Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am running Amazon EC2 instance with Red hat enterprise linux, where I have two network interface.

Now:

  1. eth0 is currently active having public ip where I am remotely logged in via SSH, to configure VPN (once VPN is done, I wont be able to remotely access this IP and interface anymore)

  2. eth1 is showing down (using amazon I have assigned on it with another new public ip but cant ping it nor I can login on it using SSH)

  3. once I have eth1 up and remotely accessable, I have to configure VPN client on eth0 to connect to another remote server

How can I make the eth1 up so that I have remote access on eth1 and eth0 can be dedicated for the VPN IPSec host to host?

[ec2-user@ip-10-0-0-41 ~]$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 0e:29:01:a8:c6:98 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.41/24 brd 10.0.0.255 scope global eth0
    inet6 fe80::c29:1ff:fea8:c698/64 scope link 
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 0e:29:01:a9:6e:32 brd ff:ff:ff:ff:ff:ff

EDIT:

$ system-config-network-tui
eth1 is added as dhcp

$ ifup eth1
Determining IP information for eth1...

EDIT:

$ ssh amazonec2@eth0...public...ip  - fails
$ ssh amazonec2@eth1...public...ip  - allow to login
$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 0e:29:01:a8:c6:98 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.41/24 brd 10.0.0.255 scope global eth0
    inet6 fe80::c29:1ff:fea8:c698/64 scope link 
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 0e:29:01:a9:6e:32 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.110/24 brd 10.0.0.255 scope global eth1
    inet6 fe80::c29:1ff:fea9:6e32/64 scope link 
       valid_lft forever preferred_lft forever

EDIT:

$ yum install openswan
$ cat /etc/ipsec.conf
version 2.0 # conforms to second version of ipsec.conf specification
config setup
    protostack=netkey
    nat_traversal=yes
    virtual_private=
    oe=off
include /etc/ipsec.d/*.conf

$ cat /etc/ipsec.d/test.conf

### Administrator given this to setup
# Phase1: Encryption: AES128 Integrity: MD5 IKE Lifetime: 28800 sec.
# Phase2: Encryption: AES128 Integrity: MD5 IPsec lifetime: 3600 sec.

### Red hat we use Phase 1 and Phase 2 for IPSec 
conn test
    type=tunnel
    authby=secret
    pfs=no
    # Lifetime: 1440 sec
    ike=aes128-md5;modp1024!
    # Lifetime: 3600 sec
    phase2alg=aes128-md5;modp1024
    aggrmode=no    
    left=194.x.x.x
    right=54.x.x.x
    leftsubnet=10.109.0.0/24
    rightsubnet=10.0.0.0/24
    #auto=start

$ service ipsec restart && ipsec auto --add test
ipsec_setup: Stopping Openswan IPsec...
ipsec_setup: Starting Openswan IPsec U2.6.32/K2.6.32-358.6.2.el6.x86_64...
ipsec_setup: /usr/libexec/ipsec/addconn Non-fips mode set in /proc/sys/crypto/fips_enabled
/usr/libexec/ipsec/addconn Non-fips mode set in /proc/sys/crypto/fips_enabled

$ ipsec auto --up test
022 "test": We cannot identify ourselves with either end of this connection.
  • If add works without error then config file is correct the rest is other issues for tunnel.
share|improve this question
add comment

1 Answer

it Works!

#!/bin/bash
# Version 1.0 - Stable
# --------------------------------------------
# Amazon EC2 instance + VPC + RHEL 6.4 64-bit
# eth0: 10.0.0.108  public ip: 8.8.8.8
# eth1: 10.0.0.27   public ip: 9.9.9.9
# 
# VPN Sever: 2.2.2.2
#

amazonEth0="10.0.0.8"
amazonWan0="8.8.8.8"
vpnServer="2.2.2.2"
hosttoHost=(10.109.0.20/32 10.109.0.21/32 10.109.58.6/32 10.109.59.3/32)
pingHost=(10.109.0.20 10.109.0.21 10.109.58.6 10.109.59.3)

# Step 0
yum -y install openswan

cat > /etc/ipsec.d/secret.secrets << EOF
# Step 1
$vpnServer 0.0.0.0 %any: PSK "123"
EOF

cat > /etc/ipsec.conf << \EOF
# Step 2
version 2.0 # conforms to second version of ipsec.conf specification
config setup
    plutodebug="all"
        plutostderrlog=/var/log/pluto.log
    protostack=netkey
    nat_traversal=no
    virtual_private=
    oe=off
include /etc/ipsec.d/*.conf
EOF

for i in 1 2 3 4
do
cat > /etc/ipsec.d/test$i.conf << EOF
#Step 3
conn test$i
    #auto=start
    type=tunnel
    authby=secret
    pfs=no
    aggrmode=no
    ikelifetime=28800s
    lifetime=3600s
    ike=aes128-md5;modp1024!
    phase2alg=aes128-md5;modp1024
    forceencaps=yes
    left=$amazonEth0
    leftid=$amazonWan0
    leftsourceip=$amazonWan0
    right=$vpnServer
    rightsubnet=${hosttoHost[$i-1]}
EOF
done

### Run me
cat > /tmp/vpn.sh << EOF
#!/bin/bash
service ipsec restart
ipsec auto --add test1
ipsec auto --add test2
ipsec auto --add test3
ipsec auto --add test4

ipsec auto --up test1
ipsec auto --up test2
ipsec auto --up test3
ipsec auto --up test4

ipsec auto --status
ip xfrm policy
ip route show
ping -c 1 ${pingHost[0]}; 
ping -c 1 ${pingHost[1]};
ping -c 1 ${pingHost[2]}; 
ping -c 1 ${pingHost[3]}; 

EOF
chmod +x /tmp/vpn.sh

# Finishing - touch
/tmp/vpn.sh
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.