This document will explain howto set up an IPSec encrypted GRE tunnel on OpenBSD. In the document, both end points are OpenBSD 4.1 systems, however it should be fairly straight forward to implement on other systems.

To start, I would advise disabling pf on gre0 and enc0 until you have the encrypted tunnel working, this will eliminate pf from any toubleshooting you may have to do, you can do that by adding the following in /etc/pf.conf, make sure you re-load the pf rules.

set skip on enc0
set skip on gre0

 
Now, on to the tutorial…
Assume two hosts in disparate parts of the world with the following interfaces

Host A
   public interface 10.0.0.5
   private interface 10.0.50.0/24

Host B
   public interface 192.168.0.5
   private interface 192.168.50.0/24

 
First, enable gre on both hosts A and B by enabling the sysctl net.inet.gre.allow

# sysctl -w net.inet.gre.allow=1

 
To make it more permanent, add net.inet.gre.allow=1 to /etc/sysctl.conf.

Now, we will construct a gre tunnel to allow their private networks to communicate.

On Host A you would run the following

# ifconfig gre0 create
# ifconfig gre0 172.16.0.1 172.16.0.2 netmask 0xffffffff link0 up
# ifconfig gre0 tunnel 10.0.0.5 192.168.0.5
# route add -net 192.168.50 -netmask 255.255.255.0 172.16.0.2

 
Where did 172.16.0.1 and 172.16.0.2 come from, you might ask? These addresses create the point to point gre tunnel, you should pick them from RFC1918 space that is unused in the network(s) you will be connecting.

On to Host B

# ifconfig gre0 create
# ifconfig gre0 172.16.0.2 172.16.0.1 netmask 0xffffffff link0 up
# ifconfig gre0 tunnel 192.168.0.5 10.0.0.5
# route add -net 10.0.50 -netmask 255.255.255.0 172.16.0.1

 
Once you’ve proven a host on 10.0.50.x can communicate with a host on 192.168.50.x, you can write the gre to /etc/hostname.gre0.

Host A’s /etc/hostname.gre0 looks like this,

172.16.0.1 172.16.0.2 netmask 0xffffffff link0 up
tunnel 10.0.0.5 192.168.0.5
!route add -net 192.168.50 -netmask 255.255.255.0 172.16.0.2

 
At this point your GRE tunnel should be working, do not move onto implementing IPSec until your GRE tunnel is functioning, it will only complicate troubleshooting

Now, enable ipsec on both hosts A and B by enabling the sysctl net.inet.esp.enable

# sysctl -w net.inet.esp.enable=1

 
To make it more permanent, add net.inet.esp.enable=1 to /etc/sysctl.conf.

Now, in this document we will be using public key authentication, to implement x509 certificate authentication please refer to this document.

For public key encryption, you will make use of the file /etc/isakmpd/local.pub. If for some reason this file does not exist, check to see if /etc/isakmpd/private/local.key exists, if neither exists you can create them with the following commands.

# /usr/sbin/openssl genrsa -out /etc/isakmpd/private/local.key 1024
# chmod 600 /etc/isakmpd/private/local.key
# openssl rsa -out /etc/isakmpd/local.pub \
                    -in /etc/isakmpd/private/local.key -pubout

 
If /etc/isakmpd/private/local.key exists but /etc/isakmpd/local.pub does not, you can generate it with the command

# openssl rsa -out /etc/isakmpd/local.pub \
                    -in /etc/isakmpd/private/local.key -pubout

 
Now, you’ll want to copy Host A’s /etc/isakmpd/local.pub to Host B and copy it to /etc/isakmpd/pubkeys/ipv4/10.0.0.5

Note: 10.0.0.5 is a file, not a directory

Likewise, you’ll need to copy Host B’s /etc/isakmpd/local.pub to Host A and copy it to /etc/isakmpd/pubkeys/ipv4/192.168.0.5

Once these have been copied, you need to setup ipsec, Host A’s /etc/ipsec.conf should contain the following

ike esp transport from 10.0.0.5 to 192.168.0.5

 
And Host B’s /etc/ipsec.conf should contain

ike esp transport from 192.168.0.5 to 10.0.0.5

 
Note: We chose transport, because ipsec is not tunneling our subnets, the gre tunnel is taking care of that for us, we are simply encrypting between the two endpoints of the tunnel.

Now, we start isakmpd and load the ipsec rules

# isakmpd -K
# ipsecctl -f /etc/ipsec.conf

 
Now, to test if you’ve been successful, try to connect from a host on 10.0.50.x to a host on 192.168.50.x.

Assuming you can still connect, run the following on one of the end points:

# tcpdump -ni enc0
tcpdump: WARNING: enc0: no IPv4 address assigned
tcpdump: listening on enc0, link-type ENC
20:07:03.036687 (authentic,confidential): SPI 0x8d8b5b6b: 192.168.50.120 > 10.0.50.10: icmp: echo request (gre encap)
20:07:03.075990 (authentic,confidential): SPI 0xaf01c27a: 10.0.50.10 > 192.168.50.120: icmp: echo reply (gre encap)

 
Success! As the packet dump is telling us, you’ve a gre encapsulated packet, that is also being encrypted.

Now, to make some of those settings more permanent, add the following to /etc/rc.conf.local

isakmpd_flags="-K"
ipsec=YES

 
Now that you have IPSec over GRE working, I would strongly advise you remove the set skip rules added to your pf.conf and modify your pf rules for more stringent enforcement.