Contents

Overview

If the connection between the Charon-SSP host system, including the configured Charon-SSP guest systems, and the rest of the customer’s network runs over a public network as is the case for Charon-SSP AWS instances, it is necessary to secure the traffic against unauthorized access.
The example in this section describes how to configure a bridged SSH-based VPN tunnel between the Charon-SSP AWS host and a remote Linux system across a public network. Topologies that are more complicated will require other, more sophisticated, solutions.

 The customer is responsible for ensuring that any VPN solution meets the requirements of his or her company’s security guidelines. The example in this chapter is only for illustrative purposes.

The advantage of a bridged connection is that L2 protocols are also supported.

Once the sample configuration has been set up, it can be used for

• communication between host and guest system,
• communication between customer network and guest system.

Prerequisites

The example shows how to use the Charon Manager on the Charon-SSP AWS host and a set of commands on the remote Linux System to create an SSH VPN tunnel. For this configuration to work, the following prerequisites must be met:

• The remote Linux system must have access to the public IP address and the SSH port of the Charon-SSH AWS host.
• The private key necessary to access the instance must be available on the remote Linux system. The key-pair required to access the AWS instance is created via the AWS EC2 dashboard and associated with the instance when it is created.
   The private key can be downloaded only once when the key is created. If it is lost, access to the instance may be permanently lost.
• The bridge-utils and autossh packages must be installed on the remote Linux system.

Setting up the VPN Tunnel

The image below shows a sample setup. This section describes how to configure this sample setup.

Steps on the Charon-SSP Host System

Creating a VPN Bridge

To configure the SSH VPN connection, you must setup a private VPN bridge (called a virtual network in the Charon context) using the Charon Manager. Use the following steps to perform this task:

1. Open the Charon-SSP Manager and log in to the Charon-SSP host.

2. In the Charon Manager, open the Network Settings window by clicking on Tools > Network Settings. This will open the Network Settings window.

3. Click on Add and then on Virtual Network to open the virtual network configuration window. This will open the Add Virtual Network configuration window as shown below.

4. Enter the required information as shown below:

To learn more about the virtual network configuration options, refer to section Host System Network Configuration. 

Assigning the Guest Ethernet Interface

One of the TAP interfaces created in the step above, must be assigned to the Solaris guest system to add it to the LAN that will be tunneled across SSH to the remote Linux system.

Perform the following steps:

1. Open the Charon-SSP Manager and log in to the Charon-SSP host.

2. In the Charon Manager, select the guest system and then the Ethernet configuration category on the left. Assign one of the created TAP interfaces to the guest (see example below).

Click on OK to save the configuration change.

 If the emulated instance is currently running, the guest must be shut down and the emulated instance must be restarted for the change to become active.

Steps on the Remote Linux System

 The steps on the Charon-SSP host must be performed first.

As the user root on the remote Linux system, perform the following steps to set up the VPN tunnel according to the overview image above:

Possible additional steps:

• Enable IP forwarding on the remote Linux system if it is to act as a router between the tunnel connection and
  other systems in the customer network:
  # /sbin/sysctl -w net.ipv4.ip_forward=1
  (to make permanent: add the setting to /etc/sysctl.conf)
• Add static or dynamic routes to distribute the tunnel subnet to other systems in the customer network that need to communicate with the Solaris guest system across the VPN..
• Adapt the firewall on the remote Linux system as required to allow the VPN traffic to pass.

Steps on the Solaris Guest System

Set the IP address on the Ethernet interface to an address within the VPN subnet. To follow the example above, you would set the address to 192.168.0.33/24. To permanently change the IP address on the Solaris system, change the address in /etc/hosts for the hostname specified in /etc/<interfacename>.hostname. 
On Solaris 11, use the commands ipadm create-ip netX and ipadm create-addr -T static -a <ip-address>/<netmask> netX/v4.

Stopping the SSH Tunnel

To stop the SSH tunnel, perform the following steps on the remote Linux system:

Routing to/from Solaris Guest 

After following the description above, the Solaris guest system can be reached from the systems that are also connected to the virtual bridge (in the example: remote Linux system and host system). To enable the Solaris guest system to communicate with other systems in the customer network (or the Internet) over the VPN connection, perform the following steps:

• Add the VPN address of the remote Linux system as the default gateway for the Solaris guest system.
• Propagate the IP network used for the SSH VPN within the customer network, as required.
• Enable IP forwarding on the remote Linux system and allow forwarded packages through the firewall.

The screenshot below illustrates the Solaris guest system behavior (after the VPN network has been made known within the customer LAN and the remote Linux host has been set up as a router):

• The interface address shows that the Solaris system is in the 192.168.0.0/24 network using the ifconfig command.
• The netstat -rn command shows the routing table without a default route.
• The ping to an IP address outside the SSH VPN fails.
• The route add default <gateway> command adds the remote Linux host as the default gateway.
• The  netstat -rn command now shows the default route.
• The ping to an IP address outside the SSH VPN succeeds.

To make the entry permanent 

• on Solaris 10: use the route -p command (stores routes in /etc/inet/static_routes).
• on older Solaris versions: add the address of the default gateway to /etc/defaultrouter.