On-Premises Site 2 Site VPN with Azure using Tomato Shibby Mod (Entware-ng and Strongswan setup) – part 3

This article is part of a series of 4 where I am talking about how to setup site-2-site VPN between on-premises and Azure using Tomato Shibby Mod, Entware-ng and Strongswan. For a better understanding please make sure you read also the other parts:

  1. Install and configure Entware-ng + strongSwan on your router.
  2. Configure and perform the site-2-site VPN using Azure dynamic gateway.
  3. Configure and perform the site-2-site VPN using Azure static gateway.
  4. Troubleshooting Azure site-2-site VPN and strongSwan.

 

Please note these steps are not required in case you already configured a Dynamic Routing Azure VPN gateway.

Configure and perform the site-2-site VPN using Azure static gateway

 

In the Azure Portal, carefully select Static Routing when the VPN gateway creation is initiated.

On-Premises_Site_2_Site_VPN_with_Azure_using_Tomato_Shibby_Mod_Entware-ng_and_Strongswan_27

On-Premises_Site_2_Site_VPN_with_Azure_using_Tomato_Shibby_Mod_Entware-ng_and_Strongswan_28

 

 

In this example:

  • 188.194.135.45 represents the on-premises gateway IP address (the router configured with Entware-ng + strongSwan)
  • 192.168.2.0/24 represents the on-premises network subnet
  • 40.68.213.251 represents the Azure VPN gateway IP address
  • 192.168.64.0/18 represents the Azure network subnet
  • “JHTg6u5euztuFMJ3tvKyB2OKWrztHWzd” represents the pre-shared key

 

 

Connect to your router and make the following adjustments to your ipsec.conf and ipsec.secrets files.
nano /opt/etc/ipsec.conf

# ipsec.conf - strongSwan IPsec configuration file

# basic configuration

config setup
        # strictcrlpolicy=yes
        # uniqueids = no

# Add connections here.

conn AZURE
        authby=secret
        right=40.68.213.251 #Azure VPN gateway IP address
        rightsubnet=192.168.64.0/18 #Azure network subnet defined in cloud
        leftfirewall=no
        left=188.194.135.45 #IP address of your on-premises gateway
        leftsubnet=192.168.2.0/24 #network subnet located on-premises
        type=tunnel
        keyexchange=ikev1
        ikelifetime=28800s
        keylife=3600s
        lifebytes=102400000
        esp=aes256-sha1
        ike=aes256-sha1-modp1024
        rekey=yes
        keyingtries=1
        mobike=no
        dpdaction=none
        auto=start
        rekeymargin=3m

On-Premises_Site_2_Site_VPN_with_Azure_using_Tomato_Shibby_Mod_Entware-ng_and_Strongswan_29

 

 

nano /opt/etc/ipsec.secrets

# /etc/ipsec.secrets - strongSwan IPsec secrets file
188.194.135.45 40.68.213.251 : PSK "JHTg6u5euztuFMJ3tvKyB2OKWrztHWzd"

On-Premises_Site_2_Site_VPN_with_Azure_using_Tomato_Shibby_Mod_Entware-ng_and_Strongswan_30

Please note any additional empty new line or invalid characters added to these two configuration files can lead to unsuccessful VPN site-2-site.

 

 

Execute the following two commands to ensure the new settings are propagated.

ipsec stop
ipsec start

On-Premises_Site_2_Site_VPN_with_Azure_using_Tomato_Shibby_Mod_Entware-ng_and_Strongswan_21

 

 

Use the “status” parameter to see if the VPN connection has been established.

ipsec status

On-Premises_Site_2_Site_VPN_with_Azure_using_Tomato_Shibby_Mod_Entware-ng_and_Strongswan_31

 

 

After couple of minutes the connected status will be reflected also in the Azure Portal.

On-Premises_Site_2_Site_VPN_with_Azure_using_Tomato_Shibby_Mod_Entware-ng_and_Strongswan_32

 

 

By default your router will allow all outbound traffic with your defined Azure networks, but will block all the traffic initiated to your on-premises subnet. That’s why is necessary to open additional traffic between the two internal networks (on-premises and Azure).

Append the following commands in the Firewall script section. Please keep in mind is necessary to call/execute these commands also in the SSH session in case is necessary to make the changes immediately.

iptables -I FORWARD -s 192.168.64.0/18 -d 192.168.2.0/24 -j ACCEPT
iptables -I INPUT -p icmp -s 192.168.64.0/18 -d 192.168.2.1/32 -j ACCEPT

On-Premises_Site_2_Site_VPN_with_Azure_using_Tomato_Shibby_Mod_Entware-ng_and_Strongswan_24

 

 

Let’s test the site-2-site connectivity.

From on-premises to Azure.

On-Premises_Site_2_Site_VPN_with_Azure_using_Tomato_Shibby_Mod_Entware-ng_and_Strongswan_25

 

From Azure to on-premises.

On-Premises_Site_2_Site_VPN_with_Azure_using_Tomato_Shibby_Mod_Entware-ng_and_Strongswan_26

 

 

Continue with On-Premises Site 2 Site VPN with Azure using Tomato Shibby Mod (Entware-ng and Strongswan setup) – part 4.

 

Leave a Reply