From c4f39262af1aab66ba9595b699d6ad03a6c2922c Mon Sep 17 00:00:00 2001 From: Dan Guido Date: Sun, 15 May 2016 12:12:17 -0400 Subject: [PATCH] configure a user --- templates/ipsec.conf.j2 | 18 ++++++++++++++++++ templates/ipsec.secrets.j2 | 1 + vpn.yml | 14 ++++++++++++-- 3 files changed, 31 insertions(+), 2 deletions(-) create mode 100644 templates/ipsec.conf.j2 create mode 100644 templates/ipsec.secrets.j2 diff --git a/templates/ipsec.conf.j2 b/templates/ipsec.conf.j2 new file mode 100644 index 0000000..3eef6ce --- /dev/null +++ b/templates/ipsec.conf.j2 @@ -0,0 +1,18 @@ +config setup + uniqueids = never # allow multiple connections per user + +conn %default + keyexchange=ikev2 + ike=aes128gcm16-sha2_256-prfsha256-ecp256! + esp=aes128gcm16-sha2_256-ecp256! + compress=yes + fragmentation=yes + +conn psk + authby=psk + left=%any + leftsubnet=0.0.0.0/0 + right=%any + rightdns=8.8.8.8,8.8.4.4 + rightsourceip=10.0.0.0/24 + auto=add \ No newline at end of file diff --git a/templates/ipsec.secrets.j2 b/templates/ipsec.secrets.j2 new file mode 100644 index 0000000..9ecb639 --- /dev/null +++ b/templates/ipsec.secrets.j2 @@ -0,0 +1 @@ +dan : PSK "{{ ipsec_psk.stdout }}" diff --git a/vpn.yml b/vpn.yml index 97880f9..01a8746 100644 --- a/vpn.yml +++ b/vpn.yml @@ -14,5 +14,15 @@ - name: Do not accept ICMP redirects (prevent MITM attacks) sysctl: name=net.ipv4.conf.all.send_redirects value=0 - - name: Configure IPTables to route traffic appropriately - iptables: table=nat chain=POSTROUTING source=10.0.0.0/24 out_interface=eth0 jump=MASQUERADE \ No newline at end of file + - name: Needed so that IPSEC traffic can traverse the tunnel + iptables: table=nat chain=POSTROUTING source=10.0.0.0/24 out_interface=eth0 jump=MASQUERADE + + - name: Setup the ipsec.conf file from our template + template: src=ipsec.conf.j2 dest=/etc/ipsec.conf owner=root group=root mode=644 + + - name: Generate a random IPsec pre-shared key (16 bytes) + shell: openssl rand -base64 16 + register: ipsec_psk + + - name: Setup the ipsec.secrets file with users and passwords + template: src=ipsec.secrets.j2 dest=/etc/ipsec.secrets owner=root group=root mode=600 \ No newline at end of file