1

I'm setting up IPSec VPN and I have met an error which upon searching I found the error actually means required kernel modules are missing. That prompted me to check that with lsmod and kmod list but both give an empty list.

That sounds to me like there is no loaded kernel module (sounds strange and unlikely to me but I have no other explanations) and so I need to load them in case they are there but not loaded or install them in case they are not there.

How do I do that?

I operate Debian 9 Box with Strongswan 5.1 as IPSec VPN Software

UPDATE

The error I get is this one

ipsec up conn-name
establishing CHILD_SA conn-name
generating CREATE_CHILD_SA request 937 [ SA No KE TSi TSr ]
sending packet: from <MY IP>[500] to <DEST IP>[500] (496 bytes)
received packet: from <DEST IP>[500] to <MY IP>[500] (352 bytes)
parsed CREATE_CHILD_SA response 937 [ N(ESP_TFC_PAD_N) SA No KE TSi TSr ]
received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
received netlink error: Protocol not supported (93)
unable to add SAD entry with SPI c845df8d
received netlink error: Protocol not supported (93)
unable to add SAD entry with SPI 009fbcd3
unable to install inbound and outbound IPsec SA (SAD) in kernel
failed to establish CHILD_SA, keeping IKE_SA
sending DELETE for ESP CHILD_SA with SPI c845df8d
generating INFORMATIONAL request 938 [ D ]
sending packet: from <MY IP>[500] to <DEST IP>[500] (80 bytes)
received packet: from <DEST IP>[500] to <MY IP>[500] (80 bytes)
parsed INFORMATIONAL response 938 [ D ]
establishing connection 'conn-name' failed

Output for: lsmod

#lsmod
Module                  Size  Used by

uname -a

Linux xxx 2.6.32-042stab127.2 #1 SMP Thu Jan 4 16:41:44 MSK 2018 x86_64 GNU/Linux

also cat /proc/modules is empty

Is this your own hardware, some virtualization

It is a VPS actually so I have no control over the hardware

  • 1
    It's good to downvote, but it is far better to say why so that the post can be improved. Downvoting without saying a word is counter-productive – Stefano Mtangoo May 15 at 20:26
  • 1
    can you add the error you're getting from Stronswan? I've never seen a completely empty lsmod output. Do you see any output from cat /proc/modules? – Tim Kennedy May 15 at 20:41
  • 1
    Completely empty lsmod output could indicate a shared kernel, one which you may not be able to change. Is this your own hardware, some virtualization, or some hosted service? If this is a hosted service, you may need to discuss with them what the limits of your service are, and they can possibly add the modules you need. The output of uname -a might be interesting. – GracefulRestart May 15 at 23:33
  • @GracefulRestart it is a shared VPS, so hardware isn't mine. But isn't VPS having ability to install anything including linux kernel? – Stefano Mtangoo May 16 at 4:21
  • 1
    @TimKennedy I have updated my question with details (empty output of course) – Stefano Mtangoo May 16 at 4:21
2
Linux xxx 2.6.32-042stab127.2 #1 SMP Thu Jan 4 16:41:44 MSK 2018 x86_64 GNU/Linux

That is definitely not a standard Debian 9 kernel. For a vanilla Debian 9, you would expect a 4.9.x series kernel.

Googling on the version number indicates this may be an old OpenVZ/Virtuozzo kernel based on RHEL 6.

The kernel configuration is documented on that webpage, and indicates it should have the modules you need. Moreover, the kernel packages downloadable from that page definitely have the modules you need.

You should probably contact your VPS provider's support to find out what is going on with your environment and why the kernel modules seem to be missing. Maybe their VPS environment initialization procedure has a bug...

  • 1
    Thank you, let me contact them – Stefano Mtangoo May 16 at 5:18
  • 1
    It should. You could even download a .dpkg package of the current OpenVZ kernel (or an updated version of it) from the webpage I mentioned, and install that, if it turns out there is a requirement to use OpenVZ kernels in your VPS environment: (re?)installing a kernel package will also install the kernel modules for that kernel version. – telcoM May 16 at 5:37
  • 1
    have specific command for reinstalling? – Stefano Mtangoo May 16 at 5:51
  • 1
    If you have the package file at hand locally, dpkg -i package_name.deb should work. If it is available in a package repository provided by your VPS provider, then apt-get install --reinstall package_name. If the current kernel is not listed as an installed package, or you use a kernel version newer than what you currently have, you should omit the --reinstall option. – telcoM May 16 at 6:03
  • 1
    Thank you for information – Stefano Mtangoo May 16 at 7:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.