xxxx:xxx::f49[500] spi:d____________f initiate new phase 2 negotiation: 2604:xxxx:xxx::500[500]<=>2607:xxxx:xxx::f49[500] IPsec-SA established: AH/Transport 2604:xxxx:xxx::500[500]->2607:xxxx:xxx::f49[500] spi=11___2(0x6____) IPsec-SA established: ESP/Transport 2604:xxxx:xxx::500[500]->2607:xxxx:xxx::f49[500] spi=1___1(0xc____) IPsec-SA established: AH/Transport 2604:xxxx:xxx::500[500]->2607:xxxx:xxx::f49[500] spi=1___5(0xb____) IPsec-SA established: ESP/Transport 2604:xxxx:xxx::500[500]->2607:xxxx:xxx::f49[500] spi=96___3(0x5____)
Viola! You care confirm if you like by sniffing the network traffic via “wireshark”.
