cloudstack-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF subversion and git services (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (CLOUDSTACK-8730) Site-to-site VPN functionality does not work
Date Fri, 14 Aug 2015 11:07:47 GMT

    [ https://issues.apache.org/jira/browse/CLOUDSTACK-8730?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14696876#comment-14696876
] 

ASF subversion and git services commented on CLOUDSTACK-8730:
-------------------------------------------------------------

Commit 05a29f01b4de0e88e2f0fb99886573a25c87fea6 in cloudstack's branch refs/heads/master from
[~remibergsma]
[ https://git-wip-us.apache.org/repos/asf?p=cloudstack.git;h=05a29f0 ]

Merge pull request #693 from remibergsma/s2svpn-fixes

Fix site-to-site VPN featureThis is work done together with @jayapalu on fixing the site2site
VPN. The first part was done in PR #690 by @jayapalu. On top of that, some other fixes were
needed and those are added in this PR. It made sense to make a new PR which includes all fixes
so we can actually test it.

The original PR #690 is already merged into this one, so can be closed. Since the commit ids
are kept the same, merging this will close both.

I closely compared the 4.4/4.5 implementation with the new 4.6 one. I did not only make it
work, but also added some security improvements (some of which were also in 4.4/4.5). I noticed
the pre shared key was being logged, so removed that as well.

This is how I tested and verified it:
https://github.com/schubergphilis/MCT-shared/tree/master/helper_scripts/cloudstack/vpn_tests
When I have some time available, I'll write a Marvin test for it that we can include in the
repo.

It now works(tm) with one manual step due to CLOUDSTACK-8685:
We need a default gateway before site-to-site VPN will actually work. It will connect, but
not forward packets. The reason for this, is due to the iptables setup. VM1 has router1 as
gateway, but router1 does not know the route to VM2 so it will give up. With a default gateway,
the packets are about to be forwarded to the default gateway but when they reach eth1 the
public nic, iptables kicks in, does some magic and forwards it through the ipsec tunnel. So,
you need a default gw set to upstream.

Workaround for now is setting the route manually:
``route add default gw 1.2.3.4``  or  ``ip route add default via 1.2.3.4``

In other words, we need to fix CLOUDSTACK-8685 soon, too.

Thanks to @snuf @jayapalu!

@jayapalu @snuf could you please review this?

* pr/693:
  do not log sensitive site-to-site VPN PSK
  tighten security of site-to-site VPN
  CLOUDSTACK-8730: fix s2s iptables rules and ipsec config
  CLOUDSTACK-8710: Fixed applying iptables rules for s2s vpn

Signed-off-by: Remi Bergsma <github@remi.nl>


> Site-to-site VPN functionality does not work
> --------------------------------------------
>
>                 Key: CLOUDSTACK-8730
>                 URL: https://issues.apache.org/jira/browse/CLOUDSTACK-8730
>             Project: CloudStack
>          Issue Type: Bug
>      Security Level: Public(Anyone can view this level - this is the default.) 
>    Affects Versions: 4.6.0
>            Reporter: Remi Bergsma
>            Assignee: Remi Bergsma
>            Priority: Critical
>             Fix For: 4.6.0
>
>
> See CLOUDSTACK-8710, I tested the site-to-site VPN functionality but even with the iptables
rules applied (as per CLOUDSTACK-8710) it does not work. This is because some iptables rules
are missing, that were present in pre-4.6 version.
> The goal: have two VPCs, echt with a VM in a single tier, be able to talk to each other
over the VPN (ipsec tunnel).
> [~rajanik] I will be working on this and will make sure it gets in 4.6.0



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message