0

I have created a network gateway on an Ubuntu server. It has 2 interfaces and forwards the traffic from one interface to another. One of the interfaces is connected with a pfsense firewall that connects to the internet and creates a tunnel with a corresponding pfsense firewall and a corresponding network gateway. Is there a way to encrypt all traffic going to pfsense and vice versa?

My topology:

LAN <--> Network Gateway <--> pfsense <-->tunnel<--> pfsense <--> Network Gateway <--> LAN

I want to know if there is a native way to encrypt/decrypt the traffic (something like a service), if not a native way some software (Open Source working on Linux) or if I need to write some script that will be working as a service.

4
  • Why would you want to encrypt the traffic between your gateway and pfsense? Is the specific network segment not trusted?
    – user284677
    Commented Aug 18, 2023 at 10:07
  • @Spyros The segment is trusted. I just want everything to be encrypted in case the VPN fails and loose the VPN encryption
    – Kostas
    Commented Aug 21, 2023 at 6:01
  • So you want a gateway to gateway VPN that will go through your pfsense vpn?
    – user284677
    Commented Aug 21, 2023 at 6:05
  • @Spyros Yes. I want to do a VPN over VPN. I was asked to create a double encrypted connection between the office and a remote location.
    – Kostas
    Commented Aug 22, 2023 at 5:24

2 Answers 2

1

You generally have three ways to secure traffic:

  1. Let the physical layer secure it via MACsec or similar. This should work in your scenario, if your components support it. It doesn't look like pfsense does, however.
  2. VPN, basically tunneling IP over IP, which is done by the hosts, independent of the physical layer.
  3. Protocol encryption with TLS or similar. Ensure that all traffic is secured by TLS. Each individual application requires appropriate configuration.

You're basically constrained to either VPN or protocol encryption given that your systems doesn't support macsec.

2
  • Thank you very much for your answer. Since I want the encryption/decryption to be done inside the Ubuntu gateways is there going to be a problem with pfsense? The network Gateways and the pfsense firewalls are different machines. The pfsense machines are creating a site-to-site VPN on their own. If I create a MACsec tunnel between the Gateways over the VPN tunnel am I going to have a problem?
    – Kostas
    Commented Aug 16, 2023 at 7:53
  • Then you're pretty much stuck with VPN.
    – vidarlo
    Commented Aug 16, 2023 at 9:26
0

Based on your clarification, you want to have a VPN tunnel going through the pfSense tunnel, something like this:

              pfSense tunnel 
            |----------------|
LAN -> GW <---- VPN tunnel ----> GW <- LAN
            |----------------|

A solution would be to setup a site-to-site OpenVPN tunnel between your gateways. See here and here for examples on how to do it. OpenVPN is usually included in Ubuntu servers, that's why it's an easy go-to solution. It can be configured to operate at both OSI layers 2 and 3.

However, you may want to also check whether IPSec suits your needs; see here for an example on how to do it. It operates at OSI layer 3.

No matter which one to use, though, keep in mind that the configuration is not straight forward; you need to configure appropriately your subnets and traffic rules, or you may encounter problems (e.g. for OpenVPN through pfSense).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .