OpenWrt Router und IPsec iptables

config defaults
	option syn_flood '1'  
	option forward 'REJECT'  
	option input 'ACCEPT'  
	option output 'ACCEPT'  

config zone
	option name 'lan'  
	option input 'ACCEPT'  
	option output 'ACCEPT'  
	option forward 'ACCEPT'  
	option network 'lan'  

config zone
	option name 'wan'  
	option input 'REJECT'  
	option output 'ACCEPT'  
	option forward 'REJECT'  
	option masq '1'  
	option mtu_fix '1'  
	option network 'wan'  

config rule
	option name 'Allow-DHCP-Renew'  
	option src 'wan'  
	option proto 'udp'  
	option dest_port '68'  
	option target 'ACCEPT'  
	option family 'ipv4'  

config rule
	option name 'Allow-Ping'  
	option src 'wan'  
	option proto 'icmp'  
	option icmp_type 'echo-request'  
	option family 'ipv4'  
	option target 'ACCEPT'  

config rule
	option name 'Allow-IGMP'  
	option src 'wan'  
	option proto 'igmp'  
	option family 'ipv4'  
	option target 'ACCEPT'  

config rule
	option name 'Allow-DHCPv6'  
	option src 'wan'  
	option proto 'udp'  
	option src_ip 'fc00::/6'  
	option dest_ip 'fc00::/6'  
	option dest_port '546'  
	option family 'ipv6'  
	option target 'ACCEPT'  

config rule
	option name 'Allow-MLD'  
	option src 'wan'  
	option proto 'icmp'  
	option src_ip 'fe80::/10'  
	list icmp_type '130/0'  
	list icmp_type '131/0'  
	list icmp_type '132/0'  
	list icmp_type '143/0'  
	option family 'ipv6'  
	option target 'ACCEPT'  

config rule
	option name 'Allow-ICMPv6-Input'  
	option src 'wan'  
	option proto 'icmp'  
	list icmp_type 'echo-request'  
	list icmp_type 'echo-reply'  
	list icmp_type 'destination-unreachable'  
	list icmp_type 'packet-too-big'  
	list icmp_type 'time-exceeded'  
	list icmp_type 'bad-header'  
	list icmp_type 'unknown-header-type'  
	list icmp_type 'router-solicitation'  
	list icmp_type 'neighbour-solicitation'  
	list icmp_type 'router-advertisement'  
	list icmp_type 'neighbour-advertisement'  
	option limit '1000/sec'  
	option family 'ipv6'  
	option target 'ACCEPT'  

config rule
	option name 'Allow-ICMPv6-Forward'  
	option src 'wan'  
	option dest '*'  
	option proto 'icmp'  
	list icmp_type 'echo-request'  
	list icmp_type 'echo-reply'  
	list icmp_type 'destination-unreachable'  
	list icmp_type 'packet-too-big'  
	list icmp_type 'time-exceeded'  
	list icmp_type 'bad-header'  
	list icmp_type 'unknown-header-type'  
	option limit '1000/sec'  
	option family 'ipv6'  
	option target 'ACCEPT'  

config rule
	option name 'Allow-ESP-input'  
	option proto 'esp'  
	option target 'ACCEPT'  
	option src 'dmz'  
	option family 'ipv4'  

config rule
	option name 'Allow-IKE-input'  
	option dest_port '500 4500'  
	option proto 'udp'  
	option target 'ACCEPT'  
	option src 'dmz'  
	option family 'ipv4'  

config zone
	option network 'dmz'  
	option name 'dmz'  
	option input 'ACCEPT'  
	option forward 'ACCEPT'  
	option output 'ACCEPT'  
	option family 'ipv4'  

config rule
	option dest_port '53'  
	option src 'dmz'  
	option name 'dmz-dns'  
	option target 'ACCEPT'  
	list proto 'tcp'  
	list proto 'udp'  
	option family 'ipv4'  

config rule
	option src 'dmz'  
	option name 'dmz-dhcp'  
	option target 'ACCEPT'  
	list proto 'udp'  
	option dest_port '68'  
	option family 'ipv4'  

config forwarding
	option dest 'wan'  
	option src 'lan'  

config forwarding
	option dest 'wan'  
	option src 'dmz'  

config include
	option path '/etc/firewall.user'  

connections {
    lan-passthrough {
        children {
            lan-passthrough {
                local_ts = 192.168.1.0/24 # Replace with your LAN subnet
                remote_ts = 192.168.1.0/24 # Replace with your LAN subnet
                priority = 1
                mode = pass
                start_action = trap
            }
        }
    }
    pp {
        unique = never
        version = 2
        keyingtries=0
        dpd_delay = 300s
        rekey_time = 0
        encap = yes
        proposals = aes256-sha256-modp2048
        vips = 0.0.0.0
        send_cert = never
        send_certreq = yes
        local_addrs = 192.168.1.1 # Replace with your default Router IP address
        remote_addrs = <PP Server IP> # Replace with your PP Server IP

        local {
            id = 192.168.1.1 # Replace with your default Router IP address
            auth = eap-mschapv2
            eap_id = Username # Replace with your PP-Username
        }
        remote {
            id = %any
            auth = pubkey
        }
        children {
            pp {
                dpd_action = start
                close_action = start
                inactivity = 36000s
                life_time = 0
                esp_proposals = aes256-sha256
                updown = /etc/swanctl/updown.sh
                remote_ts = 0.0.0.0/0
                priority = 1
                mode = tunnel
                start_action = start # "none" is for manual start, or use "start" for autostart 
            }
        }
    }
} # connections
secrets {
    eap-user {
        id = Username # Replace with your PP-Username
        secret = "Password" # Replace with your "PP-Password"   
    }
} # secrets

config rule
	option name 'Allow-ESP-input'  
	option proto 'esp'  
	option target 'ACCEPT'  
	option src 'dmz'  
	option family 'ipv4'  

config rule
	option name 'Allow-IKE-input'  
	option dest_port '500 4500'  
	option proto 'udp'  
	option target 'ACCEPT'  
	option src 'dmz'  
	option family 'ipv4'  

config rule
	option name 'Allow-ESP-input'  
	option src 'wan'  
	option proto 'esp'  
	option target 'ACCEPT'  

config rule
	option name 'Allow-IKE-NATT-input'  
	option src 'wan'  
	option dest_port '500 4500'  
	option proto 'udp'  
	option target 'ACCEPT'  

right 37.48.94.1
rightsubnet 0.0.0.0/0

#!/bin/sh
set -o nounset
set -o errexit

# Interface
VTI_IFACE="vti0"  

case "$PLUTO_VERB" in  
up-client)
	iptables -t nat -A postrouting_wan_rule -s 192.168.1.0/24 -m policy --dir out --pol none -j SNAT --to-source "$PLUTO_MY_SOURCEIP"  
	
	echo "Creating tunnel interface $VTI_IFACE local $PLUTO_ME remote $PLUTO_PEER mode vti key 42"  
	ip tunnel add "$VTI_IFACE" local "$PLUTO_ME" remote "$PLUTO_PEER" mode vti  
	echo "Activating tunnel interface $VTI_IFACE"  
	ip link set "$VTI_IFACE" up  

	echo "Adding $PLUTO_MY_SOURCEIP to $VTI_IFACE"  
	ip addr add "$PLUTO_MY_SOURCEIP" dev "$VTI_IFACE"  

	echo "Disabling IPsec policy (SPD) for $VTI_IFACE"  
	sysctl -w "net.ipv4.conf.$VTI_IFACE.disable_policy=1"  

	DEFAULT_ROUTE="$(ip route show default | grep default | awk '{print $3}')"  
	echo "Identified default route as $DEFAULT_ROUTE"  
	echo "Adding route: $PLUTO_PEER via $DEFAULT_ROUTE dev $PLUTO_INTERFACE"  
	ip route add "$PLUTO_PEER" via "$DEFAULT_ROUTE" dev "$PLUTO_INTERFACE"  
	;;
down-client)
	iptables -t nat -F postrouting_wan_rule

	echo "Deleting interface $VTI_IFACE"  
	ip tunnel del "$VTI_IFACE"  

	echo "Deleting route for $PLUTO_PEER"  
	ip route del "$PLUTO_PEER"  
	;;
esac

opkg install strongswan-full ip-full vti kmod-ip-vti kmod-ip6-vti