Courses or Training

[jorgevisentini]

Hello guys!

Sorry about my English.

Does OPNSense.org offer courses or training?

I'm already 2 weeks ago looking for some documentation so I can base myself to make a VPN IPsec failover.

I have realized that it is complicated and that maybe OPNSense does not availability natively, so maybe a workaround is needed.

Thank you all.

[Pain Free IT]

Hi Jorge,

This is for the VPN portion.

The biggest thing is to make sure that the settings on both peers match.

If you are using this for data you care about I would recommend at least:

AES-128, SHA256, ESP, and PFS enabled. Typically later versions, and higher numbers are more secure. For RSA / Diffie-Helman go with the largest bit length that works (RSA would be 4096 bit). For DH use Group 14 or better.

Use IKEv2 if possible. If using IKEv1, then use 'Main mode', not 'Aggressive Mode' if possible.

You can use Mutual RSA (Certificates) or Mutual PSK (Pre Shared Key).

For the Pre-Shared key generation go to this site:
https://www.fourmilab.ch/hotbits/secure_generate.html

Set the web form to '1 Password' of '64' letters/numbers/punctuation (or more than 64). Use this for the Key. It will be truly random, based on a radioisotope source.

PSK may be easier to setup than RSA. You will still need the High Availability portion.

Here is the background info on VPNs in general:

IPSec (Internet Protocol Security) VPNs use 2 different phases to establish an encrypted tunnel for data:

IKE (Internet Key Exchange)
Phase 1 Authenticates each peer, and negotiates encryption, and hash protocols used to protect Phase 2 negotiation.
Phase 2 Negotiates encryption, and hash protocols for IPSec that will be used to encrypt traffic.

So Phase 1 protects Phase 2. Phase 2 protects traffic. Both Phases can / will renogotiate, or rekey periodically.

Technically this is called the Phase 1 Proposal, and Phase 2 Proposal.

Once both tunnels are up, traffic can be exchanged between networks using the Phase 2 settings (IPSec SA).

IKE SA
IPSec SA (Security Association)

Security Associations (SA) are the set of parameters, that were negotiated, and are now being used. Both peers will actively expect traffic based on them.

Encryption algorithms (ciphers):
Scramble data so it can't be read

Hash algorithms, or One Way Functions (also, 'Digest Function', HMAC / 'Hash Message Authentication Code'):
Shows any change in data. A whole DVD will have a radically different hash if a single bit is changed.
Can be used to detect corruption, or to authenticate. Passwords are typically stored this way (salted hopefully).

VPN Options:
AH
'Authentication Header': Authentication only; does not encrypt traffic! Not compatible with NAT.
ESP
'Encapsulating Security Payload': Authentication, and encryption. NAT compatible.
Use ESP if possible.

PFS
'Perfect Forward Secrecy': Hardens key exchange; makes unauthorized decryption less likely.
Always use if possible.

SA
'Security Association': Parameters negotiated to encrypt traffic.

Key Exchange Algorithm:
DH
Diffie-Hellman
Creates, and securely exchanges a session key with a peer that was already authenticated.

Encryption Algorithms:
Two types of Algorithms:
1. Uses the same key for encrypting, and decrypting (symmetric algorithm / symmetric key(s))
2. Uses different keys for encrypting, and decrypting (assymetric algorithm / Public Key Infrastructure (PKI))

I give the whole internet my 'public key', you encrypt a 'session key' (symmetric algorithm) with my 'public key', and send that to me; only I can decrypt the 'session key' using my 'private key'. I use the 'session key' to exchange encrypted data with you.

So RSA / ECC / DH are used for exchanging the AES / Blowfish / CAST128 keys.

Symmetric algorithms are much faster than assymetric algorithms. So asymmetric are used to encrypt the symmetric keys. The symmetric keys are then used to encrypt the data.

Symmetric:
DES, AES, Blowfish, CAST128, Serpent (TrueCrypt), etc.

Assymetric:
RSA
Rivest Shamir Adleman (Names of researchers who developed the algorithm)
RSA specifies keys in 1024, 2048, 4096, 8198, 16384 (16384 is the largest I've used)
Based on trying to factor large prime numbers.

ECC
Elliptic Curve Cryptography (Regarded as more secure than RSA, and typically faster)
Bit length varies. These are based on predicting 'random looking' curves, over a small portion of their area (finite field). They are currently about 10x stronger than the equivalent RSA keys in terms of bit length, for both classical, and quantum attacks.
Bit length varies according to the curve.
Most curves are specified from a pool of 15 that the NSA recommends, which I'm sure are secure...You can use your own.

Hash algorithms (One Way Functions)
MD4 - deprecated
MD5 'Message Digest Algorithm' - deprecated, ('birthday' attacks / collisions)
SHAx 'Secure Hash Algorithm'
SHA1 (160 bits)
SHA2 (4 different bit lengths):
SHA224, SHA256, SHA384 and SHA512
AES-XCBC
Whirlpool (TrueCrypt)
etc.
Collisions occur when two different sets of data have the same hash function output (different data should always have different output).

OpenVPN is better for clients in general. You can choose from:
Username / Password
Certificates
One Time Password (Google Auth, or similar)

With TLS-Auth the firewall won't even respond if the client doesn't have the shared key, so no port scanning. Also, vulnerabilities like heartbleed won't work for an attacker without the shared key.

More Info:
AH & ESP
http://www.networksorcery.com/enp/protocol/ah.htm
https://security.stackexchange.com/questions/90021/why-use-ipsec-ah-vs-esp
https://www.ibm.com/support/knowledgecenter/SSLTBW_1.13.0/com.ibm.zos.r13.halz002/f1a1b3b1281.htm

IKE Key Terminology (Oracle):
http://docs.oracle.com/cd/E19253-01/816-4554/ike-32/index.html

IPSec overview (Cisco):
http://www.ciscopress.com/articles/article.asp?p=25474&seqNum=7

FAQ-What are the differences between IKEv1 and IKEv2 (Huawei)
http://support.huawei.com/enterprise/KnowledgebaseReadAction.action?contentId=KB1000081273

IPSEC & IKE (Checkpoint)
https://sc1.checkpoint.com/documents/R76/CP_R76_VPN_AdminGuide/13847.htm

IPsec phase 1 and phase 2 (Brocade)
http://www.brocade.com/content/html/en/vrouter5600/40r1/vrouter-40r1-ipsecvpn/GUID-0B3591F2-F0FE-4F64-ABF9-A3B5F05ABD96.html

Understanding Phase 1 of IKE Tunnel Negotiation (Juniper)
https://www.juniper.net/documentation/en_US/junos/topics/concept/vpn-security-phase-1-ike-proposal-understanding.html

Understanding Phase 2 of IKE Tunnel Negotiation (Juniper)
https://www.juniper.net/documentation/en_US/junos12.1x44/topics/concept/vpn-security-phase-2-ipsec-proposal-understanding.html

Diffie Hellman Groups (Cisco)
https://supportforums.cisco.com/document/12276506/diffie-hellman-groups

Diffie Hellman (Wolfram)
http://mathworld.wolfram.com/Diffie-HellmanProtocol.html