ElasticHosts Deployment Setup for VNS3

Video tutorial

Introduction

Requirements

  • You have an ElasticHosts account. (For Free ElasticHosts trials, visit https://www.elastichosts.com/free-trial/)

  • Ability to configure a client (whether desktop based or cloud based) to use OpenVPN client software.

  • You have a compliant IPsec firewall/router networking device:

Preferred: Most models from Cisco Systems, Juniper, Watchguard, Dell SONICWALL, Netgear, Fortinet,Barracuda Networks, Check Point, Zyxel USA, McAfee Retail, Citrix Systems, Hewlett Packard, D-Link,WatchGuard, Palo Alto Networks, OpenSwan, pfSense, and Vyatta.

Best Effort: Any IPsec device that supports: IKE1 or IKE2, AES256 or AES128 or 3DES, SHA1 or MD5.

*Known Exclusions: Checkpoint R65+ requires native IPSec connections as Checkpoint does not conform to NAT-Traversal Standards and Cisco ASA 8.4(2)-8.4(4) bugs prevent a stable connection from being maintained.

Getting Help with VNS3

This guide covers a very generic VNS3 setup in an ElasticHosts cloud computing facility. If you are interested in more custom use cases and would like Cohesive to advise and help setup the topology, contact sales@cohesive.com for services pricing.

Please review the VNS3 Support Plans and Contacts before sending support inquiries.

Firewall Considerations

VNS3 Manager instances use the following TCP and UDP ports.

• UDP port 1194 For client VPN connections; network cal or hypervisor access rule for the VNS3 Manager must allow UDP port 1194 from all servers that will join
VNS3 topology as clients.

• UDP 1195-1197 For peering between VNS3 Manager peers; must be accessible from all peers in a given topology. Free Edition and Lite Edition will not require UDP ports 1195-1197 access as it is not licensed for Manager Peering (Single Manager Topologies).

• TCP port 8000 HTTPS admin interface; must be accessible from hosts where you will want to obtain runtime status or configure your VNS3 topology, also needs to be open to and from the managers at least for the peering process, and needs to be accessible when downloading credentials for installation on overlay network clients.

• UDP port 500, ESP Protocol and possibly UDP port 4500 IPsec connections to ElasticHosts support both native IPsec (UDP 500 and ESP Protocol 50) and NAT-Traversal encapsulation (UDP 500 and
UDP 4500).

Remote Support

VNS3 Remote Support

Note that TCP 22 (ssh) is not required for normal operations. Each VNS3 Manager is running a restricted SSH daemon, with access limited only to Cohesive for debugging purposes controlled by the user via the Remote Support toggle and key exchange generation.

In the event Cohesive needs to observe runtime state of a VNS3 Manager in response to a tech support request, we will ask you to open Security Group access to SSH from our support IP range and Enable Remote Support via the Web UI.

Cohesive will send you an encrypted passphrase to generate a private key used by Cohesive Support staff to access your Manager. Access to the restricted SSH daemon is completely controlled by the user. Once the support ticket has been closed you can disable remote support access and invalidate the access key.

Sizing Considerations

Image Size and Architecture

VNS3 Edition Manager Images (Free Edition and BYOL-UL) are available as 64bit images to allow the greatest flexibility for your use-case. We recommend Manager instances be launched with at least 1024MB of RAM. Smaller sizes are supported but the performance will depend on the use-case.

Clientpack Key Size

VNS3 Managers currently generate 1024 bit keys for connecting the clients to the overlay network via the “clientpacks”. Smaller or larger encryption keys can be provided upon request (from 64 bit to 2048 bit).

Future releases of VNS3 will provide the user control over key size and cipher during initialization and configuration.

ElasticHosts Deployment Setup

ElasticHosts Configuration: Select VNS3 Template

Login to your ElasticHosts account at the data center where you wish to run VNS3.

Below the “Control Panel” menu item there is a menu for “Add”. Click on “Add” and then select “Server (VM)”.

ElasticHosts - Select Template

The “Add Server (VM)” dialogue menu will pop up.

Give your targeted VNS3 instance a name and at least 1gig of memory and 10gig of disk. Choose a type of “Pre-installed system” and then click on the “Image” drop down menu.

You will find free and paid editions in the image listing.

ElasticHosts - Add Server

ElasticHosts Configuration: Public IP Access

In ElasticHosts, an instance can have a public IP on eth0 and a private VLAN IP on eth1. When you create a VLAN at ElasticHosts you don’t define a specific subnet mask. Clients launched with “eth1" connected to a VLAN must have addresses in the same subnet in their local configurations. This is very different than most cloud implementations - but incredibly flexible.

As a result, VNS3 can be used as an Internet Gateway, sitting at a private VLAN edge, providing NAT-ing and port forwarding for the other devices in the private VLAN.

EH instances can have dynamically assigned public IPs or static IPs. This choice is made at instance creation time.

Create an ElasticHosts Private VLAN

From the “Control panel” page, use the “Add” menu again, selecting “Private VLAN”.
ElasticHosts - private VLAN

On the “Control panel” page the selection will take you to a text box near a network graphic. The only configuration of the VLAN needed is to give it a “display name” for use when launching instances into it. In this example, the VLAN has been named “MyFavoriteVLAN”.

ElasticHosts - VLAN Name

Launch a VNS3 Manager

After creating your server your can then configure it.

ElasticHosts - Configure VLAN

On the server configuration page, you can set the display name of the instance.

You can select from your available static public IPs shown in the pop up menu, or choose “Dynamic IP - Assigned at Boot” to get a public IP that is not static.

In the lower right corner, there are “Advanced Options”. In this section, you pick the Private VLAN that you want to connect this VNS3 Manager instance to. In the section marked “VLAN” use the drop menu to pick the VLAN for use, in this case, “MyFavoriteVLAN”.

VNS3 Manager Log in

Login to the VNS3 Web UI - https://publicIP:8000 making sure to use https and change "publicIP" to your public IP allocated from ElasticHosts.

VNS3 login

Default username: vnscubed
Default password: vnscubed

Reset your passwords:

VNS3 - Reset Password

  • Reset the Web UI Password - Even though the instance id is unlikely to be “guessed”, please change it for security purposes.

  • NOTE: Your VNS3 Manager answers to API calls on the same port 8000 as the web interface runs on. Ideally, make a separate password for the API usage against the manager.

  • Reset the API Password - Even though the instance id is unlikely to be “guessed”,please change it for security purposes, again making it a different password than the web interface is probably best.

  • NOTE: Cohesive does not have any key access or remote access to your VNS3 Managers unless provided by you. If you forget these passwords we cannot recover them for you.

Configure VNS3 for the VLAN

Configure VNS3 for the VLAN

Before any other configuration steps of your VNS3 Manager, you can configure it for the ElasticHosts Private VLAN.

Select the “Private VLAN” menu item under the “Admin” section. (Remember - at ElasticHosts the VLAN is defined “collectively” by the addresses assigned to the instance in the VLAN.) Please note, the instances in the VLAN should be configured to be in the same subnet mask.

In this case, we are de facto making the VLAN a 192.168.10.0/24 subnet. This is done by setting an address for the VNS3 Manager’s private IP (192.168.10.1) and then setting a network mask for the entirety of the subnet (255.255.255.0, which translates to a /24).

Hit “Save and Reboot” and the VNS3 Manager will set up its internal “eth1” and reboot to properly initialize the interface and associated internal ACLs.

Configure ElasticHosts Hosts to use VNS3 as Internet Gateway

Configure hosts to use VNS3 as internet gateway

WARNING

Do not configure ElasticHosts VLAN hosts to use VNS3 as an Internet Gateway until the VNS3 instance is fully configured with Private VLAN settings and Firewall rules for NAT-ing installed. If you have public IPs temporarily assigned to your ElasticHosts VLAN hosts, and create a route to the VNS3 as the gateway to 0.0.0.0/0, you will most likely lose connectivity until the VNS3 configuration is complete, including port forwarding information to SSH or RDP into the VLAN host through the VNS3 Manager.

This following page describes the process for configuring ElasticHosts VLAN hosts: https://www.elastichosts.com/support/tutorials/set-up-a-vlan/

Here we show the first steps recommended by the ElasticHosts document above. In this case, the addresses used are based upon the addresses we used for the VNS3 Manager on the previous page “Configure VNS3 for the VLAN”.

After bringing up the “eth1” interface and configuring the network interface information, the networking can be restarted. In this instance, using Ubuntu, the command is the one used in the ElasticHosts documentation.

After the networking is restarted, an “ifconfig” command shows the instance has an “eth1” with the address of 192.168.10.2 as specified.

Configure VNS3 as Internet Gateway

In order to configure VNS3 as the Internet Gateway, the following Firewall rules need to be entered. (The example continues assuming the VLAN is 192.168.10.0/24)

# Allow traffic to/from the VLAN to this VNS3 Manager

INPUT_CUST -s 192.168.10.0/24 -j ACCEPT
OUTPUT_CUST -d 192.168.10.0/24 -j ACCEPT

# NAT traffic from theVLAN that is using this VNS3 Manager as Internet Gateway

MACRO_CUST -o eth0 -s 192.168.10.0/24 -d 0.0.0.0/0 -j MASQUERADE

# Port forward traffic to my 192.168.10.2 host

PREROUTING_CUST -i eth0 -p tcp -s 0.0.0.0/0 --dport 33 -j DNAT --to 192.168.10.2:22

Assuming your VLAN host is like the example, at 192.168.10.2, and is accessible via SSH, then the firewall is now configured to NAT traffic for any VLAN host configured to use it as the Internet Gateway, and shows how to port forward traffic into theVLAN through theVNS3 Manager.

Configure ElasticHosts Hosts Route to VNS3 Manager

The last step after all the previous are complete is to enter a route on the ElasticHosts VLAN host, pointing to the VNS3 Manager’s private ip as the gateway to the Internet.

On the ElasticHosts host enter:
ip route add 0.0.0.0/0 via 192.168.10.1

(The address 192.168.10.1 us used because in this example that is the VNS3 Manager private IP.)

You should now be able to reach Internet resources even without a public IP attached to the ElasticHosts host.

Depending on the operating system used in the cloud hosts, the route will need to be made persistent. This varies by operating system.

VNS3 Product Resources - Documentation | Add-ons

VNS3 Configuration Instructions

Instructions and screenshots for configuring aVNS3 Manager in a single or multiple Manager topology. Specific steps include, initializing a new Manager, generating clientpack keys, setting up peering, building IPsec tunnels, and connecting client servers to the Overlay Network.

VNS3 Administration Document

Covers the administration and operation of a configuredVNS3 Manager. Additional detail is provided around theVNS3 Firewall, all administration menu items, upgrade licenses, other routes, and SNMP traps.

VNS3 Docker Instructions

Explains the value of the VNS3 3.5 Docker integration and covers uploading, allocating and exporting application containers.

VNS3 Troubleshooting

Troubleshooting document that provides explanation issues that are more commonly experienced with VNS3.