EdgeRouter: Routing through OpenVPN and IPSEC with OSPF

By | May 9, 2016

Open Shortest Path First (OSPF) is a routing protocol for Internet Protocol (IP) networks. Because I have site-to-site OpenVPN and IPSEC tunnels between my primary and remote sites I ended up defining lots of static routes. The environment started to be complex enough to justify the use of OSPF that is supported by EdgeRouter.

The current setup of my environment looks like:

routers

Primary Site:

ER-8 (with load-balancing WAN1 and WAN 2):
– WAN 1: eth0 linked to the ISP 1 through a Hitron cable modem in bridge mode. Thus the ER-8 gets the IP from the ISP.
– WAN 2: eth1 not linked.
– LAN 7: eth7 to internal LAN 2
– LAN 11: eth2 internal LAN 11

D-Link DWR-921 LTE:
– WAN 1: LTE link to Mobile service ISP.

EdgeRouter POE:
– WAN1: etho, IP = 192.168.7.10 linked to EdgeRouter ER-8 eth7 with gateway 192.168.7.1
– WAN2: eth1, IP = 192.168.0.50 link to D-Link DWR-921 LTE eth4 with gateway 192.168.0.1
– LAN 2: switch0, all the internal LAN

Remote Site:

UPC Cable Modem:
– WAN 1: eth0 linked to the ISP 1

EdgeRouter Lite:
– WAN 1: eth0, link to UPC Cable Modem eth1 with gateway 192.168.0.1
– LAN 9: eth1, local service LAN
– LAN 10: eth2, local management LAN

OpenVPN site-to-site between primary site (EdgeRouter POE) and remote site (EdgeRouter Lite). The tunnel is used to communicate between networks 192.168.2.0/24 from primary site and 192.168.9.0/24 from remote site.

IPSEC site-to-site with vti between primary site (ER-8) and remote site (EdgeRouter Lite).

By using IPSEC site-to-site with vti see https://blog.voina.org/edgerouter-ipsec-site-to-site-with-virtual-tunnel-interface/ I have the advantage of being able to tret the IPSEC associated virtual interface as any other routable interface, so OSPF can be applied for IPSEC also.

By using OSPF I am able to get rid of all the static routes necessary to be able to route through OpenVPN and IPSEC tunnels. This will make it very easy to add new local network on primary and remote sites without the need to add additional static routes.

Note that OSPF works by discovering routes from the neighbour. In the digram of the network we can see we have a loop made of the three EdgeRouter routers. Very important in this loop is the direction in which the OSPF will discover routes.

(EdgeRouter POE)(eth0) —uplink—> (eth7)(ER-8)(vti0) —IPSEC—> (vti0)(EdgeRouter Lite)(vtun0) —OpenVPN—> (vtun0)(EdgeRouter POE)

I am choosing the above direction because I want some networks to be routed through IPSEC connection that is much faster than the OpenVPN. Because OpenVPN is not using any hardware acceleration on EdgeRouter has much lower bandwidth than IPSEC.

The configuration will be done in the same order.

STEP 1: Configure OSPF on EdgeRouter POE

STEP 1.1: Allow OSPF traffic through the firewall

Add a new allow rule to the firewall for OSPF protocol:

STEP 1.2: Modify interfaces for OSPF

We have to declare in each interface definition that will be involved with OSPF, the OSPF parameters. Note that currently we will not use vtun0 for OSPF as is not necessary to “close” the loop. To route directly through the OpenVPN tunnel we will use static routes. See the static route used to force going to 192.168.9.0/24 from the remote site.

So we add to the eth0 interface the ospf routing parameters:

STEP 1.3: Advertise networks for ospf

Under protocols add an ospf section:

Note:
1. network 192.168.2.0/24 = with this we advertise a network for ospf. You can add any network that is connected to the router.
2. router-id 192.168.7.10 = this is important to be the router IP that is linked to the next neighbour. The IP of the immediate neighbour will be an IP from the same network (in our case 192.168.7.1 the IP on eth7 on the ER-8).

STEP 1.4: Commit changes
After we commit the changes osfp daemon will be automatically started and the router will start route discovery. Nothing will happen yet as there is no active neighbour.

STEP 2: Configure OSPF on ER-8

STEP 2.1: Allow ospf traffic through the firewall

Add a new allow rule to the firewall for OSPF protocol:

STEP 2.2: Modify interfaces for OSPF

We have to declare in each interface definition that will be involved with ospf, the ospf parameters. This is the middle device so we have two interfaces that advertise for ospf: eth7 and vti0

So we add to the eth7 and vti0 interface the ospf routing parameters:
Note that vti0 has a special setting: “network point-to-point” to indicate that this is a special kind of OSPF.

STEP 2.3: Advertise networks for OSPF

Under protocols add an ospf section:

Note:
1. network 192.168.7.0/24 = with this we advertise a network for ospf. You can add any network that is connected to the router. Note that we must add the vti0 network 40.0.0.0/30
2. router-id 192.168.7.1 = this is important to be the router IP that is linked to the previous neighbour. The IP of the immediate neighbour will be an IP from the same network (in our case 192.168.7.10 the IP on eth0 on the EdgeRouter-POE).
3. because the vti0 interface is declared as having ospf as “network point-to-point” we are able to see the next neighbour directly through this interface. In this case it does not matter that we have “router-id 192.168.7.1”.

STEP 2.4: Commit changes
After we commit the changes OSPF daemon will be automatically started and the router will start route discovery.

STEP 3: Configure OSPF on ER-Lite

STEP 3.1: Allow ospf traffic through the firewall

Add a new allow rule to the firewall for OSPF protocol:

STEP 3.2: Modify interfaces for OSPF

We have to declare in each interface definition that will be involved with ospf, the ospf parameters. This is the last device so we have one interface that advertises for ospf: vti0

So we add to the vti0 interface the ospf routing parameters:
Note that vti0 has a special setting: “network point-to-point” to indicate that this is a special kind of OSPF.

STEP 3.3: Advertise networks for OSPF

Under protocols add an ospf section:

Note:
1. network 192.168.9.0/24 = with this we advertise a network for ospf. You can add any network that is connected to the router. We must add the vti0 network 40.0.0.0/30
2. router-id yy.yy.yy.yy = this is the external WAN IP or the WAN IP. Because our immediate neighbour is the neighbour through the vti0 interface this router-id is not used to detect the neighbour. Because the vti0 interface is declared as having ospf as “network point-to-point” we are able to see the next neighbour directly through this interface.

STEP 3.4: Commit changes
After we commit the changes OSPF daemon will be automatically started and the router will start route discovery.

STEP 4:
Because the OSPF daemons were started in the order the configurations were done not everything was discovered. Let’s clear the ip tables and force discovery.
Execute on all the routers:

Other useful ospf commands:

Show IP information for OSPF:

Show IP database for OSPF network:

Show OSPF interface :

STEP 5: List the discovered routes on all routers

Note that there are a lot of routes discovered across networks and routers. There are even multiple routes for different networks from the remote site, through vtun0 and also through vti0.
The distance of OSPF detected routes is 110 so lower than static defined routes. This means that we can overwrite at any time an OSPF route with a static one.

Router 1: EdgeRouter POE

Router 2: ER-8

Router 3: EdgeRouter Lite

Advertisements