Prerequisites
- SECRET_KEY - replace with your generated secret preshared key
- NordLayerIP - replace with the IP of your NordLayer server with a dedicated IP
- YourIP - replace with your public static IP
- LocalSubnet - replace with the IP of your local subnet
Note:
Before setting up site-to-site, make sure you have all the dependencies on your Linux server. You can do that by running the following command:
sudo apt-get update && apt-get upgrade
Also, you will need to have the following packages:
sudo apt-get install strongswan libcharon-extra-plugins
For Arch-based distributions and others, you might not have libcharon packages, as they are in the strongswan package. You can simply run the following command and it will suffice:
pacman -S strongswan
Setting up Site-to-site client on Linux server
cat<<EOF>/etc/ipsec.secrets
YourIP NordLayerIP : PSK "SECRET_KEY"
EOF
cat<<EOF>/etc/ipsec.conf
config setup
charondebug="all"
uniqueids=yes
strictcrlpolicy=no
conn Nordlayer
authby=secret
left=YourIP
leftsubnet=LocalSubnet
right=NordLayerIP
rightsubnet=10.6.0.0/20
ike=aes256-sha256-modp2048
esp=aes256-sha256-modp2048
keyingtries=0
ikelifetime=1h
lifetime=8h
dpddelay=30
dpdtimeout=120
dpdaction=restart
auto=start
EOF
Add some iptable rules
/sbin/iptables -A INPUT -p esp -j ACCEPT
/sbin/iptables -A INPUT -p udp --dport 500 -j ACCEPT
/sbin/iptables -t nat -A POSTROUTING -s 10.6.0.0/20 -o InternalInterface -j MASQUERADE
/sbin/iptables net.ipv4.ip_forward = 1
*InternalInterface should correspond to your main network adapter - usually eth0
Ending note:
In order to finalize the site-to-site tunnel, please create a setup in Sites tab of the NordLayer Control Panel.
- Pre-shared key - you can generate it or we can provide it
- Encryption details (AES, SHA and DH group) - AES256, SHA256 and DH group 14 are recommended (also must support IKEv2)
- Remote gateway/router public IP (must be reachable while connected to the server with a dedicated IP)
- Remote subnet and mask (the subnet is used in your local network)
Note: In case you have any questions or issues, press 'Chat with support' at the bottom of the page.