2

I'm struggling with IPSec while trying to configure to a Windows server. I need to use IPSec only in the 172.30.1.0/24 network.

Linux Settings

Running in AWS EB 4.4.15-25.57.amzn1.x86_64 GNU/Linux, I did sudo yum install openswan and put the 2 files:

(pay attention to the leftand rightparameters as I'm not sure what to do there, I want all the traffic inside that subnet encrypted)

/etc/ipsec.config

version 2.0     # conforms to second version of ipsec.conf specification

# basic configuration
config setup
    protostack=netkey
    nat_traversal=yes
    virtual_private=%v4:172.30.1.0/24
    plutoopts="--perpeerlog"

conn aws-vpc
    authby=secret
    auto=start
    type=tunnel
    pfs=yes
    left=%any
    leftsubnet=172.30.1.0/24
    right=%any
    rightsubnet=172.30.1.0/24
    ike=aes256-sha1;modp2048
    phase2=esp
    phase2alg=aes256-sha1;modp2048

/etc/ipsec.secrets

%any %any : PSK "---long key here---"

To try it, I'm doing a PING to the Windows server and it's not working (but it does work from the other Windows server)

Windows Settings

This is configured in 2 computers and working

Windows Encryption

Windows Encryption type

Subnet info

PSK

  • left should be the name or IP of your IPSEC server; is not it ipsec.conf? I think 3DES is deprecated by now, it should be AES. For Windows clients with encryption and without a certificate, you also need a regedit key. I usually try to deal in the Windows side with the native VPN client and not complicate much the thing ; if using it I recommend IKEv2 with a certificate. I also preferred to deal with strongswan rather then openswan a couple of month ago, can't remember the reasons from the top of my head. – Rui F Ribeiro Oct 19 '16 at 7:47
  • Thanks @RuiFRibeiro, but what's the IPServ server? I don't have a server by itself, just 2 computers. – Diego Jancic Oct 19 '16 at 12:27
  • The ipsec server is your AMI box that gives the service to the Windows box. I suspect you are following an old tutorial. How old is the page/instructions you are following? – Rui F Ribeiro Oct 19 '16 at 13:12
  • better yet, post the url here please – Rui F Ribeiro Oct 19 '16 at 17:07
  • I was using several pages, for example: linux.die.net/man/5/ipsec.conf. For now I put it in a subnet that doesn't require IPSec. – Diego Jancic Oct 19 '16 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.