Private IP address over IPSEC tunnel

Question

I have two dedicated servers that I have configured to require AH and ESP between their (public) IP addresses and using racoon I've set up isakmp. The IPsec tunnel between them is working well - I can see that all traffic between them is encrypted (that is, tcpdump shows only AH and ESP header no matter what kind of traffic I'm sending between them).

Now, I'm a little paranoid that at some point something could happen and the setkey service that configures my security policy could end up off on both servers. Or perhaps something happens and someone flushes the security policy. And then all my traffic between the servers is unencrypted for weeks or months before someone (hopefully) notices.

Question: What can I do to avoid ever having the traffic between these two servers work unencrypted?

My half-brained solution: One way I thought of accomplishing this was to assign each of them a private IP (let's say 192.168.0.1 and 192.168.0.2 to keep it simple) and then have all my applications that need to talk to the other server use those private IPs rather than the public IPs and then make it so that those private IPs are only routable when the IPsec tunnel is up.

Questions: Is this a feasible way to do this? Would I need GRE? Or could I do it with simple "ip route add 192.168.0.2/32 via [public ip 2] dev eth0" (from server 1)? Is it necessary? What's the best way to accomplish it?

Answer 1

The simplest way would be to install a firewall (either on the servers or in the path) that block any traffic destined for the other server that isn't protocol 50 (ESP) or UDP/500 (ISAKMP). It isn't clear why you would need AH, I am guessing you don't.

Having said that, using private addressing is always sensible for private services, though relying on routing is not a security mechanism.

In your IPSEC config you should have two settings related to traffic, one would be the gateway (which would be the other server in each case), and the other would be permitted traffic across the VPN, known as interested traffic. Currently this is your servers' public addresses, and you would change this to your private addresses.

To route the traffic, you just need to push it out of the right interface, it will match the interested traffic rules in the IPSEC config and get encrypted and sent to the gateway (the other server).

So this should suffice:

ip route add 192.168.0.2/32 dev eth0