I'm trying to set up Xauth IPsec on my linux machine. This IPsec server is behind a NAT.
My goal is to have two types of users that can authenticate with a password and a PSK.
The first group (regular user) should be able to access only a certain IP on the server's LAN, whereas the second group (advanced user) should be able to access the whole LAN (both groups shall have access to the default gateway though). This part of the configuration seems more or less clear to me (it's just about configuring the firewall), it's just to provide you an overview.
Therefore, I'd like to assign each group a certain subnet/address pool:
╔══════════╦══════════════════════════════╦═════════════════════════════╦════════════════╗
║ Class ║ Virtual IP Range ║ Allowed LAN Access ║ Common Names ║
╠══════════╬══════════════════════════════╬═════════════════════════════╬════════════════╣
║ Regular ║ 192.168.43.10-192.168.43.250 ║ Custom service at 10.66.4.4 ║ Custom service ║
║ Advanced ║ 192.168.42.10-192.168.42.250 ║ Entire 10.66.4.0/24 subnet ║ Advanced ║
╚══════════╩══════════════════════════════╩═════════════════════════════╩════════════════╝
Say 10.66.4.0/24 is my LAN.
This is how I configured IPsec:
version 2.0
config setup
virtual-private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:!192.168.42.0/24,%v4:!192.168.43.0/24
protostack=netkey
interfaces=%defaultroute
uniqueids=no
conn shared
left=%defaultroute
leftid=raspberrypi
right=%any
encapsulation=yes
authby=secret
pfs=no
rekey=no
keyingtries=5
dpddelay=30
dpdtimeout=120
dpdaction=clear
ikev2=never
ike=aes256-sha512;modp8192,aes256-sha512;modp4096,aes256-sha512;modp2048
phase2alg=aes_gcm-null,aes256-sha512,aes256-sha2
sha2-truncbug=no
conn xauth-psk-1
auto=add
leftsubnet= 10.66.4.0/24
rightaddresspool=192.168.43.10-192.168.43.250
modecfgdns="10.66.4.1"
leftxauthserver=yes
rightxauthclient=yes
leftmodecfgserver=yes
rightmodecfgclient=yes
modecfgpull=yes
xauthby=file
ike-frag=yes
cisco-unity=yes
also=shared
conn xauth-psk-2
auto=add
leftsubnet= 10.66.4.0/24
rightaddresspool=192.168.42.10-192.168.42.250
modecfgdns="10.66.4.1"
leftxauthserver=yes
rightxauthclient=yes
leftmodecfgserver=yes
rightmodecfgclient=yes
modecfgpull=yes
xauthby=file
ike-frag=yes
cisco-unity=yes
also=shared
I added two users to the /etc/ipsec.d/passwd file:
user1:$1$gGFrE5Sz$BqPBohuaLhHoVr7cQjd/C0:xauth-psk-1
user2:$1$gGFrE5Sz$BqPBohuaLhHoVr7cQjd/C0:xauth-psk-2
It works fine to authenticate as user1. However, when trying to sign in as user2, the authentication fails:
"xauth-psk-1"[6] 10.66.4.23 #9: XAUTH: User <unknown>: Authentication Failed (retry 1)
Apparently, it picked the wrong connection name.
How do I set this up correctly?
