Since I’ve recently moved back to Loughborough into “CompSoc” house I found the networking equipment to be rather inadequate. So I purchased a 877 (he’s called Steven) and the fun began. First installing it wasn’t easy….and probably not safe.
The basic config is a simple NAT overload to the Virgin Modem, house switch connected off one port and a DD-WRT access point off another. After the NAT overload was put on security was the next issue, so to overcome the problem CBAC is used on the WAN interface to inspect inbound packets to ensure they originated from the LAN side first. Essentially a poor mans firewall.
After a bit of discussion with some of my housemates it became apparent it would be nice if we could VPN in to manage our LAN side equipment remotely. So I did a bit of research at work, got some sample configs and implemented them on Steven.
Now the VPN did work however I could only get to the LAN side of traffic, now I wasn’t satisfied with this, so I did a bit more research and Stuart Howlette found this technote on cisco’s website. In order to get WAN and LAN traffic routing through the VPN on a stick all that is required if a bit of knowledge on route maps. The route maps match any traffic heading the LAN subnet and then push it to the LAN interface otherwise it get pushed to the loopback which is then natted to the Internet.
So now below is a commented configuration file which explains what I did in order to get a home VPN on a stick which also routes to the internet.
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Steven
!
boot-start-marker
boot-end-marker
!
logging buffered 50000
!
aaa new-model
!
!
! Activate User and Group authentication
aaa authentication login default local
aaa authentication login userlist local
aaa authorization network grouplist local
aaa authorization network groupauthor local
!
!
aaa session-id common
!
!
dot11 syslog
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.1.100 192.168.1.254
!
ip dhcp pool steve
network 192.168.1.0 255.255.255.0
domain-name stv
default-router 192.168.1.1
dns-server 8.8.8.8 208.67.222.222
!
!
ip domain name stv
ip inspect name lolnet http
ip inspect name lolnet https
ip inspect name lolnet telnet
ip inspect name lolnet ssh
ip inspect name lolnet tcp
ip inspect name lolnet udp
!
!
multilink bundle-name authenticated
!
! Username and password is required for the VPN client to authenticate against
username Steven password 0 supersecret!
!
!Create an ISAKMP policy for phase 1 negotations
crypto isakmp policy 3
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp keepalive 60 5
!
! Create a cyrpto group for client configuration
! You can configure the preshare key, dns servers and the IP address pool
crypto isakmp client configuration group Home-vpn
key secretkey
dns 8.8.8.8 8.8.4.4
pool vpnz
!
! Create the phase 2 policy
crypto ipsec transform-set Home-set esp-3des esp-md5-hmac
!
! Create the dynamic map and apply it to the phase 2 policy
crypto dynamic-map mode 1
set transform-set Home-set
reverse-route
!
! Create the crypto map and apply the AAA authentication lists we created earlier
crypto map mode client authentication list userlist
crypto map mode isakmp authorization list grouplist
crypto map mode client configuration address respond
crypto map mode 1 ipsec-isakmp dynamic mode
!
archive
log config
hidekeys
!
!
ip ssh version 2
!
!
! Create a loopback on a separate subnet for VPN traffic heading to external destinations can be routed
interface Loopback0
ip address 192.168.2.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
!
interface FastEthernet0
description <<< PHYSICAL SWITCH TO HOUSE LAN >>>
switchport access vlan 17
spanning-tree portfast
!
interface FastEthernet1
description <<< PHYSICAL MODEM LINK >>>
switchport access vlan 12
spanning-tree portfast
!
interface FastEthernet2
description <<< ACCESS POINT >>>
switchport access vlan 17
spanning-tree portfast
!
interface FastEthernet3
!
interface Vlan1
no ip address
shutdown
!
interface Vlan12
description <<< WAN INTERFACE >>>
ip address dhcp
ip access-group WAN-IN in
ip nat outside
ip inspect lolnet in
ip virtual-reassembly
! Apply the route map to determine where traffic is heading
ip policy route-map VPN-Client
! Applying the crypto map allows vpn connections to establish
crypto map mode
!
interface Vlan17
description <<< LAN INTERFACE >>>
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
! Assign a third subnet for VPN clients
ip local pool vpnz 192.168.3.1 192.168.3.254
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Vlan12 dhcp
!
!
no ip http server
no ip http secure-server
ip nat translation timeout 360
ip nat inside source list NAT interface Vlan12 overload
!
! Anything heading to either 3.0 and 1.0 need to be denied through the NAT due to the order of operation
ip access-list extended NAT
deny ip any 192.168.1.0 0.0.0.255
deny ip any 192.168.3.0 0.0.0.255
permit ip any any
ip access-list extended WAN-IN
deny icmp any any
deny tcp any any eq 22
deny tcp any any eq telnet
permit ip any any
! Route Map Access lists for matching against
access-list 143 permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 144 permit ip 192.168.3.0 0.0.0.255 any
!
!
! If it’s heading to the LAN, push the traffic to the LAN interface
route-map VPN-Client permit 9
match ip address 143
set interface Vlan17
!
! If it’s not heading to the LAN subnet then push it to the Loopback so it can be natted
route-map VPN-Client permit 10
match ip address 144
set ip next-hop 192.168.2.2
!
!
control-plane
!
!
line con 0
no modem enable
line aux 0
line vty 0 4
!
scheduler max-task-time 5000
end
)
