Skip to main content

Connect branch offices and data centers: VPN Site-to-Site

Last update:
For your information

These are instructions for configuring the Selectel firewall when creating a Site-to-Site VPN tunnel between the data center and an external site, such as your office or another data center. The instructions cover IPsec configuration.

You will need to configure the equipment on the other side of the tunnel yourself according to the manufacturer's documentation. Before configuring, make sure that your equipment supports the IPsec protocol.

  1. Connect to the Selectel firewall.
  2. Configure the IKE first phase parameters for each device.
  3. Configure the IKE second phase parameters for each device.
  4. Configure permissive rules on the firewall for IPsec protocol operation.
  5. Raise the tunnel between the devices.

1. Connect to a Selectel firewall⁠

  1. Open the page in your browser:

    https://<ip_address>:5443

    Specify <ip_address> — The IP address of the firewall.

  2. Enter the login and password you received in the ticket after ordering the firewall. The main page of the graphical interface with the dashboard will open.

2. Set the parameters of the first phase of IKE⁠

Configure the settings on the Selectel firewall. On your equipment on the other side of the tunnel, you must set similar parameter values.

  1. In the VPN menu, go to the IPsec section.

  2. Open the Tunnels tab.

  3. Press Add P1.

  4. In the Key Exchange Version field, select the protocol version for key exchange — IKEv2.

  5. In the Internet Protocol field, select the Internet Protocol — IPv4.

  6. In the Interface field, select the network interface from which to build the tunnel.

  7. In the Remote Gateway field, enter the IP address of the remote device.

  8. In the Authentication Method field, select an authentication method:

    • Mutual PSK;
    • or Mutual Certificate and fill in the My Certificate and Peer Certificate Authority fields.

  9. In the My Identifier field, select the type and enter the ID of the device from which you are setting up the tunnel.

  10. In the Peer Identifier field, select the type and enter the ID of the remote device.

  11. In the Pre-Shared key field, enter the authentication code. This is used when setting up and connecting the remote device.

  12. In the Encryption Algorithm box, configure the encryption algorithm:

    12.1 Select AES in the Algorithm field.

    12.2 Select 256 bits in the Key Length field.

    12.3 In the HASH field, select — SHA512.

    12.4. In the DH Group field, select — 14.

  13. Click Save → Apply Changes.

3. Configure the parameters of the second phase of IKE⁠

Configure the settings on the Selectel firewall. On your equipment on the other side of the tunnel, you must set similar parameter values.

  1. In the VPN menu, go to the IPsec section.

  2. Open the Tunnels tab.

  3. Under the IKE Phase 1 row, click Show Phase 2 Entries.

  4. Click Add P2.

  5. In the Mode field, select Tunnel IPv4 mode.

  6. In the Local Network field, select Network as the type of local network behind the VPN gateway and enter the IP address of the local subnet.

  7. In the Remote Network field, select the type of remote network behind the VPN gateway -Network and enter the IP address of the remote subnet.

  8. In the Protocol field, select the protocol for protecting the transmitted data — ESP.

  9. In the Encryption Algorithm box, configure the encryption algorithm:

    9.1 Check the AES checkbox and select Key Length — 128 bits.

    9.2 Check the AES256-GCM checkbox and select Key Length — 128 bits.

  10. In the Hash Algorithms field, select the hash algorithm — SHA512.

  11. In the PFS Key Group field, select the parameters for additional encryption key protection — 14.

  12. Click Save → Apply Changes.

4. Configure permissive rules on the firewall⁠

Create an enabling rule for IPsec on the WAN and IPsec interfaces.

  1. On the Firewall menu, go to the Rules section.
  2. Open the WAN interface tab.
  3. Click Add.
  4. In the Action field, select the action when receiving or sending data packets — Pass.
  5. In the Interface field, select the network interface — IPsec.
  6. In the Source field, select the subnet that is the source of the network traffic.
  7. In the Destination field, select the destination address to which network traffic is allowed.
  8. Click Save.
  9. Click Add.
  10. In the Action field, select the action when receiving or sending data packets — Pass.
  11. In the Interface field, select the network interface — WAN.
  12. In the Source field, select the source of the network traffic.
  13. In the Destination field, select the destination address to which network traffic is allowed.
  14. Click Save.
  15. Drag the created rules above the prohibiting rules. Rules are executed in order from top to bottom in the list.
  16. Click Apply Changes.

5. Raise the tunnel between devices⁠

  1. On the Status menu, go to the IPsec section.
  2. Open the Overview tab.
  3. Press Coppest P1 and P2.