個人用メモ。AzureのVNETとPPPoEしてるVyOSをSite to Site VPNでつなぐコンフィグ例です。（雑）
Azure側久しぶりに見たらだいぶ変わってましたね。（現行ポータルになってローカルネットワークとの接続状態が分かりづらくなった気がする）
firewall {
all-ping enable
broadcast-ping disable
config-trap disable
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name OUTSIDE-IN {
default-action drop
rule 10 {
action accept
state {
established enable
related enable
}
}
}
name protect-vyatta {
default-action drop
rule 100 {
action accept
destination {
port 500
}
protocol udp
}
rule 200 {
action accept
protocol esp
}
rule 210 {
action accept
destination {
port 1701
}
ipsec {
match-ipsec
}
protocol udp
}
rule 250 {
action accept
destination {
port 4500
}
protocol udp
}
}
name untrusted {
default-action drop
description "deny traffic from internet"
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
twa-hazards-protection disable
}
interfaces {
ethernet eth0 {
address ＜VyOSのローカルのIPアドレス＞/24
duplex auto
firewall {
in {
}
local {
}
}
hw-id ＜Hyper-V使ってたので一応固定化＞
policy {
route PPPOE-IN
}
pppoe 0 {
default-route auto
mtu 1454
name-server auto
password ****************
user-id ＜PPPoE用のID＞
}
smp_affinity auto
speed auto
}
loopback lo {
}
}
nat {
source {
rule 10 {
destination {
address !＜VPN先のネットワークのIPアドレススペース＞/16
}
outbound-interface pppoe0
source {
address ＜ローカルのネットワークのIPアドレススペース＞/24
}
translation {
address masquerade
}
}
}
}
policy {
route PPPOE-IN {
rule 10 {
protocol tcp
set {
tcp-mss 1414
}
tcp {
flags SYN
}
}
}
}
service {
ssh {
listen-address ＜VyOSのローカルのIPアドレス＞
port 22
}
}
system {
config-management {
commit-revisions 20
}
console {
device ttyS0 {
speed 9600
}
}
host-name ＜お好みで＞
login {
user ＜VyOSのユーザー＞ {
authentication {
encrypted-password ****************
}
level admin
}
}
package {
auto-sync 1
repository community {
components main
distribution helium
password ****************
url http://packages.vyos.net/vyos
username ""
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone Asia/Tokyo
}
vpn {
ipsec {
esp-group esp-azure {
compression disable
lifetime 3600
mode tunnel
pfs disable
proposal 1 {
encryption aes128
hash sha1
}
proposal 2 {
encryption aes256
hash sha1
}
proposal 3 {
encryption 3des
hash sha1
}
}
ike-group ike-azure {
key-exchange ikev2
lifetime 28800
proposal 1 {
dh-group 2
encryption aes128
hash sha1
}
proposal 2 {
dh-group 2
encryption aes256
hash sha1
}
proposal 3 {
dh-group 2
encryption 3des
hash sha1
}
}
ipsec-interfaces {
interface pppoe0
interface eth0
}
nat-networks {
allowed-network 0.0.0.0/0 {
}
}
nat-traversal enable
site-to-site {
peer ＜Azure側のGatewayのパブリックIPアドレス＞ {
authentication {
mode pre-shared-secret
pre-shared-secret ＜Azure側で設定した事前共有キー＞
}
connection-type initiate
default-esp-group esp-azure
ike-group ike-azure
local-address ＜VyOSに振られるグローバルIPアドレス＞
tunnel 1 {
allow-nat-networks disable
allow-public-networks disable
esp-group esp-azure
local {
prefix ＜ローカルのIPアドレススペース＞/24
}
remote {
prefix ＜Azure側VNETのIPアドレススペース＞/16
}
}
}
}
}
}
ブチザッキ 