IPSec VPN Setup

#!/bin/bash
# Site-to-site VPN setup script for Ubuntu 22.04 with FortiGate firewall using IPsec
# This script sets up the required IPsec configurations, firewall rules, and port forwarding.

# Define IP addresses and ranges
PUBLIC_IP="101.46.51.126"
PRIVATE_IP="192.168.0.95"
FORTIGATE_PUBLIC_IP="185.109.177.249"
FORTIGATE_INTERNAL_IPS="172.16.2.0/24,172.16.3.0/24,172.16.4.0/24,172.16.5.0/24,172.16.6.0/24,172.16.7.0/24,172.16.8.0/24"
TARGET_IP="192.168.220.10"
PSK="P@ssw0rd!@#$"

# Ensure the script is run as root
if [ "$(id -u)" -ne 0 ]; then
  echo "This script must be run as root."
  exit 1
fi

# Install necessary packages
install_packages() {
  echo "Installing necessary packages..."
  apt-get update
  apt-get install -y libreswan iptables-persistent
}

# Configure IPsec
configure_ipsec() {
  echo "Configuring IPsec for site-to-site VPN..."

  # Create IPsec configuration
  cat > /etc/ipsec.conf <<EOF
config setup
  virtual-private=%v4:${PRIVATE_IP}/24,%v4:${FORTIGATE_INTERNAL_IPS}
  nat-traversal=yes
  protostack=netkey
  interfaces=%defaultroute

conn site-to-site
  authby=secret
  auto=start
  type=tunnel
  ike=aes256-sha1;modp1024
  phase2alg=aes256-sha1;modp1024
  left=${PUBLIC_IP}
  leftid=${PUBLIC_IP}
  leftsubnet=${PRIVATE_IP}/24
  right=${FORTIGATE_PUBLIC_IP}
  rightsubnet=${FORTIGATE_INTERNAL_IPS}
  pfs=yes
EOF

  # Create IPsec secrets
  cat > /etc/ipsec.secrets <<EOF
${PUBLIC_IP} ${FORTIGATE_PUBLIC_IP} : PSK "${PSK}"
EOF

  # Restart IPsec to apply configurations
  systemctl restart ipsec
  echo "IPsec configuration completed."
}

# Configure port forwarding for UDP port 514
setup_port_forwarding() {
  echo "Setting up port forwarding for UDP port 514..."
  iptables -t nat -A PREROUTING -d ${PUBLIC_IP} -p udp --dport 514 -j DNAT --to-destination ${TARGET_IP}:514
  iptables -A FORWARD -p udp -d ${TARGET_IP} --dport 514 -j ACCEPT
  netfilter-persistent save
}

# Enable IP Forwarding
enable_ip_forwarding() {
  echo "Enabling IP forwarding..."
  sysctl -w net.ipv4.ip_forward=1
  echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/99-ipforward.conf
}

# Main function to control the script flow
main() {
  echo "Starting the IPsec VPN setup on Ubuntu 22.04 for FortiGate compatibility"
  install_packages
  configure_ipsec
  enable_ip_forwarding
  setup_port_forwarding
  echo "Site-to-site VPN setup is complete."
}

main