1

I'm trying to set up Xauth IPsec on my linux machine. This IPsec server is behind a NAT.

My goal is to have two types of users that can authenticate with a password and a PSK.

The first group (regular user) should be able to access only a certain IP on the server's LAN, whereas the second group (advanced user) should be able to access the whole LAN (both groups shall have access to the default gateway though). This part of the configuration seems more or less clear to me (it's just about configuring the firewall), it's just to provide you an overview.

Therefore, I'd like to assign each group a certain subnet/address pool:

╔══════════╦══════════════════════════════╦═════════════════════════════╦════════════════╗
║  Class   ║ Virtual IP Range             ║     Allowed LAN Access      ║  Common Names  ║
╠══════════╬══════════════════════════════╬═════════════════════════════╬════════════════╣
║ Regular  ║ 192.168.43.10-192.168.43.250 ║ Custom service at 10.66.4.4 ║ Custom service ║
║ Advanced ║ 192.168.42.10-192.168.42.250 ║ Entire 10.66.4.0/24 subnet  ║ Advanced       ║
╚══════════╩══════════════════════════════╩═════════════════════════════╩════════════════╝

Say 10.66.4.0/24 is my LAN.

This is how I configured IPsec:

version 2.0

config setup
  virtual-private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:!192.168.42.0/24,%v4:!192.168.43.0/24
  protostack=netkey
  interfaces=%defaultroute
  uniqueids=no

conn shared
  left=%defaultroute
  leftid=raspberrypi
  right=%any
  encapsulation=yes
  authby=secret
  pfs=no
  rekey=no
  keyingtries=5
  dpddelay=30
  dpdtimeout=120
  dpdaction=clear
  ikev2=never
  ike=aes256-sha512;modp8192,aes256-sha512;modp4096,aes256-sha512;modp2048
  phase2alg=aes_gcm-null,aes256-sha512,aes256-sha2
  sha2-truncbug=no

conn xauth-psk-1
  auto=add
  leftsubnet= 10.66.4.0/24
  rightaddresspool=192.168.43.10-192.168.43.250
  modecfgdns="10.66.4.1"
  leftxauthserver=yes
  rightxauthclient=yes
  leftmodecfgserver=yes
  rightmodecfgclient=yes
  modecfgpull=yes
  xauthby=file
  ike-frag=yes
  cisco-unity=yes
  also=shared

conn xauth-psk-2
  auto=add
  leftsubnet= 10.66.4.0/24
  rightaddresspool=192.168.42.10-192.168.42.250
  modecfgdns="10.66.4.1"
  leftxauthserver=yes
  rightxauthclient=yes
  leftmodecfgserver=yes
  rightmodecfgclient=yes
  modecfgpull=yes
  xauthby=file
  ike-frag=yes
  cisco-unity=yes
  also=shared

I added two users to the /etc/ipsec.d/passwd file:

user1:$1$gGFrE5Sz$BqPBohuaLhHoVr7cQjd/C0:xauth-psk-1
user2:$1$gGFrE5Sz$BqPBohuaLhHoVr7cQjd/C0:xauth-psk-2

It works fine to authenticate as user1. However, when trying to sign in as user2, the authentication fails:

"xauth-psk-1"[6] 10.66.4.23 #9: XAUTH: User <unknown>: Authentication Failed (retry 1)

Apparently, it picked the wrong connection name.

How do I set this up correctly?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.