Certyfikaty są wydawane przez fikcyjne BogusCorp CA. Certyfikat CA
boguscorpCert.pem musi być obecny we wszystkich punktach końcowych VPN.
Generowanie certyfikatu CA
pki --gen --type ed25519 --outform pem > boguscorpKey.pe
pki --self --ca --lifetime 3652 --in boguscorpKey.pem \
--dn "C=CH, O=bogusCorp, CN=bogusCorp Root CA" \
--outform pem > boguscorpCert.pem
Generowanie CA dla punktu końcowego
pki --gen --type ed25519 --outform pem > MarySueKey.pem
pki --req --type priv --in MarySueKey.pem \
--dn "C=CH, O=boguscorp, CN=MarySue.bogus.corp" \
--san MarySue.bogus.corp --outform pem > MarySueReq.pem
pki --issue --cacert boguscorpCert.pem --cakey boguscorpKey.pem \
--type pkcs10 --in MarySueReq.pem --serial 01 --lifetime 1826 \
--outform pem > MarySueCert.pem
Konfiguracja połączenia
Host-to-Host
| 192.168.0.1 | <=> | 192.168.0.2 |
MarySue GaryStu
/etc/swanctl/x509ca/boguscorpCert.pem
/etc/swanctl/x509/MarySueCert.pem
/etc/swanctl/private/MarySueKey.pem
/etc/swanctl/swanctl.conf:
connections {
host-host {
remote_addrs = 192.168.0.2
local {
auth=pubkey
certs = MarySueCert.pem
}
remote {
auth = pubkey
id = "C=CH, O=bogusCorp, CN=GaryStu.bogus.corp"
}
children {
host-host {
start_action = trap
}
}
}
}
/etc/swanctl/x509ca/boguscorpCert.pem
/etc/swanctl/x509/GaryStuCert.pem
/etc/swanctl/private/GaryStuKey.pem
/etc/swanctl/swanctl.conf:
connections {
host-host {
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = GaryStuCert.pem
}
remote {
auth = pubkey
id = "C=CH, O=bogusCorp, CN=MarySue.bogus.corp"
}
children {
host-host {
start_action = trap
}
}
}
}
Site-to-Site
10.1.0.0/16 <-> | 192.168.0.1 | <=> | 192.168.0.2 | <-> 10.2.0.0/16
MarySue-Net MarySue GaryStu GaryStu-Net
/etc/swanctl/x509ca/boguscorpCert.pem
/etc/swanctl/x509/MarySueCert.pem
/etc/swanctl/private/MarySueKey.pem
/etc/swanctl/swanctl.conf:
connections {
net-net {
remote_addrs = 192.168.0.2
local {
auth = pubkey
certs = MarySueCert.pem
}
remote {
auth = pubkey
id = "C=CH, O=bogusCorp, CN=GaryStu.bogus.corp"
}
children {
net-net {
local_ts = 10.1.0.0/16
remote_ts = 10.2.0.0/16
start_action = trap
}
}
}
}
/etc/swanctl/x509ca/boguscorpCert.pem
/etc/swanctl/x509/GaryStuCert.pem
/etc/swanctl/private/GaryStuKey.pem
/etc/swanctl/swanctl.conf:
connections {
net-net {
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = GaryStuCert.pem
}
remote {
auth = pubkey
id = "C=CH, O=bogusCorp, CN=MarySue.bogus.corp"
}
children {
net-net {
local_ts = 10.2.0.0/16
remote_ts = 10.1.0.0/16
start_action = trap
}
}
}
}