IPSEC between Mikrotik router and a Shrew client
Overview
This article shows how to connect Shrew Ipsec client to RouterOS Ipsec server.
Shrew client works on both Windows (without need of L2TP) and Linux, see more details in their website
RouterOS Configuration
Lets assume that we already have IP connectivity between client and server. Client's IP address will be 10.5.101.20 and servers IP address will be 10.5.101.3.
IPSec configuration
/ip ipsec peer add address=10.5.101.20/32 auth-method=pre-shared-key exchange-mode=main\ secret=123 hash-algorithm=md5 enc-algorithm=3des generate-policy=yes
Since we assume that it is Road-Warrior setup, we do not know from where client will be connecting, so generate-policy=yes should be set.
The rest of the configuration is default
Shrew client configuration
Now we need to match configuration on Shrew client. And assume that we want to reach remote network 99.77.77.0/24 located behind router from Shew client
Note: RouterOS does not support modecfg and xauth. We need to disable every dynamic option in shew
- On the first configuration tab ("General") we simply specify server's IP address.
- On the second tab ("Client") disable any features that you do not want to use. In this case we are not using NAT-T, DPD, etc. So all of them are disabled.
- On the third tab ("Name Resolution") we disable everything since these options are used by modecfg, which is not supported on ROS.
- On the fourth tab In our case we are using pre shared key, so choose Mutual PSK and enter pre shared key.
- On "Phase1" and "Phase2" tabs we match configuration to the RouterOS config. Phase1 should match /ip ipsec peer config and Phase 2 should match /ip ipsec proposal config
- And the last one we manually set which network we want to reach so that Ipsec can generate proper policies.
Here is the whole Shew config, you can import it in your client
n:version:2 n:network-ike-port:500 n:network-mtu-size:1380 n:network-natt-port:4500 n:network-natt-rate:15 n:network-frag-size:540 n:network-dpd-enable:0 n:client-banner-enable:0 n:network-notify-enable:0 n:client-wins-used:0 n:client-wins-auto:1 n:client-dns-used:0 n:client-dns-auto:0 n:client-splitdns-used:0 n:client-splitdns-auto:0 n:phase1-dhgroup:2 n:phase1-life-secs:86400 n:phase1-life-kbytes:0 n:vendor-chkpt-enable:0 n:phase2-life-secs:3600 n:phase2-life-kbytes:0 n:policy-nailed:1 n:policy-list-auto:0 s:network-host:10.5.101.3 s:client-auto-mode:pull s:client-iface:direct s:network-natt-mode:disable s:network-frag-mode:disable s:auth-method:mutual-psk s:ident-client-type:address s:ident-server-type:address s:ident-client-data:10.5.101.20 s:ident-server-data:10.5.101.3 b:auth-mutual-psk:MTIz s:phase1-exchange:main s:phase1-cipher:3des s:phase1-hash:md5 s:phase2-transform:esp-3des s:phase2-hmac:md5 s:ipcomp-transform:disabled n:phase2-pfsgroup:2 s:policy-level:require s:policy-list-include:99.77.77.0 / 255.255.255.0
Check Connectivity
[admin@MikroTik] /ip ipsec remote-peers> print 0 local-address=10.5.101.3 remote-address=10.5.101.20 state=established side=responder established=44m3s
- IPSec should show intalled-sa,
[admin@MikroTik] /ip ipsec installed-sa> print
Flags: A - AH, E - ESP, P - pfs
0 E spi=0x476464 src-address=10.5.101.20 dst-address=10.5.101.3
auth-algorithm=md5 enc-algorithm=3des replay=4 state=mature
auth-key="fae8bc2918fea03dac0b7c8b6db57c60"
enc-key="15627d42163ad1fd58ee7cdc80d971d334883dbd2d81c42c"
addtime=sep/27/2012 13:51:07 expires-in=15m32s add-lifetime=48m/1h
current-bytes=240
1 E spi=0x5D4BF3B9 src-address=10.5.101.3 dst-address=10.5.101.20
auth-algorithm=md5 enc-algorithm=3des replay=4 state=mature
auth-key="728b19191d2a111673298c07d1f459c2"
enc-key="c944c45447df5429860d3999e674e1689bb41527ec941c9a"
addtime=sep/27/2012 13:51:07 expires-in=15m32s add-lifetime=48m/1h
current-bytes=240
- And dynamically created policies
[admin@MikroTik] /ip ipsec policy> print
Flags: X - disabled, D - dynamic, I - inactive
1 D src-address=10.5.101.20/32 src-port=any dst-address=99.77.77.0/24
dst-port=any protocol=all action=encrypt level=require ipsec-protocols=esp
tunnel=yes sa-src-address=10.5.101.3 sa-dst-address=10.5.101.20
proposal=default priority=2
2 D src-address=10.5.101.20/32 src-port=any dst-address=99.77.77.0/24
dst-port=any protocol=all action=encrypt level=require ipsec-protocols=esp
tunnel=yes sa-src-address=10.5.101.3 sa-dst-address=10.5.101.20
proposal=default priority=2
3 D src-address=99.77.77.0/24 src-port=any dst-address=10.5.101.20/32
dst-port=any protocol=all action=encrypt level=require ipsec-protocols=esp
tunnel=yes sa-src-address=10.5.101.20 sa-dst-address=10.5.101.3
proposal=default priority=2
Allow only encrypted traffic
We want local network behind the server to be reachable only by VNP users using encryption and drop other un-encrypted access. To do so we will need to set up firewall on the router.
First step is to allow ispec related packets. Rules allows also AH protocol and NAT-T port, which is not used in current setup but added for future use.
/ip firewall filter add chain=ipsec protocol=ipsec-esp add chain=ipsec protocol=ipsec-ah add chain=ipsec protocol=udp src-port=500 add chain=ipsec protocol=udp src-port=4500
Now we add the typical rules to allow established/related connections in input chain and jump to ipsec chain
/ip firewall filter add chain=input connection-state=established add chain=input connection-state=related add action=jump chain=input in-interface=WAN jump-target=ipsec
After decrypting ipsec packets they appear in IP firewall like regular packets. Now the trick is to determine which packets with destination (99.77.77.0/24) arrived over the ipsec tunnel. To do that we use mangle to mark ESP packets
/ip firewall mangle
add action=mark-packet chain=prerouting in-interface=WAN new-packet-mark=\
ipsec-encrypted passthrough=no protocol=ipsec-esp
After packets are marked we can add firewall rules to accept encrypted packets and drop the rest
/ip firewall filter add chain=input in-interface=WAN packet-mark=ipsec-encrypted add action=reject chain=input dst-address=99.77.77.0/24
Do the same in forward chain
/ip firewall filter add chain=forward connection-state=established add chain=forward connection-state=related add chain=forward in-interface=WAN packet-mark=ipsec-encrypted add action=reject chain=forward dst-address=99.77.77.0/24
Testing firewall
After setting firewall connect Shrew client and run ping from the client to destination network.
C:\Users\T>ping 99.77.77.1 -t Pinging 99.77.77.1 with 32 bytes of data: Reply from 99.77.77.1: bytes=32 time=9ms TTL=64 Reply from 99.77.77.1: bytes=32 time<1ms TTL=64 Reply from 99.77.77.1: bytes=32 time<1ms TTL=64 Reply from 99.77.77.1: bytes=32 time<1ms TTL=64
We can see in mangle and filters that packets are successfully matched and accepted
[admin@MikroTik] /ip firewall mangle> print stats Flags: X - disabled, I - invalid, D - dynamic # CHAIN ACTION BYTES PACKETS 0 prerouting mark-packet 2 240 20 [admin@MikroTik] /ip firewall filter> print stats chain=forward Flags: X - disabled, I - invalid, D - dynamic # CHAIN ACTION BYTES PACKETS 0 forward accept 0 0 1 forward accept 0 0 2 forward accept 1 500 25 3 forward reject 0 0
Now disconnect shrew client and you will notice that immediately ping throws an error that network is unreachable
Reply from 99.77.77.1: bytes=32 time=17ms TTL=64 Reply from 99.77.77.1: bytes=32 time=4ms TTL=64 Reply from 99.77.77.1: bytes=32 time=1ms TTL=64 Reply from 99.77.77.1: bytes=32 time=1ms TTL=64 Request timed out. Reply from 10.5.101.3: Destination net unreachable. Reply from 10.5.101.3: Destination net unreachable. Reply from 10.5.101.3: Destination net unreachable. Reply from 10.5.101.3: Destination net unreachable. Reply from 10.5.101.3: Destination net unreachable.
And in firewall filtes you will see that packets are rejected by the last reject rule.