From f5b79621d0c841ee9a596543a05ad1acc9130c1d Mon Sep 17 00:00:00 2001 From: aapostoliuk Date: Fri, 19 Jan 2024 13:38:40 +0200 Subject: Changed IPv6 pool documentation in accel-ppp services Changed IPv6 pool documentation in accel-ppp services to named IPv6 pools. https://vyos.dev/T5865 --- docs/configuration/vpn/sstp.rst | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) (limited to 'docs/configuration/vpn/sstp.rst') diff --git a/docs/configuration/vpn/sstp.rst b/docs/configuration/vpn/sstp.rst index d9bb4353..2c5cef6d 100644 --- a/docs/configuration/vpn/sstp.rst +++ b/docs/configuration/vpn/sstp.rst @@ -132,7 +132,8 @@ Configuration Use this command to define default address pool name. -.. cfgcmd:: set vpn sstp client-ipv6-pool prefix
mask +.. cfgcmd:: set vpn sstp client-ipv6-pool prefix
+ mask Use this comand to set the IPv6 address pool from which an SSTP client will get an IPv6 prefix of your defined length (mask) to terminate the @@ -140,8 +141,8 @@ Configuration bit long, the default value is 64. -.. cfgcmd:: set vpn sstp client-ipv6-pool delegate
delegation-prefix - +.. cfgcmd:: set vpn sstp client-ipv6-pool delegate
+ delegation-prefix Use this command to configure DHCPv6 Prefix Delegation (RFC3633) on SSTP. You will have to set your IPv6 pool and the length of the @@ -150,6 +151,11 @@ Configuration delegation prefix can be set from 32 to 64 bit long. +.. cfgcmd:: set vpn sstp default-ipv6-pool + + Use this command to define default IPv6 address pool name. + + .. cfgcmd:: set vpn sstp name-server
Connected client should use `
` as their DNS server. This -- cgit v1.2.3 From dd3537443d71b8a5481ad0e8fb1a8e4edd0ecb71 Mon Sep 17 00:00:00 2001 From: aapostoliuk Date: Thu, 25 Jan 2024 16:13:49 +0200 Subject: T5971: Added PPP options documentation Added PPP options documentation --- docs/configuration/vpn/l2tp.rst | 2 +- docs/configuration/vpn/sstp.rst | 71 ++++++++++++++++++++++++++++++++++++++--- 2 files changed, 68 insertions(+), 5 deletions(-) (limited to 'docs/configuration/vpn/sstp.rst') diff --git a/docs/configuration/vpn/l2tp.rst b/docs/configuration/vpn/l2tp.rst index 4a7657e7..ce3b6711 100644 --- a/docs/configuration/vpn/l2tp.rst +++ b/docs/configuration/vpn/l2tp.rst @@ -98,7 +98,7 @@ Below is an example to configure a LNS: set vpn l2tp remote-access client-ip-pool L2TP-POOL range 192.168.255.2-192.168.255.254 set vpn l2tp remote-access default-pool 'L2TP-POOL' set vpn l2tp remote-access lns shared-secret 'secret' - set vpn l2tp remote-access ccp-disable + set vpn l2tp remote-access ppp-options disable-ccp set vpn l2tp remote-access authentication mode local set vpn l2tp remote-access authentication local-users username test password 'test' diff --git a/docs/configuration/vpn/sstp.rst b/docs/configuration/vpn/sstp.rst index 2c5cef6d..a9def827 100644 --- a/docs/configuration/vpn/sstp.rst +++ b/docs/configuration/vpn/sstp.rst @@ -179,35 +179,98 @@ SSL Certificates PPP Settings ------------ +.. cfgcmd:: set vpn sstp ppp-options disable-ccp + + Disable Compression Control Protocol (CCP). + CCP is enabled by default. + +.. cfgcmd:: set vpn sstp ppp-options interface-cache + + Specifies number of interfaces to keep in cache. It means that don’t + destroy interface after corresponding session is destroyed, instead + place it to cache and use it later for new sessions repeatedly. + This should reduce kernel-level interface creation/deletion rate lack. + Default value is **0**. + +.. cfgcmd:: set vpn sstp ppp-options ipv4 + + Specifies IPv4 negotiation preference. + + * **require** - Require IPv4 negotiation + * **prefer** - Ask client for IPv4 negotiation, do not fail if it rejects + * **allow** - Negotiate IPv4 only if client requests (Default value) + * **deny** - Do not negotiate IPv4 + +.. cfgcmd:: set vpn sstp ppp-options ipv6 + + Specifies IPv6 negotiation preference. + + * **require** - Require IPv6 negotiation + * **prefer** - Ask client for IPv6 negotiation, do not fail if it rejects + * **allow** - Negotiate IPv6 only if client requests + * **deny** - Do not negotiate IPv6 (default value) + +.. cfgcmd:: set vpn sstp ppp-options ipv6-accept-peer-interface-id + + Accept peer interface identifier. By default is not defined. + +.. cfgcmd:: set vpn sstp ppp-options ipv6-interface-id + + Specifies fixed or random interface identifier for IPv6. + By default is fixed. + + * **random** - Random interface identifier for IPv6 + * **x:x:x:x** - Specify interface identifier for IPv6 + +.. cfgcmd:: set vpn sstp ppp-options ipv6-interface-id + + Specifies peer interface identifier for IPv6. By default is fixed. + + * **random** - Random interface identifier for IPv6 + * **x:x:x:x** - Specify interface identifier for IPv6 + * **ipv4-addr** - Calculate interface identifier from IPv4 address. + * **calling-sid** - Calculate interface identifier from calling-station-id. + .. cfgcmd:: set vpn sstp ppp-options lcp-echo-failure Defines the maximum `` of unanswered echo requests. Upon reaching the - value ``, the session will be reset. + value ``, the session will be reset. Default value is **3**. .. cfgcmd:: set vpn sstp ppp-options lcp-echo-interval If this option is specified and is greater than 0, then the PPP module will send LCP pings of the echo request every `` seconds. + Default value is **30**. .. cfgcmd:: set vpn sstp ppp-options lcp-echo-timeout Specifies timeout in seconds to wait for any peer activity. If this option specified it turns on adaptive lcp echo functionality and "lcp-echo-failure" - is not used. + is not used. Default value is **0**. + +.. cfgcmd:: set vpn sstp ppp-options min-mtu + + Defines minimum acceptable MTU. If client will try to negotiate less then + specified MTU then it will be NAKed or disconnected if rejects greater MTU. + Default value is **100**. .. cfgcmd:: set vpn sstp ppp-options mppe - Specifies :abbr:`MPPE (Microsoft Point-to-Point Encryption)` negotioation + Specifies :abbr:`MPPE (Microsoft Point-to-Point Encryption)` negotiation preference. * **require** - ask client for mppe, if it rejects drop connection - * **prefer** - ask client for mppe, if it rejects don't fail + * **prefer** - ask client for mppe, if it rejects don't fail. (Default value) * **deny** - deny mppe Default behavior - don't ask client for mppe, but allow it if client wants. Please note that RADIUS may override this option by MS-MPPE-Encryption-Policy attribute. +.. cfgcmd:: set vpn sstp ppp-options mru + + Defines preferred MRU. By default is not defined. + RADIUS ------ -- cgit v1.2.3 From d71c4607fa0c330a3c6269811b2126a25ceb91f7 Mon Sep 17 00:00:00 2001 From: aapostoliuk Date: Thu, 29 Feb 2024 16:21:27 +0200 Subject: Rewritten the SSTP server documentation Fully rewritten SSTP server documentation. --- docs/configuration/vpn/sstp.rst | 595 +++++++++++++++++++++++++++------------- 1 file changed, 403 insertions(+), 192 deletions(-) (limited to 'docs/configuration/vpn/sstp.rst') diff --git a/docs/configuration/vpn/sstp.rst b/docs/configuration/vpn/sstp.rst index a9def827..3749eb7b 100644 --- a/docs/configuration/vpn/sstp.rst +++ b/docs/configuration/vpn/sstp.rst @@ -19,50 +19,43 @@ local and RADIUS authentication. As SSTP provides PPP via a SSL/TLS channel the use of either publically signed certificates as well as a private PKI is required. -.. note:: All certificates should be stored on VyOS under ``/config/auth``. If - certificates are not stored in the ``/config`` directory they will not be - migrated during a software update. +*********************** +Configuring SSTP Server +*********************** Certificates ============ -Self Signed CA --------------- - -To generate the CA, the server private key and certificates the following -commands can be used. +Using our documentation chapter - :ref:`pki` generate and install CA and Server certificate .. code-block:: none - vyos@vyos:~$ mkdir -p /config/user-data/sstp - vyos@vyos:~$ openssl req -newkey rsa:4096 -new -nodes -x509 -days 3650 -keyout /config/user-data/sstp/server.key -out /config/user-data/sstp/server.crt - - Generating a 4096 bit RSA private key - .........................++ - ...............................................................++ - writing new private key to 'server.key' - [...] - Country Name (2 letter code) [AU]: - State or Province Name (full name) [Some-State]: - Locality Name (eg, city) []: - Organization Name (eg, company) [Internet Widgits Pty Ltd]: - Organizational Unit Name (eg, section) []: - Common Name (e.g. server FQDN or YOUR name) []: - Email Address []: - - vyos@vyos:~$ openssl req -new -x509 -key /config/user-data/sstp/server.key -out /config/user-data/sstp/ca.crt - [...] - Country Name (2 letter code) [AU]: - State or Province Name (full name) [Some-State]: - Locality Name (eg, city) []: - Organization Name (eg, company) [Internet Widgits Pty Ltd]: - Organizational Unit Name (eg, section) []: - Common Name (e.g. server FQDN or YOUR name) []: - Email Address []: + vyos@vyos:~$ generate pki ca install CA + +.. code-block:: none + vyos@vyos:~$ generate pki certificate sign CA install Server Configuration ============= +.. code-block:: none + + set vpn sstp authentication local-users username test password 'test' + set vpn sstp authentication mode 'local' + set vpn sstp client-ip-pool SSTP-POOL range '10.0.0.2-10.0.0.100' + set vpn sstp default-pool 'SSTP-POOL' + set vpn sstp gateway-address '10.0.0.1' + set vpn sstp ssl ca-certificate 'CA1' + set vpn sstp ssl certificate 'Server' + +.. cfgcmd:: set vpn sstp authentication mode + + Set authentication backend. The configured authentication backend is used + for all queries. + + * **radius**: All authentication queries are handled by a configured RADIUS + server. + * **local**: All authentication queries are handled locally. .. cfgcmd:: set vpn sstp authentication local-users username password @@ -70,137 +63,185 @@ Configuration Create `` for local authentication on this system. The users password will be set to ``. -.. cfgcmd:: set vpn sstp authentication local-users username disable +.. cfgcmd:: set vpn sstp client-ip-pool range - Disable `` account. + Use this command to define the first IP address of a pool of + addresses to be given to SSTP clients. If notation ``x.x.x.x-x.x.x.x``, + it must be within a /24 subnet. If notation ``x.x.x.x/x`` is + used there is possibility to set host/netmask. -.. cfgcmd:: set vpn sstp authentication local-users username static-ip -
+.. cfgcmd:: set vpn sstp default-pool - Assign static IP address to `` account. + Use this command to define default address pool name. -.. cfgcmd:: set vpn sstp authentication local-users username rate-limit - download +.. cfgcmd:: set vpn sstp gateway-address - Download bandwidth limit in kbit/s for ``. + Specifies single `` IP address to be used as local address of PPP + interfaces. -.. cfgcmd:: set vpn sstp authentication local-users username rate-limit - upload +.. cfgcmd:: set vpn sstp ssl ca-certificate - Upload bandwidth limit in kbit/s for ``. + Name of installed certificate authority certificate. -.. cfgcmd:: set vpn sstp authentication protocols - +.. cfgcmd:: set vpn sstp ssl certificate - Require the peer to authenticate itself using one of the following protocols: - pap, chap, mschap, mschap-v2. + Name of installed server certificate. -.. cfgcmd:: set vpn sstp authentication mode +********************************* +Configuring RADIUS authentication +********************************* - Set authentication backend. The configured authentication backend is used - for all queries. +To enable RADIUS based authentication, the authentication mode needs to be +changed within the configuration. Previous settings like the local users, still +exists within the configuration, however they are not used if the mode has been +changed from local to radius. Once changed back to local, it will use all local +accounts again. - * **radius**: All authentication queries are handled by a configured RADIUS - server. - * **local**: All authentication queries are handled locally. +.. code-block:: none + set vpn sstp authentication mode radius -.. cfgcmd:: set vpn sstp gateway-address +.. cfgcmd:: set vpn sstp authentication radius server key - Specifies single `` IP address to be used as local address of PPP - interfaces. + Configure RADIUS `` and its required shared `` for + communicating with the RADIUS server. +Since the RADIUS server would be a single point of failure, multiple RADIUS +servers can be setup and will be used subsequentially. +For example: -.. cfgcmd:: set vpn sstp port +.. code-block:: none - Specifies the port `` that the SSTP port will listen on (default 443). + set vpn sstp authentication radius server 10.0.0.1 key 'foo' + set vpn sstp authentication radius server 10.0.0.2 key 'foo' +.. note:: Some RADIUS severs use an access control list which allows or denies + queries, make sure to add your VyOS router to the allowed client list. -.. cfgcmd:: set vpn sstp client-ip-pool range +RADIUS source address +===================== - Use this command to define the first IP address of a pool of - addresses to be given to SSTP clients. If notation ``x.x.x.x-x.x.x.x``, - it must be within a /24 subnet. If notation ``x.x.x.x/x`` is - used there is possibility to set host/netmask. +If you are using OSPF as IGP, always the closest interface connected to the +RADIUS server is used. You can bind all outgoing RADIUS requests +to a single source IP e.g. the loopback interface. -.. cfgcmd:: set vpn sstp client-ip-pool next-pool +.. cfgcmd:: set vpn sstp authentication radius source-address
- Use this command to define the next address pool name. + Source IPv4 address used in all RADIUS server queires. -.. cfgcmd:: set vpn sstp default-pool +.. note:: The ``source-address`` must be configured on one of VyOS interface. + Best practice would be a loopback or dummy interface. - Use this command to define default address pool name. +RADIUS advanced options +======================= +.. cfgcmd:: set vpn sstp authentication radius server port -.. cfgcmd:: set vpn sstp client-ipv6-pool prefix
- mask + Configure RADIUS `` and its required port for authentication requests. - Use this comand to set the IPv6 address pool from which an SSTP client - will get an IPv6 prefix of your defined length (mask) to terminate the - SSTP endpoint at their side. The mask length can be set from 48 to 128 - bit long, the default value is 64. +.. cfgcmd:: set vpn sstp authentication radius server fail-time