RPi as VPN Gateway

Question

I have been trying to setup a Raspberry Pi as a "Gateway" to my VPN server, even though I am not a sysadmin, I am usually fine with setting up software such as NGiNX however this has taken a lot of time and yielded no results hence my post.

The VPN server is powered by StrongSwan with IKEv2, testing it with the Windows VPN client was okay, everything worked (authentication is done using PKI, more specifically through a .p12 file).

This is a brief diagram of what I am trying to accomplish:

(192.168.2.x addresses are assigned via DHCP, 1.x and 3.x are manual just to make it easier to see what is what.)

From what I gathered, making devices use the VPN via the RPi could be as simple as changing the default gateway to the IP address of the Raspberry Pi. If my assumption is correct then all I would need to do is setup the Pi to forward ALL traffic it receives to the VPN.

I have tried many tutorials from various websites however I could not find a configuration file that would work. The RPi is running Raspbian 9 (stretch) with openswan installed on it.

The problem seems pretty trivial however I could not find answers on how to solve it and am sure that there are other people who would like to achieve the same effect.

I would appreciate if someone could create a step-by-step guide that would fit this specific use case (Raspbian 9, all traffic, PKI authentication, IKEv2).

Many thanks

Answer 1

I'm not sure that I fully understand your question as it relates to your diagram but I just recently setup a RPi as a VPN gateway that allows me to access networks at multiple sites. I am using OpenVPN but the principle should be the same for IKEv2. Since I'm not sure I understand your implementation, I will elaborate on mine and we can continue if it seem relevant. Each of my remote sites is running an OpenVPN server on a Smart NAS box and each has a unique subnet in the 192.168.x.x range. I use the RPi as a client to connect to each OpenVPN server simultaneously. I then creating a routing table on the RPi to route each subnet through it's specific VPN connection, ie, 192.168.1.x >> tun01, 192.168.2.x >> tun02. Finally, on the main office router I created a NAT entry to route all 192.168.x.x traffic to the RPi. The end result is that from any system in the central office, I can reach any system at the remote locations while all traffic outside of the 192.168.x.x range is unaffected.