This repo is based on rgl/strongswan-site-to-site-vpn-vagrant. See original README.md in README.old.md
This project sets up site-to-site VPN using 4 VMs. Each site contains a gateway and a host:
sun-ubuntu --- sun <=> moon --- moon-ubuntu
sun and moon are gateways, and sun-ubuntu, moon-ubuntu are their respective hosts.
We set up SSH tunnel to forward traffic from client running on host OS to server.
sun-ubuntu --- sun <= VPN => moon --- moon-ubuntu <= SSH tunnel => host OS
server ----------- <= VPN => -------------------- <= SSH tunnel => client
Install Virtualbox
Install Vagrant
Prepare settings and AttestationReportSigningCACert.pem files and place them into ./sgx-secrets-after-ra.
This paragraph shows basic usage based on simple HTTP server. It demonstrates that the VPN is actually encrypting the traffic.
Fetch submodules
git submodule update --init
Start everything
vagrant up # takes a lot of time
Login into the moon machine (a VPN device), and watch the network traffic:
vagrant ssh moon-ubuntu
# then, inside the VM:
tcpdump -n -i any tcp port 3000
From your host computer, access the following URLs to see them working:
http://10.1.0.4:3000
http://10.2.0.4:3000
Then, see how site-to-site traffic looks like:
vagrant ssh moon-ubuntu
# then, inside the VM:
wget -qO- 10.2.0.4:3000
When running the example, you have to setup SSH tunnel to moon-ubuntu
vagrant ssh moon-ubuntu -- -L 7777:10.2.0.4:7777
sudo tcpdump -n -i any tcp port 7777 # show traffic
Now any traffic pointed to localhost:7777 on host OS will be forwarded to sun-ubuntu, i.e. server application that provides secrets.
SSH into sun-ubuntu host to set up the server
vagrant ssh sun-ubuntu
cd /vagrant/sgx-secrets-after-ra
./bootstrap
./configure
make
./run-server
Now run client on host OS as usual:
cd /path/to/this/project/sgx-secrets-after-ra
./bootstrap
./configure
make
./run-client
Install rsync to use synced_folder:
choco install rsync
If you don't have rsync installed, you can disable sync_folder in Vagrantfile by setting disabled: false to disabled: true:
config.vm.synced_folder ".", "/vagrant/", type: "rsync", disabled: false,
Now checkout from git manually:
mkdir -p ~/project
cd project
d863a25ace194daa17370dbefc6dbdef68262a5d
Keep in mind that local changes won't be propagated from host OS to VM.