Relution Shield (Add-on)

Relution Shield enables secure access to the organisation’s internal intranet from the internet and combines Virtual Private Network (VPN), Public Key Infrastructure (PKI) and UEM - MDM. Further information: Relution Shield →.

Upgrading from Relution Shield 1.x? See Update from 1.x to 2.x →

Prerequisites

Relution Server

The existing Relution application server on which Relution Shield is configured and VPN profiles for end devices are managed.

Relution Server (version 5.26+)
One target organization on the server with Relution Shield license

Relution Shield Server

A separate server on which Relution Shield is installed as the VPN component.

Ubuntu 22.04+ (check version: lsb_release -a)
UDP ports 500 and 4500 must be available and reachable from the internet (configured in step 5 of the firewall setup, check status: sudo ufw status verbose)
Outgoing traffic to all targets which should be protected by Relution Shield
Outgoing traffic via HTTPS to Relution server
The Relution Shield server MUST be available from the internet
Recommended: public DNS entry

Prepare Relution

Set up a technical user and create an API access key

Create a new permission role with the Relution Shield Access Check permission
Create a new non-password user in the target organisation
Assign the role to the user
Create an API access key for the user
Configuring the technical user in the Global organisation allows the Relution Shield Server to check access for all organisations of the Relution Server (Requires Relution Shield 2.0 or higher)

Relution Shield Server

Required parameters

Relution Host: Host name of the Relution server, e.g. yourserver.eu.relution.io
Relution API key: See previous step (user creation →)
VPN CIDR: The private IP address range from which Relution Shield assigns an internal IP address to connected devices, e.g. 10.1.0.0/16. This range must not overlap with the existing network.
Network interface: Name of the network interface to use for Relution Shield, e.g. eth0
Relution Shield Host: Host name of Relution Shield, e.g. vpn.yourserver.eu.relution.io
DNS Servers: The IP addresses of the internal DNS servers in the network, e.g. 10.1.0.1,10.1.0.2. These are communicated to connected devices so that internal hostnames (e.g. intranet resources) can be resolved. If no internal DNS server is available, public DNS servers (e.g. 8.8.8.8) can be used — however, internal hostnames will not be resolvable in that case.

Installation

The installation of Relution Shield is demanding and requires attention and time. Also pay attention to variables that need to be set. Check the commands and configurations before saving them.

Run sudo apt update && upgrade
Install Docker including docker compose: https://docs.docker.com/engine/install/ubuntu/ (Do not install via snap)
Create install directory and compliance directory
```
mkdir -p /opt/relution-shield/compliance
```
Create environment file /opt/relution-shield/.env – replace <%Relution Host%> with the actual hostname, e.g. RELUTION_HOSTNAME=mdm.mydomain.com
```
touch /opt/relution-shield/.env
vi /opt/relution-shield/.env
```
```
RELUTION_HOSTNAME=<%Relution Host%>
RELUTION_REST_API_ACCESS_TOKEN=<access token generated above>
```
If the API access token belongs to Global organisation, enable access check for all organisations of the Relution Server (Requires Relution Shield 2.0 or higher):
```
   RELUTION_ACCESS_CHECK_SCOPE=global
```

Configure Ubuntu firewall ufw

Change default forward policy in /etc/default/ufw to DEFAULT_FORWARD_POLICY="ACCEPT"
```
vi /etc/default/ufw
```
Allow SSH and required UDP ports
```
ufw allow ssh
ufw allow 500,4500/udp
```

Adjust /etc/ufw/before.rules. Add the following lines at the start of the file, before the required lines containing *filter (make sure to replace <%VPN CIDR%> and <%Network interface%> - each value 3 times):

vi /etc/ufw/before.rules

# Relution Shield additional rules
*nat
-A POSTROUTING -s <%VPN CIDR%> -o <%Network interface%> -m policy --pol ipsec --dir out -j ACCEPT
-A POSTROUTING -s <%VPN CIDR%> -o <%Network interface%> -j MASQUERADE
COMMIT

*mangle
-A FORWARD --match policy --pol ipsec --dir in -s <%VPN CIDR%> -o <%Network interface%> -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
COMMIT

# Don't delete these required lines, otherwise there will be errors
*filter
...

Adjust /etc/ufw/before.rules. Add the following lines at the start of the file, after the required lines containing *filter (make sure to replace <%VPN CIDR%>):

...
# End required lines

# Relution Shield additional rules
-A ufw-before-forward --match policy --pol ipsec --dir in --proto esp -s <%VPN CIDR%> -j ACCEPT
-A ufw-before-forward --match policy --pol ipsec --dir out --proto esp -d <%VPN CIDR%> -j ACCEPT

Adjust /etc/ufw/sysctl.conf, add the following lines at the end:

vi /etc/ufw/sysctl.conf

# Relution Shield IPv4 forwarding kernel configuration
net/ipv4/ip_forward=1
net/ipv4/conf/all/accept_redirects=0
net/ipv4/conf/all/send_redirects=0
net/ipv4/ip_no_pmtu_disc=1

Restart Ubuntu Firewall
```
ufw disable && ufw enable
```

Prepare configuration of Relution Shield

Create required certificates and keys (make sure to replace <%Relution Shield Host%>)

cd /opt/relution-shield
# Create mounted directories
mkdir -v -p pki/{cacerts,certs,private}
docker run -ti --volume "$(pwd)/pki:/opt/pki" relution/relution-shield:latest bash

# Now in docker container
cd /opt

# Create CA private key
pki --gen --type rsa --size 4096 --outform pem > pki/private/ca-key.pem

A line is displayed in the terminal (plugin ‘tpm’: failed to load…), which indicates a missing TPM plugin. This message can be ignored. This is not an error.

# Create certificate
pki --self --ca --lifetime 3650 --in pki/private/ca-key.pem \
    --type rsa --dn "CN=ca.<%Relution Shield Host%>" --outform pem > pki/cacerts/ca-cert.pem

# Generate server key, signed by the CA
pki --gen --type rsa --size 4096 --outform pem > pki/private/server-key.pem

# Generate certificate, signed by the CA
pki --pub --in pki/private/server-key.pem --type rsa \
    | pki --issue --lifetime 1825 \
        --cacert pki/cacerts/ca-cert.pem \
        --cakey pki/private/ca-key.pem \
        --dn "CN=<%Relution Shield Host%>" --san "<%Relution Shield Host%>" \
        --flag serverAuth --flag ikeIntermediate --outform pem \
    >  pki/certs/server-cert.pem

# Prepare Key Pair archive, will be needed for Relution later
openssl pkcs12 -export -out "pki/ca.<%Relution Shield Host%>.p12" -inkey pki/private/ca-key.pem -in pki/cacerts/ca-cert.pem

# Exit the docker container
exit

The Certification Authority (CA) private key needs to be stored securely, as its theft would compromise the VPN Public Key Infrastructure (PKI).

Move the certificate files to the appropriate places

mkdir -v -p /opt/relution-shield/etc/swanctl/{x509,x509ca,private}
mv pki/cacerts/ca-cert.pem /opt/relution-shield/etc/swanctl/x509ca/ca-cert.pem
mv pki/private/server-key.pem /opt/relution-shield/etc/swanctl/private/server-key.pem
mv pki/certs/server-cert.pem /opt/relution-shield/etc/swanctl/x509/server-cert.pem

Create configuration file /opt/relution-shield/etc/strongswan.conf

Show full configuration example

# strongswan.conf - strongSwan configuration file
#
# Refer to the strongswan.conf(5) manpage for details
#
# Configuration changes should be made in the included files

charon {
    load_modular = yes

    threads = 64

    start-scripts {
        creds = swanctl --load-creds
        conns = swanctl --load-conns
        pools = swanctl --load-pools
    }

    processor {
        priority_threads {
          high = 2
          medium = 8
        }
    }

    filelog {
        stdout {
            default = 0
            enc = 0
        }
    }

    plugins {
        include strongswan.d/charon/*.conf

        bypass-lan {
            interfaces_use = lo
        }
    }
}

Create configuration file /opt/relution-shield/etc/swanctl/swanctl.conf (make sure to replace <%Relution Shield Host%>, <%VPN CIDR%>, <%Relution Host%> and <%DNS Servers%>)

Show full configuration example

relution-shield-default {
    version = 2
    dpd_delay = 0s
    send_cert = always
    encap = yes
    # Listen on all interfaces for incoming connections
    local_addrs = 0.0.0.0
    proposals = chacha20poly1305-sha512-curve25519-prfsha512,aes256gcm16-sha384-prfsha384-ecp384,aes256-sha384-modp4096,aes256-sha256-modp4096,aes256-sha384-ecp384,aes256-sha256-ecp384,aes256-sha256-ecp256
    pools = relution-shield
    children {
        child {
            start_action = none
            esp_proposals = chacha20poly1305-sha512,aes256gcm16-ecp384,aes256-sha256,aes256-sha384-modp4096,aes256-sha256-modp4096,aes256-sha384-ecp384,aes256-sha256-ecp384,aes256-sha256-ecp256
            # Server can route all traffic, including internet-bound
            local_ts = 0.0.0.0/0
            # Accept client's dynamically assigned IP
            remote_ts = dynamic
            # Ensures reconnection when the client is reachable again
            dpd_action = restart
            updown = /usr/libexec/ipsec/_updown iptables
        }
    }
    local {
        auth = pubkey
        certs = server-cert.pem
        id = <%Relution Shield Host%>
    }
    remote {
        auth = eap-tls
        eap_id = %any
        id = "*@<%Relution Host%>"
        cacerts = ca-cert.pem
    }
}

connections {
    relution-shield-eaptls : relution-shield-default {
        remote {
            id = "*@<%Relution Host%>"
        }
    }
    relution-shield-eaptls-windows : relution-shield-default {
        remote {
            id = "%any"
        }
    }
}

pools {
   relution-shield {
        addrs = <%VPN CIDR%>
        dns = <%DNS Servers%>
    }
}

secrets {
    private {
        file = "server-key.pem"
    }
}

Install Relution Shield via docker

Create /opt/relution-shield/compose.yml

services:
  relution-shield:
    image: relution/relution-shield:2-latest
    restart: unless-stopped
    privileged: true
    cap_add:
      - NET_ADMIN
      - NET_RAW
      - SYS_MODULE
    network_mode: host
    ports:
      - "500:500/udp"
      - "4500:4500/udp"
    environment:
      RELUTION_HOSTNAME: ${RELUTION_HOSTNAME}
      RELUTION_REST_API_ACCESS_TOKEN: ${RELUTION_REST_API_ACCESS_TOKEN}
      RELUTION_ACCESS_CHECK_SCOPE: ${RELUTION_ACCESS_CHECK_SCOPE}
    volumes:
      - "./etc/swanctl:/etc/swanctl:ro"
      - "./etc/strongswan.conf:/etc/strongswan.conf:ro"
      - "./compliance:/opt/strongswan/compliance"

If Relution Shield 1.x is used, RELUTION_REST_API_ACCESS_TOKEN needs to be replaced by REST_API_ACCESS_TOKEN.

Start Relution Shield in /opt/relution-shield via docker compose up -d

Automatically restart Relution Shield after network daemon restart (e.g. after auto-updates), create /etc/systemd/system/relution-shield-networkd-post-restarter.service

[Unit]
Requires=systemd-networkd.service
After=systemd-networkd.service network-online.target

[Service]
Type=oneshot
ExecStart=docker compose -f /opt/relution-shield/compose.yml restart
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

Start the service via systemctl enable relution-shield-networkd-post-restarter --now

Environment Variables

The following environment variables can be used to configure Relution Shield.

Environment Variable	Description	Values	required	Availability
`RELUTION_HOSTNAME`	Host name of Relution server, e.g. `yourserver.eu.relution.io`		yes	1.0.0
`RELUTION_REST_API_ACCESS_TOKEN`	API token used to access Relution (Relution Shield 1.x.y: `REST_API_ACCESS_TOKEN`)		yes	2.0.0
`RELUTION_ACCESS_CHECK_SCOPE`	Access check scope	`global` / `local`	no (Default: `local`)	2.0.0
`RELUTION_SERVER_NOT_REACHABLE_ALLOW_DEVICE`	Allow connections for valid certificates if Relution cannot be reached to perform compliance checks	`true` / `false`	no (Default: `true`)	26.0.0
`DEVICE_STATE_CACHE_DURATION_MINUTES`	How long the device state is cached before retrieving it from Relution again	Number	no (Default: `1`)	1.0.0

Configure Relution

Certificate Setup

Import the certificates into the target organsiation
1. Navigate to Settings → Certificates
2. Upload the certificate at /opt/relution-shield/etc/swanctl/x509ca/ca-cert.pem and give it a name like <%Relution Shield Host%> CA Certificate
3. Upload the certificate at /opt/relution-shield/etc/swanctl/x509/server-cert.pem and give it a name like <%Relution Shield Host%> Server Certificate
4. Upload the PKCS12 archive at /opt/relution-shield/pki/ca.<%Relution Shield Host%>.p12 and give it a name like <%Relution Shield Host%> CA Key Pair
5. Backup the contents of /opt/relution-shield/pki/ securely, and remove the folder
Create certificate authority and certificate template
1. Navigate to Settings → Certificate Authorities
2. Add a new certificate authority with type Built-in and select the <%Relution Shield Host%> CA Key Pair certificate uploaded before
3. Navigate to Settings → Certificate Templates
4. Add a new certificate template
  1. Select the certificate authority created before
  2. Set Subject Name to CN=${device.uuid}@<%Relution Host%> (Note the CN= at the beginning)
  3. In the Certificate Key Usage field, enable Signature and Key encryption
  4. Add a Subject Alternative Name of type Email with ${device.uuid}@<%Relution Host%> (No CN= at the beginning)
    Confirm the entered value by pressing Enter
  5. Enable automatic renewal and set appropriate values, e.g. 60 days and 180 days

Sample iOS configuration

Create a new iOS policy or extend an existing one
Add a VPN configuration
1. Select type IKEv2
2. Enable Per App and Account VPN ( see also Relution Hub Docs → )
3. Set Server and Remote identifier to the value of <%Relution Shield Host%>
4. Set Local identifier to ${device.uuid}@<%Relution Host%>
5. Set Machine authentication to Certificate and select the certificate template created before
6. Acvivate Enable extended authentication (EAP)
7. Set both IKE SA params and Child SA params to AES-256, SHA-256, DH group 16: 4096-bit group, 1440 minutes
8. Optional: Add a test domain to Safari Domains below to automatically activate the VPN when the domain is accessed via Safari
Add a Certificate configuration to the policy and select the <%Relution Shield Host%> CA Certificate uploaded before
Optionally add a App to VPN Mapping configuration and select the VPN configuration created before and another browser app like Firefox or Chrome to test VPN access. It is recommended to also add an app compliance with this app as required to ensure it is installed
Publish the policy, and assign it to a device. The VPN can now be manually connected via Settings → General → VPN & Device Management → VPN. Relution Shield will also automatically be connected when accessing the Safari domains configured above in Safari or opening the browser app
Adjust the configuration according to include the accounts, apps and domains which should only be accessed via Relution Shield

Sample Android Enterprise configuration

Crate a new Android Enterprise policy or extend an existing one
Add a StrongSwan VPN Profile configuration
1. Select IKEv2 EAP-TLS as VPN Type
2. Set Server and Server identity to the value of <%Relution Shield Host%>
3. Set User Certificate to the certificate template generated before
4. Set CA certificate to the <%Relution Shield Host%> CA Certificate uploaded before
5. Set Client identity to ${device.uuid}@<%Relution Host%>
6. Set Only these Apps will use the VPN to a browser like Firefox
Add a StrongSwan VPN Restrictions configuration and select the VPN profile created before as the default profile
Publish the policy, and assign it to a device. The VPN can now be manually connected via the StrongSwan app. Relution Shield will also automatically be connected when opening the browser app configured before
Adjust the configuration according to include the apps which should only be accessed via Relution Shield

Major Upgrades

Upgrade from 1.x to 2.x

Securely store the CA private key /opt/relution-shield/etc/ipsec.d/private/ca-key.pem outside the Relution Shield server if not already done.

Stop Relution Shield in /opt/relution-shield via docker compose down

Create/adjust the following files as described in the installation instructions:

Create new config folders

mkdir -v -p /opt/relution-shield/etc/swanctl/{x509,x509ca,private}

Create etc/swanctl/swanctl.conf → see step 6.4 of the installation
Replace contents of /opt/relution-shield/compose.yml → see step 7.1 of the installation
Update /opt/relution-shield/.env → see step 4 of the installation
Update /opt/relution-shield/etc/strongswan.conf → see step 6.3 of the installation
Move the following files

Previous path	Target path
`/opt/relution-shield/etc/ipsec.d/cacerts/ca-cert.pem`	`/opt/relution-shield/etc/swanctl/x509ca/ca-cert.pem`
`/opt/relution-shield/etc/ipsec.d/certs/server-cert.pem`	`/opt/relution-shield/etc/swanctl/x509/server-cert.pem`
`/opt/relution-shield/etc/ipsec.d/private/server-key.pem`	`/opt/relution-shield/etc/swanctl/private/server-key.pem`

Remove the /opt/relution-shield/etc/ipsec.d directory
Remove /opt/relution-shield/etc/ipsec.conf
Remove /opt/relution-shield/etc/ipsec.secrets
Start Relution Shield in /opt/relution-shield via docker compose up -d

Customer Hub

Relution Shield (Add-on)

Prerequisites #

Relution Server #

Relution Shield Server #

Prepare Relution #

Set up a technical user and create an API access key #

Relution Shield Server #

Required parameters #

Installation #

Environment Variables #

Configure Relution #

Certificate Setup #

Sample iOS configuration #

Sample Android Enterprise configuration #

Major Upgrades #

Upgrade from 1.x to 2.x #

Prerequisites

Relution Server

Relution Shield Server

Prepare Relution

Set up a technical user and create an API access key

Relution Shield Server

Required parameters

Installation

Environment Variables

Configure Relution

Certificate Setup

Sample iOS configuration

Sample Android Enterprise configuration

Major Upgrades

Upgrade from 1.x to 2.x