{"id":156,"date":"2024-08-20T20:05:42","date_gmt":"2024-08-21T03:05:42","guid":{"rendered":"https:\/\/eisaichen.com\/?p=156"},"modified":"2024-08-22T10:39:30","modified_gmt":"2024-08-22T17:39:30","slug":"how-to-connect-oracle-oci-and-opnsense-with-ipsec-site-to-site-vpn","status":"publish","type":"post","link":"https:\/\/eisaichen.com\/?p=156","title":{"rendered":"How to connect Oracle OCI and Opnsense with IPsec (Site-to-Site VPN)"},"content":{"rendered":"\n
\n

Step-by-step guide for connecting Oracle site-to-site vpn to Opnsense as CPE.<\/p>\n<\/blockquote>\n\n\n\n

Oracle OCI Side<\/h2>\n\n\n\n


1a) Go to “Networking > Customer connectivity > Site-to-Site VPN, or just search “VPN”.<\/h5>\n\n\n\n

1b) Choose “Customer-premises equipment” on the left, and create a new CPE.
(CPE means your own equipment, which is Opnsense in this case)<\/h5>\n\n\n\n
\"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n
    \n
  • Name:<\/strong> <any name><\/li>\n\n\n\n
  • IP address:<\/strong> <your Opnsense WAN IP><\/li>\n\n\n\n
  • CPE vendor information:<\/strong> Other<\/li>\n<\/ul>\n\n\n\n

    1c) Back to “Site-to-Site VPN” and Create IPSec connection<\/h5>\n\n\n\n
    \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n
      \n
    • Name:<\/strong> <any name><\/li>\n\n\n\n
    • Customer-premises equipment:<\/strong> <The one you just created><\/li>\n\n\n\n
    • This CPE is behind a NAT device:<\/strong> <Enable NAT-T or not>
      Enable it if you don’t have a WAN IP on your Opnsense.
      If you un-check it, it will still be set to “Auto”
      When enabled, it will use port 500 and fallback to 4500, when disabled, it will only use 4500<\/li>\n\n\n\n
    • Routes to your on-premises network:<\/strong> <Subnets on your Opnsense end> e.g.: 192.168.1.0\/24<\/li>\n<\/ul>\n\n\n\n

      1d) the Tunnel options needs extra attention. (But you can always change it later)<\/h5>\n\n\n\n
        \n
      • Name:<\/strong> <any name><\/li>\n\n\n\n
      • IKE version:<\/strong> IKEv2<\/li>\n\n\n\n
      • Routing type:<\/strong>

        The most important option here, all 3 types can work, depending on your preference.
        And what you choose will decide how we config Opnense next.

        BGP dynamic routing:<\/strong>
        (recommended)
        Dynamic routing
        Need VTI
        plugin “os-frr” needs to be installed on Opnsense<\/em>
        IPsec security policy will not be installed to the kernel(or simply think the routing table from IPsec will not install). Once Phase 1 and 2 are established, we will create a P2P virtual tunnel interface(VTI), then pass routing entry on each side via BGP protocol.

        Static routing:<\/strong>
        (not recommended)
        Need VTI<\/em>
        Same as BGP, we don’t install routing entry and we use VTI once Phase 2 is reached. But instead of using BGP to learn routing entries automatically, we create static route entries on both sides manually.

        Policy based routing:<\/strong>
        Sample
        Still need to add static routes on Opnsense manually<\/em>
        IPsec handles everything, so we don’t need VTI. when connecting, route entry will be negotiated and installed on Phase 2.

        (You can choose different types for each tunnel, but not recommended)


        (From here, everything you configured needs to be matched on both sides)<\/strong><\/li>\n<\/ul>\n\n\n\n

        1d-1) For BGP dynamic routing<\/strong><\/h6>\n\n\n\n
          \n
        • BGP ASN:<\/strong> <number from 64512 to 65535><\/li>\n\n\n\n
        • IPv4 inside tunnel interface – CPE:<\/strong> <IP Address for the P2P connection> (Opnsense End)
          this address will later be used for BGP peering. e.g.:10.100.1.3\/31<\/li>\n\n\n\n
        • IPv4 inside tunnel interface – Oracle:<\/strong> <IP Address for the P2P connection> (Oracle End)
          this address will later be used for BGP peering. e.g.:10.100.1.2\/31<\/li>\n\n\n\n
        • IPv6 addressing:<\/strong> <Check if you have ipv6 subnet>
          IPv6 inside tunnel interface(s):<\/strong> same usage as above, e.g.: fe50:cafe:100:1::3\/127<\/li>\n<\/ul>\n\n\n\n
          1d-2) For Static routing:<\/strong><\/h6>\n\n\n\n

          Same as BGP, you just don’t need the “BGP ASN” and “IPv4 inside tunnel interface”<\/p>\n\n\n\n

          1d-3) For Policy based routing:<\/strong><\/h6>\n\n\n\n
            \n
          • On-premises CIDR blocks:<\/strong> <Subnets on Opnsense> (Usually same as the “Routes to your on premises network” on 1c)<\/li>\n\n\n\n
          • Oracle Cloud CIDR blocks:<\/strong> <Subnets on Oracle>
            IPv4 inside tunnel interface(s):<\/strong> <not needed><\/li>\n<\/ul>\n\n\n\n

            1e) Click “Show advanced options” and config encryption<\/h5>\n\n\n\n

            Check “Set custom configurations”
            Phase one (ISAKMP) configuration<\/p>\n\n\n\n

              \n
            • Custom encryption algorithm:<\/strong> AES_256_CBC<\/li>\n\n\n\n
            • Custom authentication algorithm:<\/strong> SHA_256<\/li>\n\n\n\n
            • Custom Diffie-Hellman group:<\/strong> GROUP14<\/li>\n<\/ul>\n\n\n\n

              Phase two (IPSec) configuration<\/p>\n\n\n\n

                \n
              • Custom encryption algorithm:<\/strong> AES_256_CBC<\/li>\n\n\n\n
              • Custom authentication algorithm:<\/strong> HMAC_SHA2_256_128<\/li>\n\n\n\n
              • Perfect forward secrecy Diffie-Hellman group:<\/strong> GROUP14<\/li>\n<\/ul>\n\n\n\n
                \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n

                1f) Finally, Create IPSec connection<\/h5>\n\n\n\n


                Opnsense Side<\/h2>\n\n\n\n


                2a) On OCI, go to “Networking > Customer connectivity > Site-to-Site VPN > <the VPN you just created><\/h5>\n\n\n\n

                Switch to “CPE & tunnels information” tab, and put it on the side, you will find all the information you need next here.<\/p>\n\n\n\n


                2b) On Opnsense, go to “VPN > IPsec > Connections”, click the “+”. (Don’t enable IPsec before everything is configured.)
                Config for each tunnel at a time<\/h5>\n\n\n\n
                  \n
                • Proposals:<\/strong> aes256-sha256-modp2048 [DH14]<\/li>\n\n\n\n
                • Version:<\/strong> IKEv2<\/li>\n\n\n\n
                • MOBIKE:<\/strong> un-check<\/li>\n\n\n\n
                • Local addresses:<\/strong> <the address use to initiate VPN connection>
                  Usually Opnsense WAN IP. You can also use your domain name if you have DNS\/DDNS.<\/li>\n\n\n\n
                • Remote addresses<\/strong>: <see “Oracle VPN IP address” in step 1a><\/li>\n\n\n\n
                • DPD delay (s):<\/strong> 20 (Or you can set your own on step 1e)<\/li>\n\n\n\n
                • Description<\/strong>: <give it a name><\/li>\n\n\n\n
                • Save<\/li>\n<\/ul>\n\n\n\n

                  2c) Under “Local Authentication”, click “+”<\/h5>\n\n\n\n
                    \n
                  • Connection:<\/strong> <profile name><\/li>\n\n\n\n
                  • Authentication:<\/strong> Pre-Shared Key<\/li>\n\n\n\n
                  • Id:<\/strong> <leave it blank>
                    leave it blank will default to the “Local address” you set on 2b. need to match the “CPE IKE identifier” on OCI (step 2a)<\/li>\n\n\n\n
                  • Certificates<\/strong>: <None><\/li>\n\n\n\n
                  • Description<\/strong>: <give it a name><\/li>\n<\/ul>\n\n\n\n

                    2d) Under “Remote Authentication”, click “+”<\/h5>\n\n\n\n
                      \n
                    • Connection:<\/strong> <profile name><\/li>\n\n\n\n
                    • Authentication:<\/strong> Pre-Shared Key<\/li>\n\n\n\n
                    • Id:<\/strong> <match the “Oracle VPN IP address” on OCI (step 2a)><\/li>\n\n\n\n
                    • Certificates<\/strong>: <None><\/li>\n\n\n\n
                    • Description<\/strong>: <give it a name><\/li>\n<\/ul>\n\n\n\n
                      \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n

                      2e) Under “Children”, click “+”<\/h5>\n\n\n\n
                        \n
                      • Connection:<\/strong> <profile name><\/li>\n\n\n\n
                      • Mode:<\/strong> Tunnel (OCI only supported Tunnel mode)<\/li>\n\n\n\n
                      • Start action:<\/strong> Trap+start<\/li>\n\n\n\n
                      • DPD action:<\/strong> Clear<\/li>\n\n\n\n
                      • ESP proposals:<\/strong> aes256-sha256-modp2048 [DH14]<\/li>\n<\/ul>\n\n\n\n
                        2e-1) For “BGP dynamic routing” and “Static routing”<\/strong><\/h6>\n\n\n\n
                          \n
                        • Policies: UN-CHECK (IMPORTANT)<\/strong>
                          Failed to do so will result in loss of all connections once IPsec is initiated.<\/li>\n\n\n\n
                        • Local:<\/strong> 0.0.0.0\/0<\/li>\n\n\n\n
                        • Remote:<\/strong> 0.0.0.0\/0
                          (If you have ipv6, use “0.0.0.0\/0,::\/0” for both)<\/li>\n\n\n\n
                        • Reqid:<\/strong> <any number>
                          Cannot be blank, and needs to be unique. e.g.: 10 for tunnel 1, 20 for tunnel 2.<\/li>\n\n\n\n
                        • Description:<\/strong> <give it a name><\/li>\n<\/ul>\n\n\n\n
                          \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n
                          2e-2) For “Policy based routing”<\/strong><\/h6>\n\n\n\n
                            \n
                          • Policies: <\/strong>checked<\/li>\n\n\n\n
                          • Local:<\/strong> <match “On-premises CIDR blocks” you gave on 1d-3><\/li>\n\n\n\n
                          • Remote:<\/strong> <match “Oracle Cloud CIDR blocks” you gave on 1d-3><\/li>\n\n\n\n
                          • Reqid:<\/strong> <any number>
                            Cannot be blank, and needs to be unique. e.g.: 10 for tunnel 1, 20 for tunnel 2.<\/li>\n\n\n\n
                          • Description:<\/strong> <give it a name><\/li>\n<\/ul>\n\n\n\n

                            2f) Go to “VPN > IPsec > Pre-Shared Keys”, Click “+”<\/h5>\n\n\n\n
                              \n
                            • Local Identifier:<\/strong> <ID you gave on step 2c> (Should be your WAN port IP by default)<\/li>\n\n\n\n
                            • Remote Identifier:<\/strong> <ID you gave on step 2d><\/li>\n\n\n\n
                            • Pre-Shared Key:<\/strong> <You can found it on step 1a, “Shared secret”><\/li>\n\n\n\n
                            • Type:<\/strong> PSK<\/li>\n<\/ul>\n\n\n\n

                              2g) “Policy based routing” Skip this step.<\/strong>
                              Go to “VPN > IPsec > Virtual Tunnel Interfaces”, Click “+”<\/h5>\n\n\n\n
                                \n
                              • Reqid:<\/strong> <Reqid you given on step 2e-1><\/li>\n\n\n\n
                              • Local address:<\/strong> <You WAN port IP><\/li>\n\n\n\n
                              • Remote address:<\/strong> <see “Oracle VPN IP address” in step 1a><\/li>\n\n\n\n
                              • Tunnel local address:<\/strong> <see “IPv4 inside tunnel interface – CPE” on step 1d-1><\/li>\n\n\n\n
                              • Tunnel remote address:<\/strong> <see “IPv4 inside tunnel interface – Oracle” on step 1d-1><\/li>\n\n\n\n
                              • Name:<\/strong> <give it a name><\/li>\n\n\n\n
                              • (If you set up for ipv6 address on 1d-1, put ipv6 address into “Tunnel secondary address(es)<\/strong>” accordingly)<\/li>\n<\/ul>\n\n\n\n

                                2h) Clone profiles for tunnel 2<\/h5>\n\n\n\n
                                  \n
                                • Clone, VPN > IPsec > Connections
                                  Change “Remote addresses<\/strong>“
                                  Change “ID<\/strong>” under “Remote Authentication”<\/li>\n\n\n\n
                                • Clone, VPN > IPsec > Pre-Shared Keys
                                  Change “Remote Identifier<\/strong>“<\/li>\n\n\n\n
                                • Clone, VPN > IPsec > Virtual Tunnel Interfaces (Skip for “Policy based routing”)
                                  Change “Tunnel local address<\/strong>“
                                  Change “Tunnel remote address<\/strong>“<\/li>\n<\/ul>\n\n\n\n

                                  2i) Allow IPsec traffic
                                  Go to “Firewall > Rules > WAN”, Allow the following ports<\/h5>\n\n\n\n
                                    \n
                                  • Protocol:<\/strong> IPv4 ESP
                                    Port:<\/strong> *<\/li>\n\n\n\n
                                  • Protocol:<\/strong> IPv4 UDP
                                    Port:<\/strong> 500<\/li>\n\n\n\n
                                  • Protocol:<\/strong> IPv4 UDP
                                    Port:<\/strong> 4500<\/li>\n<\/ul>\n\n\n\n
                                    \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n

                                    2j) Enable IPsec, go to “VPN > IPsec > Status Overview”
                                    You should see connections successfully established.<\/h5>\n\n\n\n
                                    \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n


                                    Add Route<\/h2>\n\n\n\n


                                    3a) Allow traffic on interface “IPsec”
                                    (BGP dynamic routing & Static routing) Allow traffic on your VTI(s)
                                    Adjust security list on OCI as well<\/h5>\n\n\n\n

                                    3b) On OCI, Go to “Networking > Virtual cloud networks > Virtual Cloud Network Details > Subnets”<\/h5>\n\n\n\n

                                    Choose your subnet, then the routing table of it.
                                    Add all the Opnsense subnets to it, and point to the Dynamic Routing Gateway.

                                    If you chose “Policy based routing<\/strong>“, then congratulations, you should able to send traffic to the VPN now. Your job is done.<\/strong><\/p>\n\n\n\n

                                    \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n

                                    3c-1) For “BGP dynamic routing”<\/strong>, on Opnsense, go to “Routing > BGP”<\/h5>\n\n\n\n

                                    Under “General” Tab<\/p>\n\n\n\n

                                      \n
                                    • BGP AS Number:<\/strong> <match “BGP ASN” you gave on 1d-1><\/li>\n\n\n\n
                                    • Network:<\/strong> <Opnsense subnets><\/li>\n<\/ul>\n\n\n\n

                                      Under “Neighbors” Tab<\/p>\n\n\n\n

                                        \n
                                      • Peer-IP:<\/strong> <see “IPv4 inside tunnel interface – Oracle” on OCI (step 2a)><\/li>\n\n\n\n
                                      • Remote AS:<\/strong> <see “Oracle BGP ASN” on OCI (step 2a)><\/li>\n\n\n\n
                                      • Update-Source Interface:<\/strong> <VTI Interface><\/li>\n<\/ul>\n\n\n\n

                                        Repeat the process for tunnel 2 and ipv6.
                                        Enable “BGP” and “Routing” in “General”, congratulations, you should able to send traffic to the VPN now. Your job is done.<\/strong><\/p>\n\n\n\n

                                        3c-2) For “Static routing”<\/strong>, on Opnsense, go to “System > Gateways > Configuration”<\/h5>\n\n\n\n

                                        Add 2 of your VTI interface as Gateway
                                        IP Address:<\/strong> <see “IPv4 inside tunnel interface – Oracle” on OCI (step 2a)>
                                        Un-check “Disable Gateway Monitoring<\/strong>“, then add 2 gateways into a group, so you can have redundancy.<\/p>\n\n\n\n

                                        Go to “System > Routes > Configuration”, click “+”<\/p>\n\n\n\n

                                          \n
                                        • Network Address<\/strong>: <Your OCI subnets><\/li>\n\n\n\n
                                        • Gateway:<\/strong> <Your VTI interface><\/li>\n<\/ul>\n\n\n\n

                                          Repeat it for every subnet on Oracle.
                                          Congratulations, you should able to send traffic to the VPN now. Your job is done.<\/strong><\/p>\n\n\n\n

                                          \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n","protected":false},"excerpt":{"rendered":"

                                          Step-by-step guide for connecting Oracle site-to-site vpn to Opnsense as CPE. Oracle OCI Side 1a) Go to “Networking > Customer connectivity > Site-to-Site VPN, or just search “VPN”. 1b) Choose “Customer-premises equipment” on the left, and create a new CPE. (CPE means your own equipment, which is Opnsense in this case) 1c) Back to “Site-to-Site […]<\/p>\n","protected":false},"author":1,"featured_media":201,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"[]"},"categories":[3],"tags":[],"class_list":["post-156","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tech"],"_links":{"self":[{"href":"https:\/\/eisaichen.com\/index.php?rest_route=\/wp\/v2\/posts\/156","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/eisaichen.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/eisaichen.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/eisaichen.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/eisaichen.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=156"}],"version-history":[{"count":51,"href":"https:\/\/eisaichen.com\/index.php?rest_route=\/wp\/v2\/posts\/156\/revisions"}],"predecessor-version":[{"id":223,"href":"https:\/\/eisaichen.com\/index.php?rest_route=\/wp\/v2\/posts\/156\/revisions\/223"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/eisaichen.com\/index.php?rest_route=\/wp\/v2\/media\/201"}],"wp:attachment":[{"href":"https:\/\/eisaichen.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=156"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/eisaichen.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=156"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/eisaichen.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=156"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}