Install Proton VPN with Ansible

- name: Install ProtonVPN
  become: true
  block:
    - name: Add protonvpn APT repository
      vars:
        protonvpn_release: 1.0.8
      ansible.builtin.apt:
        deb: https://repo.protonvpn.com/debian/dists/stable/main/binary-all/protonvpn-stable-release_{{ protonvpn_release }}_all.deb

    - name: Install ProtonVPN client
      apt:
        update_cache: true
        name:
          - proton-vpn-gnome-desktop

Links
https://protonvpn.com/support/de/official-linux-vpn-ubuntu

LEFT (DEV env)

Server

sudo apt install -y wireguard

cd /etc/wireguard
umask 077;
wg genkey | tee privatekey | wg pubkey > publickey

/etc/wireguard/wg0.conf
[Interface]
Address = 192.168.6.1/24
ListenPort = 1194
PrivateKey = qz3LQkTEA8tOJEORyUxT2w2SIwdXwCLcO7joKq58tUs=
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE     

[Peer]
PublicKey = wL+h2EqxaQpcWgwO8SIXPGqhHgssvj9xqjHAPjYLJ28=
AllowedIPs = 192.168.6.2/32

sudo ufw allow 1194/udp
sudo ufw status

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0
sudo systemctl status wg-quick@wg0

# watch connections
watch -n1 wg

Client

Create connection

VPN_GATEWAY=vpn1.example.com
VPN_USER=foo
VPN_ROUTES=192.168.11.0/24

nmcli connection add \
    connection.id vpn1 \
    connection.type vpn \
    connection.permissions "user:${USER}" \
    ipv4.routes "${VPN_ROUTES}" \
    ipv4.ignore-auto-routes yes \
    vpn.service-type org.freedesktop.NetworkManager.openconnect \
    vpn.data "
        protocol = anyconnect,
        authtype = cert,
        gateway = ${VPN_GATEWAY},
        cacert = ${HOME}/vpn1/ca.pem,
        usercert = ${HOME}/vpn1/certificate.pem,
        userkey = ${HOME}/vpn1/priv.pem,
        cookie-flags = 2
    " \
    vpn.secrets "
        form:main:group_list=CLIENTGROUP,
        form:main:username=${VPN_USER},
        save_passwords=yes
    "

Start connection and enter password once

nmcli connection up vpn1

Debug

#journalctl -fxe NM_CONNECTION=8d5ec3cb-99c5-47ea-84e2-38174cd14702
journalctl -fxe -t NetworkManager

cat /etc/NetworkManager/system-connections/vpn1.nmconnection 
nmcli con show vpn1

Links
https://0xsys.blogspot.com/2019/06/configure-vpn-using-nmcli.html

Create container

CONTAINER=wireguard

# Add ubuntu-minimal repository
lxc remote add --protocol simplestreams ubuntu-minimal https://cloud-images.ubuntu.com/minimal/releases/

# Create LXD container
#lxc launch ubuntu-minimal:lts ${CONTAINER}
lxc launch ubuntu-minimal:22.04 ${CONTAINER}

# update APT packages
lxc exec ${CONTAINER} -- bash -c "export http_proxy=${http_proxy} && apt update && apt -y dist-upgrade && apt -y autoremove"

# Install WireGuard
lxc exec ${CONTAINER} -- bash -c "export http_proxy=${http_proxy} && apt install -y wireguard iptables iputils-ping"

Configure UDP 4000 port forward to wireguard container

lxc config device add ${CONTAINER} udp51820 proxy listen=udp:0.0.0.0:51820 connect=udp:127.0.0.1:51820

Configure WireGuard

cd /etc/wireguard
umask 077;
wg genkey | tee privatekey | wg pubkey > publickey

# /etc/wireguard/wg0.conf
[Interface]
Address = 192.168.8.1/24
ListenPort = 51820
PrivateKey = aI+ohS+Jd5T5lMIDXqvLwp8g6eT6U28bQVS43t5YaU8=
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE     

[Peer]
PublicKey = yD3wRcoQ94Wu9o9WaLzjfA0S2IQrD91E8xxpSiMU6yE=
AllowedIPs = 192.168.8.2/32

Enable and start WireGuard systemd sercvice

# wg-quick up wg0
sudo systemctl enable --now wg-quick@wg0.service

WireGuard Home configuration

terraform.tfvars

os_user = "foo"
psk = "pass1234"
fritzbox_wan_ip = "1.2.3.4"
fritzbox_cidr = "192.168.178.0/24"

terraform.tf

variable "os_user" {
  type = string
}

variable "psk" {
  type = string
}

variable "fritzbox_wan_ip" {
  type = string
}

variable "fritzbox_cidr" {
  type = string
}

data "openstack_networking_network_v2" "networking_network_1" {
  name = "${var.os_user}-net"
}

data "openstack_networking_subnet_v2" "networking_subnet_1" {
  name = "${var.os_user}-subnet"
  network_id = data.openstack_networking_network_v2.networking_network_1.id
}

data "openstack_networking_router_v2" "router_1" {
  name = "${var.os_user}-router"
}

resource "openstack_vpnaas_ike_policy_v2" "vpnaas_ike_policy_1" {
  name = "${var.os_user}-ike-aes256-sha512"
  encryption_algorithm = "aes-256"
  auth_algorithm = "sha512"
  pfs = "group2"
}

resource "openstack_vpnaas_ipsec_policy_v2" "vpnaas_ipsec_policy_1" {
  name = "${var.os_user}-ipsec-aes256-sha512"
  encryption_algorithm = "aes-256"
  auth_algorithm = "sha512"
  pfs = "group2"  
}

resource "openstack_vpnaas_service_v2" "vpnaas_service_1" {
  name = "${var.os_user}-vpn-service1"
  router_id = data.openstack_networking_router_v2.router_1.id
}

resource "openstack_vpnaas_endpoint_group_v2" "vpnaas_endpoint_group_subnet_1" {
  name = "${var.os_user}-vpn-ep-subnet"
  type = "subnet"
  endpoints = toset([data.openstack_networking_subnet_v2.networking_subnet_1.id])
}

resource "openstack_vpnaas_endpoint_group_v2" "vpnaas_endpoint_group_cidr_1" {
  name = "${var.os_user}-vpn-ep-cidr"
  type = "cidr"
  endpoints = toset([var.fritzbox_cidr])
}

resource "openstack_vpnaas_site_connection_v2" "vpnaas_site_connection" {
  name = "${var.os_user}-vpn-conn1"
  ikepolicy_id = openstack_vpnaas_ike_policy_v2.vpnaas_ike_policy_1.id
  ipsecpolicy_id = openstack_vpnaas_ipsec_policy_v2.vpnaas_ipsec_policy_1.id
  vpnservice_id = openstack_vpnaas_service_v2.vpnaas_service_1.id
  psk = var.psk
  peer_address = var.fritzbox_wan_ip
  peer_id = var.fritzbox_wan_ip
  local_ep_group_id = openstack_vpnaas_endpoint_group_v2.vpnaas_endpoint_group_subnet_1.id
  peer_ep_group_id  = openstack_vpnaas_endpoint_group_v2.vpnaas_endpoint_group_cidr_1.id
}

data "openstack_networking_secgroup_v2" "networking_secgroup_1" {
  name = "${var.os_user}-sec"
}

resource "openstack_networking_secgroup_rule_v2" "networking_secgroup_rule_1" {
  direction = "ingress"
  ethertype = "IPv4"
  protocol = "tcp"
  port_range_min = 22
  port_range_max = 22
  remote_ip_prefix = var.fritzbox_cidr
  security_group_id = data.openstack_networking_secgroup_v2.networking_secgroup_1.id
}

output "vpnaas_service_external_v4_ip" {
  value = openstack_vpnaas_service_v2.vpnaas_service_1.external_v4_ip
}

Configure connnection

terraform 0.13upgrade -yes .
terraform init
terraform plan
terraform apply -auto-approve

Fix / import already existing security group rule

Define variables for OpenStack VPN configuration

FRITZBOX_EXTERNAL_IP=x.x.x.x                    # curl ipinfo.io/ip
FRITZBOX_NETWORK=192.168.178.0/24               # Heimnetz > Netzwerk > Netzwerkeinstellungen > IPv4-Einstellungen
PASSWORD='xxxxxxxx'                             # apg -m 32
OPENSTACK_SUBNET_ID=$(openstack subnet list -c ID -f value)
OPENSTACK_ROUTER_ID=$(openstack router list -c ID -f value)

Define variables

# Create ike v1 policy
openstack vpn ike policy create vpn_ike_1 \
  --ike-version v1 \
  --encryption-algorithm aes-256 \
  --auth-algorithm sha256 \
  --pfs group14

# Create ipsec policy
openstack vpn ipsec policy create vpn_ipsec_1 \
  --encryption-algorithm aes-256 \
  --auth-algorithm sha256 \
  --pfs group14

# Create service
openstack vpn service create vpn_service_1 \
  --router ${OPENSTACK_ROUTER_ID} 

# Create local endpoint group
openstack vpn endpoint group create vpn_endpoint_openstack \
  --type subnet \
  --value ${OPENSTACK_SUBNET_ID}

# Create peer endpoint group
openstack vpn endpoint group create vpn_endpoint_fritzbox \
  --type cidr \
  --value ${FRITZBOX_NETWORK}

# Create connection
openstack vpn ipsec site connection create vpn_connection_1 \
  --vpnservice vpn_service_1 \
  --ikepolicy vpn_ike_1 \
  --ipsecpolicy vpn_ipsec_1 \
  --peer-address ${FRITZBOX_EXTERNAL_IP} \
  --peer-id ${FRITZBOX_EXTERNAL_IP} \
  --psk ${PASSWORD} \
  --local-endpoint-group vpn_endpoint_openstack \
  --peer-endpoint-group vpn_endpoint_fritzbox

Define variables for Frtizbox VPN configuration

Find the VPN server and the relevant router UUID

# get VPN connection ID
openstack vpn ipsec site connection list | grep foo
openstack vpn ipsec site connection list --long | grep 

VPN_CONNECTION_ID=142dc25f-13bb-4fda-b093-edf13df98ed8
openstack vpn ipsec site connection show ${VPN_CONNECTION_ID}

VPN_SERVICE_ID=$(openstack vpn ipsec site connection show ${VPN_CONNECTION_ID} -c 'VPN Service' -f value)
openstack vpn service show ${VPN_SERVICE_ID}

# get router ID
ROUTER_ID=$(openstack vpn service show ${VPN_SERVICE_ID} -c Router -f value)
echo "ROUTER_ID=${ROUTER_ID}"

Find the ctl Node where the active router is running

ROUTER_PORT_ID=$(openstack port list --device-owner network:router_gateway -f value -c id --router ${ROUTER_ID})
CONTROL_NODE=$(openstack port show ${ROUTER_PORT_ID} -c binding_host_id -f value)
echo "CONTROL_NODE: ${CONTROL_NODE}"

echo "ssh ${CONTROL_NODE} sudo ip netns exec qrouter-${ROUTER_ID} ip a s"

Connect to that ctl node and "jump" in its neutron-l3-agent docker container

ssh ${CONTROL_NODE}
docker exec -u root -ti neutron_l3_agent bash

Enable file logging in strongswan configuration

List

openstack vpn ipsec site connection list
openstack vpn endpoint group list
openstack vpn service list
openstack vpn ipsec policy list
openstack vpn ike policy list

Setup

# install
sudo apt-get install -y strongswan

# Left (Peer client, behind NAT)
Ubuntu Client IP: 212.8.9.10
Ubuntu net: 192.168.178.0/24

OpenStack VPN IP: 217.50.60.70
OpenStack Net: 10.0.1.0/24

Create OpenStack VPN endpoint
http://www.panticz.de/openstack/vpn-fritzbox

/etc/ipsec.conf

# Peer, e.g. FritzBox
VPN_LEFT_IP=$(curl -s ipinfo.io/ip)
VPN_LEFT_NET=$(ip -o -4 a | grep -v ": lo" | cut -d " " -f7)   # e.g 10.0.100.0/24 

# Right (OpenStack VPNaaS)
# OpenStack VPN Service IP:
# VPN_SERVICE_ID=$(openstack vpn service list -c ID -f value)
# openstack vpn service show ${VPN_SERVICE_ID} -c external_v4_ip -f value
VPN_RIGHT_IP=1.2.3.4

# OpenStack subnet netmask
# for eatch subnet
# openstack vpn ipsec site connection list -f json --long | jq -r ".[] | select(.\"VPN Service\" == \"${VPN_SERVICE_ID}\") .\"Local Endpoint Group ID\""
# openstack subnet show ${SUBNET_ID} -c cidr -f value
VPN_RIGHT_NET=10.0.1.0/24 

mv /etc/ipsec.conf /etc/ipsec.conf.org
cat < /etc/ipsec.conf
config setup

conn vpn1
 keyexchange=ikev1
 left=%defaultroute
 leftid=${VPN_LEFT_IP}
 leftsubnet=${VPN_LEFT_NET}
 leftauth=psk
 leftfirewall=yes
 authby=psk
 auto=start
 ike=aes256-sha512-modp1024
 esp=aes256-sha512
 right=${VPN_RIGHT_IP}
 rightsubnet=${VPN_RIGHT_NET}
 rightauth=psk
 ikelifetime=3600s
 keylife=3600s
 type=tunnel
EOF

/etc/ipsec.secrets