R&S GP-U gateprotect Firewall How-to

Transcription

1 gateprotect Firewall How-to Setting up a VPN SSL Client-to-Site connection to an ios device (T^Wì2) Cybersecurity How-to

2 2017 Rohde & Schwarz Cybersecurity GmbH Muehldorfstr. 15, Munich, Germany Phone: +49 (0) Internet: cybersecurity.rohde-schwarz.com Printed in Germany Subject to change Data without tolerance limits is not binding. R&S is a registered trademark of Rohde & Schwarz GmbH & Co. KG. Trade names are trademarks of the owners.

3 Introduction 1 Introduction The following describes how to set up a VPN tunnel using SSL Client-to-Site between a gateprotect Firewall and an ios device (ios version or higher) using an iphone and the OpenVPN app as an example. This how-to refers to version 9.8. However, the overall procedure also applies as of version 9.4 if you pay attention to some deviations caused by GUI revisions, e.g. when creating firewall rules. Certificates have to be created with version or higher. For further information, refer to the gateprotect User Manual applicable to your particular software version. 2 Requirements A VPN SSL tunnel is set up between gateprotect Firewall using firmware version 9.8 and an iphone using OpenVPN. Make sure that the following requirements are met: The gateprotect Firewall is directly connected to the Internet via DSL modem. If you use a NAT router to connect your gateprotect Firewall to the Internet, make sure that your router forwards the ports needed for VPN SSL to the gateprotect Firewall. See the documentation of your router for further instructions. The gateprotect Firewall uses the following default settings for SSL Client-to-Site VPN connections: Port: 1194 Protocol: TCP Note: If you already made changes to your VPN SSL module, modify the settings via "VPN settings > VPN-SSL > Settings", under "Client-to-Site settings". By default, the VPN client network is /24 ( is the VPN server). Routing has to be unique. Therefore, there must be no address conflicts at the locations that will be connected via VPN. Table 2-1: Routing example. gateprotect Firewall Remote side eth0: / /24 eth1: /24 eth2: /24 eth3: /24 3

4 Creating Certificates 3 Creating Certificates To create a C2S tunnel via VPN SSL, you need X.509 certificates for the gateprotect Firewall and all clients that will have access. For the scenario described in this how-to you need the following: a certificate authority (CA) that signs the certificates a host certificate for the firewall a host certificate for the ios device (also called client certificate below) an OVPN configuration file Authentication via username/password or pre-shared key is not supported. Creating the CA To create an X.509 certificate on the gateprotect Firewall, you first need a CA that signs the host certificate to be created. 1. Open the Administration Client and connect to the firewall. 2. Navigate to "Security > Certificates". The certificates manager opens. 3. Click the plus button in the bottom left in the menu bar. A wizard for the creation of certificates opens. 4. Select "Create a CA". Click "Next". 5. Select "CA for user certificates". Click "Next". 6. Select "VPN connections and webserver" as scope. Click "Next". 7. Optional: Enable the OCSP and/or CRL protocols, if desired. For further information, see the gateprotect User Manual. Click "Next". 8. Under "Common Name" enter the common name (CN) of the CA. 4

5 Creating Certificates Figure 3-1: CN settings of the CA. Note: The common name identifies the CA and has to be unique. 9. Optional: If desired, click " Add" to enter a "Subject Alternative Name". 10. Click "Next". 11. Assign a "Password" for the private key of the CA. Select a key size of at least 2048 bits. While smaller keys are supported, they are considered insecure. Note: The password will be needed to sign certificates and cannot be changed after creation. If you lose the password, you need to recreate the CA and all certificates signed by it. 12. Click "Next". 13. Set the validity of the CA. We recommend setting a time period of at least 10 years as you will not be able to create new certificates using the CA once it has expired. Also, all certificates signed by the CA become invalid when the CA expires. It is possible to extend the validity period in the certificates manager after expiry. However, a completely new CA is created in this process that only inherits the CN and SAN. Note: VPN connections using expired certificates are rejected by the firewall. 14. Click "Execute". The CA is created with the data entered. 15. Click "Close", to exit the wizard and return to the certificates manager. The new CA is displayed in the certificates manager. 5

6 Creating Certificates Creating a Host Certificate Use the new CA to create a certificate for the VPN connection. 1. In the Administration Client, navigate to "Security > Certificates" and click the plus button in the bottom left in the menu bar. The wizard for the creation of certificates opens. 2. Select "Create certificate". Click "Next". 3. Select "VPN" as scope. Click "Next". 4. Under "Common Name", enter a name that clearly identifies the certificate (e.g. use the name of the location for the firewall). Figure 3-2: CN settings of the host certificate. 5. Click "Next". 6. Assign a "Password" for the private key of the certificate. Click "Next". 7. Under "Signing CA", select the CA created earlier from the drop-down list. 8. Under "CA password", enter the password for the private key of the CA. 6

7 Creating Certificates Figure 3-3: Select the signing CA. 9. Click "Next". 10. Define the validity of the certificate. The start and end dates have to be inside the validity period of the CA. Otherwise, an error message is displayed. The host certificate of the firewall should have the same validity period as the CA. 11. Click "Execute". The certificate is created with the provided data. Note: If you made a mistake when you entered the password for the private key, you will be notified by an error message. In this case, you need to repeat the certificate creation. 12. Click "Close" to exit the wizard and return to the certificates manager. The new certificate is displayed in a tree view below the CA. 13. Repeat steps 1 to 12 to create another certificate for the ios device. Tip: You can select a shorter validity period as required. If you later change the host certificate of the firewall, you only need to renew all C2S connections if you also use a new CA for the host certificate. 7

8 Configuring the VPN SSL Client-to-Site Tunnel 4 Configuring the VPN SSL Client-to-Site Tunnel Carry out the following steps to configure the VPN SSL Client-to-Site tunnel: 1. In the Administration Client, navigate to "VPN settings > VPN-SSL". The "VPN-SSL" dialog window opens. Note: If you open the dialog window for the first time, you see the following notification: Figure 4-1: Confirmation window when the VPN-SSL dialog opens the first time. Confirm this notification by clicking "Yes" to access the settings of the VPN SSL module. 2. In the "Settings" tab, select the "Host certificate" of the firewall: Figure 4-2: Selecting the host certificate. 3. Under "DNS" and "WINS", enter the IP address of your DNS/WINS server. 4. Optional: Edit the settings under "Client-to-Site settings" as required. 8

9 Configuring the VPN SSL Client-to-Site Tunnel Note: If you change the encryption algorithm after the C2S connection was exported, you also have to change it in all clients. Otherwise, the connection cannot be re-established successfully. 5. Click the "General" tab and proceed as follows: a) Under "VPN-SSL status", select the "Active" checkbox. b) Under "VPN-SSL clients", click the " Add" button to set up a new VPN SSL tunnel. Figure 4-3: Settings in the General tab. The "VPN SSL connection" dialog window opens. 6. In the "VPN SSL connection" dialog, proceed as follows: a) Enter a significant name for the VPN SSL connection. b) From the "Certificate" drop-down list, select the client certificate of the ios device. c) Under "Connection type", select "gateprotect VPN client". d) Under "Additional networks", click the " Add" button to add the local networks that will be reachable via VPN. Note: If your DNS server does not belong to this network, enter the IP address of the DNS server using netmask (/32). e) Optional: If you wish to route the entire traffic to the firewall, select the "Set default gateway" checkbox. f) Optional: Under "IP address of the client computer", you can assign an IP address to the client. If you leave this input field empty, the client is automatically assigned an IP address from the C2S network (recommended). 9

10 Configuring Firewall Rules g) Figure 4-4: Configuration of the VPN SSL C2S tunnel. Click "Ok" to save the settings and close the dialog. 7. Save your VPN SSL settings by clicking "Ok". Note: Make sure that the networks used (i.e. the C2S network of the VPN server and the local networks of the firewall) do not overlap the remote network when a hot spot (WLAN) is used. Otherwise, there will be routing conflicts. Modifying the local networks of the firewall later may cause a lot of effort. Setup of the C2S tunnel on the firewall is now complete. 5 Configuring Firewall Rules Create a rule set that manages communication between the firewall and the ios device and specifies what protocols (services) are allowed via the tunnel. 1. Open the Administration Client. 2. Drag a VPN computer object from the toolbar to the desktop. Tip: If you want to group several C2S connections in a user collection, create a VPN group object instead of a computer object. A configuration dialog opens. 3. In the configuration dialog, specify the following settings: a) Assign a meaningful name to the object. b) Under "VPN-connection", select "VPN-SSL". c) From the drop-down list, select the tunnel created earlier. d) Click "Ok" to save your settings and to close the configuration dialog. 10

11 Configuring Firewall Rules 4. Drag a computer object for your DNS server from the toolbar to the desktop. A configuration dialog opens. 5. In the configuration dialog, specify the following settings: a) Assign a meaningful name to the object. b) Under "Connected to", select the interface you want to connect to the DNS server. c) Enter the "IP address" of the DNS server. d) Click "Ok" to save your settings and to close the configuration dialog. 6. If it does not exist yet, drag a group object for the server network you want to reach via VPN to the desktop. A configuration dialog opens. 7. In the configuration dialog, specify the following settings: a) Assign a meaningful name to the object. b) Under "Mode", select "Network". c) Under "Connected to", select the interface you want to connect to the server network. d) Enter the "IP address" of the server network. e) Click "Ok" to save your settings and to close the configuration dialog. 8. In the toolbar, select the connection tool (or press the space bar). First click the VPN object and then the computer object for the DNS server. The rules editor opens. 9. Create the following rules for the connection: a) Use the arrow buttons to add the DNS service from the list on the left to the table on the right. This allows you to use local DNS names via VPN. b) Optional: Add the Ping service to the rules table to carry out connection tests. c) Click "Ok" to save your settings and to close the rules editor. 10. In the toolbar, select the connection tool (or press the space bar). First click the VPN object and then the server network. The rules editor opens. 11. Create the following rules for this connection according to your requirements: a) For terminal server connections, add the RDP service from the list on the left to the table on the right. b) For direct access to network shares on the file server, add the NetBIOS service to the rules table. c) Optional: Add the Ping service to the rules table to carry out connection tests. 12. Optional: If you want to access network printers, enable the LPR ports. As there is no entry for the RAW/LPR protocol in the predefined services, you need to add it manually: a) Click "Manage services". b) Select User defined services. 11

12 Configuring Firewall Rules c) Click "Create Service". A configuration dialog opens d) Click " Add". e) Create a service using port f) Under "Transport protocol", select the TCP protocol. g) Close all dialogs by clicking "Ok" until you are back in the rules editor. h) Add the new service to the rules table using the arrow button. 13. Click "Ok" to save your settings and to close the rules editor. Figure 5-1: Connections required if the gateprotect Firewall does not serve as a default gateway. Note: Make sure that the firewall is the (default) gateway of the servers when they access the C2S VPN network. This way, response packets can be routed through the tunnel. 14. If you set up the gateprotect Firewall as default gateway while configuring the VPN tunnel (see Chapter 4, "Configuring the VPN SSL Client-to-Site Tunnel", on page 8), the entire client traffic is forwarded to the firewall. For users to be able to access the Internet via VPN, you need to create an additional connection between the Internet object and the VPN object: a) Select the connection tool and first click the VPN object and then the Internet object. The rules editor opens. b) Add the services you require from the list on the left to the table on the right (for example RDP, SMTP(S), IMAP(S), POP3(S), HTTP(S), FTP, Ping, and NTP). 12

13 Exporting the VPN Configuration c) Enable NAT for all services: Select the service from the table. Click "Edit". Select the checkbox "Enable NAT for this service". Click "Ok". d) When you have created all required rules, click "Ok" to save your settings and to close the rules editor. Figure 5-2: Connections required if the gateprotect Firewall serves as a default gateway. If you enabled the option "Set default gateway" for the VPN tunnel, note that the bandwidth of the Internet connection will be increasingly utilized as the number of VPN users increases. 6 Exporting the VPN Configuration In order to set up the VPN SSL Client-to-Site tunnel on the ios device, you need to export the VPN configuration. 13

14 Exporting the VPN Configuration Export using v9.8 If software v9.8 is installed on your gateprotect Firewall, perform the following steps (otherwise proceed with "Export using v9.4 to v9.7" on page 15): 1. In the Administration Client, navigate to "VPN settings > VPN-SSL". The "VPN-SSL" dialog opens. 2. Under "VPN-SSL clients", select the created C2S tunnel. 3. Click the floppy disk symbol in the bottom right in the toolbar. The export dialog opens. 4. Under "Firewall address", specify the public address that the VPN client will connect to: a) Click the " Add" button. The "Server address" dialog opens. b) Enter the public IP address or the DNS name of the WAN interface of the firewall. c) Click "Ok". The "Server address" dialog closes. 5. Select "OpenVPN" as export format. 6. Under "Private key password", enter the password of the certificate. 7. Under "PKCS passphrase", define a password for the ios device and confirm it. This password has to be entered on the ios device when the certificate is imported. 8. Disable the "Integrate certificates in the configuration file" checkbox as ios devices do not support this. 9. Under "Export file", enter the location where the OVPN, PKCS12 and PEM files will be stored. 14

15 Exporting the VPN Configuration Figure 6-1: Exporting the VPN configuration. 10. Click "Ok". The VPN configuration will be exported as an OVPN file, the client certificate as a PKCS12 file, and the CA as a PEM file. Export using v9.4 to v9.7 If your gateprotect Firewall has a software version older than v9.8, perform the following steps: 1. Export your CA as a PEM file. For further information, see the gateprotect User Manual. 2. Create a text file in your file system. 3. Paste the content of the PEM file into the text file. The completed text file has the following content: client dev tun resolv-retry infinite nobind persist-key persist-tun 15

16 Importing the VPN Configuration mute 20 verb 1 proto tcp remote comp-lzo no route-delay 2 reneg-sec 3600 cipher AES-128-CBC <ca> -----BEGIN CERTIFICATE----- <content of your CA.PEM> -----END CERTIFICATE----- </ca> Adapt the variables proto <prot>, remote <ip or dns> <port>, and cipher <cipher> according to your settings. 7 Importing the VPN Configuration Make sure that the OpenVPN app is installed on the ios device in order to continue. 1. Transfer the PKCS12 and the OVPN files to the ios device. Import the PKCS12 file into the certificate store of the ios device. To do so, you either need to synchronize the certificate using itunes or send it to the ios device by (the mail account has to be set up in the Mail app, as this is the only app that can import the certificate to the certificate store). 2. Install the certificate. Enter the password for the private key while doing so. 3. Tap the OVPN file. The OpenVPN app opens. 16

17 Importing the VPN Configuration Figure 7-1: Display of the OpenVPN app. 4. Under "Certificate", select the installed certificate. 5. Enable AES encryption on the ios device (on the firewall AES-128 is set as the default encryption algorithm): a) Open the OpenVPN settings in the settings of the ios device. 17

18 Importing the VPN Configuration b) Enable Force AES-CBC-Ciphersuites. Figure 7-2: AES settings. 6. In the OpenVPN app, tap "Connection" to enable the connection. A VPN SSL C2S connection between the ios device and the firewall is established. 18