EoIP shared ethernet LAN using IPsec

Sometimes it is desirable to have a virtual ethernet LAN so all remote peers appear to be within the same LAN. One example is various network/LAN type multiuser games. This will allow all broadcast traffic to make it to all remote parties as if they were on the same local LAN network.

EoIP and IPsec

This configuration uses the linux-eoip software together with libreswan. The linux-eoip software is currently being added to fedora/epel7, see this review bug

Note that at least for RHEL/Fedora, the linux-eoip package isn't properly integrated yet, so some additional manual configuration for now is required.

eoip configuration

Create a bridge device for the LAN facing interface and assign a LAN IP address, for example LAN-bro

On RHEL/Fedora you can use an ifcfg file in /etc/sysconfig/networking-scripts

add a libreswan connection

The IPsec connection needs to allow sending GRE (protocol 45) traffic. If you have public IP addresses on the IPsec gateways (not behind a NAT router) you can use IPsec transport mode to save a few bytes over tunnel mode to increase the changes of the packet sizes not causing problems (because protocols might assume a 1500 mtu to be always possible because it thinks it is operating in a LAN). If one of the IPsec gateways is behind NAT, you should use tunnel mode. This assumes the two gateways have stable public IP addresses (PublicIP-A and PublicIP-B)

# /etc/ipsec.d/tun-eoip.conf

conn tun-eoip
    type=transport
    left=PublicIP-A
    initial-contact=yes
    leftsubnet=PublicIP-A/32
    leftid=pubipA
    leftprotoport=47/0
    right=PublicIP-B
    rightsubnet=PublicIP-B/32
    rightid=pubipB
    rightprotoport=47/0
    # you can also use raw RSA instead of PSK authentication
    authby=secret
    auto=start

# /etc/ipsec./tun-eoip.secret

PublicIP-A PublicIP-B : PSK "Someverylongsecurerandomsecret"

Once both ends are configured you can bring the tunnel up manually using: ipsec auto --up tun-eoip

EoIP tunnel configuration

Configure the LAN-br0 tunnel. Note the ID must be the same on both sides.

# /etc/eoip/eoip.cfg

[zeoip0]
id=2
dst=pubipB
dynamic=1

Bring up the eoip tunnel:

eoip /etc/eoip/eoip.cfg

This will show a new zeoip0: device

5: zeoip0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master LAN-br0 state UNKNOWN qlen 500
link/ether 92:ab:59:99:9e:db brd ff:ff:ff:ff:ff:ff
inet6 fe80::90ab:59ff:fe99:9edb/64 scope link
valid_lft forever preferred_lft forever

Add this to the bridge:

brctl addif LAN-br0 zeoip0

iptables configuration

The tunnel should allow GRE only over IPsec. You should also clamp the MSS on the LAN bridge:

iptables -A INPUT -i eth0 -p gre -m policy --dir in --pol ipsec -j ACCEPT
iptables-A OUTPUT -p gre -m policy --dir out --pol ipsec --mode tunnel --tunnel-dst PublicIP-A --tunnel-src PublicIP-B -j ACCEPT

iptables -A POSTROUTING -o LAN-br0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu