IPsec: two offices, one untrusted network between them

The idea

IPsec has two routers agree on keys (IKE) and then encrypt whatever their policy selects (ESP), so the ISP between two offices sees only sealed packets: a site to site tunnel. officeRouter and branchRouter build it across ispRouter, so alice in the office reaches fileServer in the branch.

Steps

1. Without the tunnel: the ISP reads everything

   Before sealing anything, see what an ISP in the middle can read without it. alice, in the office, and fileServer, in the branch, are joined across an ISP, with no tunnel yet. ispRouter records what passes.

   alice:~# curl -s http://fileServer.lab/payroll.csv

2. IKE: the routers agree on keys

   Before encrypting anything, the two routers must share keys, over the very line the ISP listens on. IKE (Internet Key Exchange) does it. swanctl drives strongSwan, the IPsec program on both routers.

   officeRouter:~# swanctl --initiate --child sites
   officeRouter:~# swanctl --list-sas