Versione 7 del 2013-03-19 22:30:38

Nascondi questo messaggio
Italiano English
Modifica History Actions

IsoleVPN

Disclaimer

This VPN is mainly used to connect network islands when it is very difficult to build a wired/wireless link ( for example two community networks in very distant city ). It is not intended to connect single persons that wants access internal services via VPN. It is recommended to avoid data traffic over the VPN because it will slow down troubleshooting operation that is one of main use of the VPN itself.

Connect to the VPN between islands with Tinc

1) Install tinc on your Linux Distro ( Debian based: apt-get install tinc, Gentoo based: emerge tinc ) MAKE SURE YOU HAVE AT LEAST TINC 1.0.13

2) Create config dir

mkdir /etc/tinc/isole

3) Create config file

/etc/tinc/isole/tinc.conf

Name = yournickname
ConnectTo = coppermine
ConnectTo = zefiro
ConnectTo = RomaVpnIsole
ConnectTo = BitArno
Mode = switch

Mode switch is required because tinc will operate with a tap interface, needed to run babeld on it.

4) Create the authorized hosts folder

mkdir /etc/tinc/isole/hosts/

5) Generate a Keypair

tincd -n isole -K

6) Add only keys you trust ( at least the ones you specified as ConnectTo ) as authorized hosts files from ChiaviTincVPNIsole (each file you add should appear like this):

/etc/tinc/isole/hosts/HostNickName

Address = Host_Address_If_Available

-----BEGIN RSA PUBLIC KEY-----                                                                                                                                                     
MIIBCgKCAQEAz3Tmd+1gK0rhLuNw2x3ueT7Fel0+PuBg6EU1bWIhIH5VM9WzCOC7                                                                                                                   
sWPVZn0Dgk+y2NdKokUEUF2J3BdNS/wPzCCu2shGGM/DvsLoZ/aV1+2R0F3/gInK                                                                                                                   
TXKAJun1ffoORTQTqhfop1Bfn8BZjKF4efagDCNdQanl8vVMRIqrFb3anXzbUI2O
QVL1lIBom8KgsviE6VywVrF5thYzotqWVKH1K2hwgpZXGVsmimIiFr9hz3pBsOfZ
dL2mmLuZXKx1JujdLq2zVYf1peh7ctcqXuXQfJRJIFGhvPndO9dluQUxtZz8StdY
sVhQcmiyCnmvKNcbyIHQXCA+5zZYNNmu9wIDAQAB
-----END RSA PUBLIC KEY-----

This file has the address ( if available ) and the public key of the VPN node

7) Look for a free IP address in the subnet 10.0.1.0/24 and add your self in the table on the GestioneIndirizzi wiki page.

8) Create the file

/etc/tinc/ninux/tinc-up

# If your distro supports flexible init networking scripts like Gentoo, you can do it in more elegant way

ip link set dev $INTERFACE up
ip a a dev $INTERFACE HEREYOURIPADDRESS/24
#Adjust MTU
ip link set mtu 1350 dev $INTERFACE
iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

Where in place of HEREYOURIPADDRESS you must put the IP address choosen at point 7 of this guide

Make the file executable

chmod +x /etc/tinc/ninux/tinc-up

9) Send an email to contatti@ninux.org and info@eigenlab.org with your Nickname chosen at point 3 and your generated public key ( also append your Nickname and public key at ChiaviTincVPNIsole ) so people can authorize you in their VPN nodes.

10) Once you received notification that your public key is authorized you can try to connect

tincd -n isole

If everything worked out you can ping 10.0.1.1. Now configure babeld to use the interface "isole"

It is FUNDAMENTAL to use latest http://www.pps.univ-paris-diderot.fr/~jch/software/babel/ babeld version

11) Configure babeld ( depending on your distro default babeld config file path can be different we will refer to Debian in the example )

edit

/etc/babeld.conf

After editing it should look like this but may vary depending on your setup

## Add interface isole as wired with a fixed cost of 300
interface isole wired true rxcost 300

## Refuse every ipv4 route with a prefix lenght less or equal to 14
in le 14 ip 0.0.0.0/0 deny

## Refuse 131.114.0.0/16 route
in ip 131.114.0.0/16 deny

## Refuse route with a prefix lenght great or equal 24 matching with 192.168.2.0/24
in ge 24 ip 192.168.2.0/24 deny

## Allow announcing route 10.0.1.0/24
redistribute ip 10.0.1.0/24 allow

## Allow here the sharing of route you want share
## for example
# redistribute ip 10.0.0.0/8 allow

## Deny announcing all other local route 
redistribute local deny