Here is my config for VPN server with ikev2 on OpenBSD 6.0.
For more details here is the link I use for setup.
http://puffysecurity.com/wiki/openikedoffshore.html
Problems with this that if connection drop that it takes several minutes to reconnect.
Have not tested this with OpenBSD 6.1.
This config may need fixing!
Server Config
Server ip address = A.B.C.D
vi /etc/iked.conf
ikev2 passive ipcomp esp \ from 0.0.0.0/0 to 10.0.0.0/8 \ from 0.0.0.0/0 to 172.16.0.0/12 \ from 0.0.0.0/0 to 192.168.0.0/16 \ local A.B.C.D peer any \ srcid A.B.C.D \ lifetime 3h bytes 2G \ tag IKED
Note The srcid A.B.C.D must match the Client SSL Certificate’s Common Name.
vi /etc/pf.conf
# $OpenBSD: pf.conf,v 1.54 2014/08/23 05:49:42 deraadt Exp $ # # See pf.conf(5) and /etc/examples/pf.conf set limit { states 200000, frags 10000, src-nodes 2000 } set limit tables 1000 set limit table-entries 100000 SSHipPASS = "{ 1.2.3.4/23, 10.0.0.0/8 }" set reassemble yes set block-policy return #set loginterface egress set skip on { lo, enc } match in all scrub (no-df random-id max-mss 1460) table <bruteforce> persist block in block in quick from urpf-failed label uRPF block quick from <bruteforce> pass out all pass in on egress proto udp from any to any port { isakmp, ipsec-nat-t } pass in on egress proto { ah, esp } pass out on egress \ from { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 } \ to { ! 10.0.0.0/8, ! 172.16.0.0/12, ! 192.168.0.0/16 } \ nat-to (egress) pass in quick inet proto icmp icmp-type { echoreq, unreach } pass in quick proto tcp from $SSHipPASS \ to (egress) port ssh \ flags S/SA modulate state \ (max-src-conn 15, max-src-conn-rate 15/5, overload <bruteforce> flush global) block in quick proto tcp from any \ to (egress) port ssh
Client Config OpenBSD Router Box.
vi /etc/iked.conf
ikev2 active ipcomp esp \ from 10.0.0.0/8 to 0.0.0.0/0 \ from 172.16.0.0/12 to 0.0.0.0/0 \ from 192.168.0.0/16 to 0.0.0.0/0 \ peer A.B.C.D \ srcid client.example.com \ tag IKED
Note The srcid client.example.com must match the Client SSL Certificate’s Common Name.
vi /etc/pf.conf
set reassemble yes set block-policy return set skip on { lo, enc } lan_if = "re1" ext_if = "pppoe0" match in all scrub (no-df random-id max-mss 1440) block in block in quick from urpf-failed label uRPF pass out quick on egress proto { tcp, udp } from any to any port { 53, 123, 443, 500, 4500 } pass in quick on egress proto { tcp, udp } from any to any port { 53, 123, 443, 500, 4500 } pass in quick on $lan_if proto { tcp, udp } from 10.1.1.0/24 to 10.1.1.1 port { 22, 53 } rdr-to lo0 pass in on egress proto udp from any to any port { isakmp, ipsec-nat-t } pass in on egress proto { ah, esp } # nat rule pass out on $ext_if from { ! 10.0.0.0/8 } to { 10.0.0.0/8 } nat-to ($ext_if:0) pass in quick inet proto icmp icmp-type { echoreq, unreach } pass in quick on $lan_if all block in quick proto tcp from any to (egress) port ssh
How to add extra FLOWS
I did not use FLOWS just config pf.conf.