Questions tagged [ipsec]
123
questions
0
votes
0
answers
24
views
Using Strongswan IPSEC in Nvidia Jetson Device causes kernel crash - BUG: scheduling while atomic: swapper
I have an Nvidia Jetson Orin Nano with Linux for Tegra kernel 5.12.
I'm trying to use Strongswan which requires some modules to be set, which I did.
However, it seems that it is missing other kernel ...
- 101
0
votes
0
answers
59
views
no files found matching '/etc/strongswan/swanctl/conf.d/*.conf' on CentOS 8 Stream
I have a very simple host-to-host connection setup with PSK authentication. I setup the same configuration on two centos vms and two ubuntu server vms and the configuration works perfectly on ubuntu ...
1
vote
1
answer
173
views
IPSec tunnel works until rekeying, then gets NO_PROPOSAL_CHOSEN
Context
I have set up a site-to-site IPSec tunnel between a Raspberry Pi located in an office and a pfSense firewall in the cloud. I am using Strongswan for the Raspberry Pi side.
Issue
My tunnel ...
0
votes
0
answers
15
views
How to tell whether a given packet is subject to IPsec's SPD?
My IPsec configuration via strongSwan is non-device and uses XFRM policies / states.
On the VPN gateway I'm trying to test whether a given IP packet (described as src IP, src dev, dst IP) will be ...
- 179
0
votes
0
answers
175
views
Debian 11: setting up L2TP + IPSec - IPSec fails?
I'm trying to configure a new VPN client (L2TP and IPSec) on a very small AWS EC2 system running Debian 11 without a desktop. I've got as far as getting NetworkManager to work, but the VPN connection ...
- 581
0
votes
1
answer
84
views
ip xfrm state update not changing auth/enc keys
I was testing the xfrm framework through the ip xfrm commands, and when testing the state update operation, I did not manage to change either the encryption keys or the authentication keys. A similar ...
- 1
0
votes
0
answers
28
views
Does `top` account for all CPU usage?
Does the linux top command account for all CPU time used by the system?
I'm trying to understand bottlenecks for IPsec processing on a linux system. In a particular case in point, the system is a VM ...
- 235
0
votes
1
answer
168
views
CA certificate misses CA basicConstraint
I am trying to create a self signed CA by doing the following:
ipsec pki --issue --cacert selfCA.pem --cakey ecdsaKEY.pem --ca --dn "..." --flag ikeintermediate --flag serverAuth --outform ...
- 11
0
votes
1
answer
216
views
ipsec pki error (plugin-openssl-failed-to-load-openssl-plugin-create-not found and no plugin file available)
Im trying to establish a vpn connection with a self signed certificate between 2 virtual machines in my M1 mac and it seems that its impossible to create the keys and the certificate due to the titles ...
- 11
2
votes
2
answers
353
views
IPSec settings greuyed out in Add new connection dialog - Fedora36
I would like to add a Layer 2 Tunneling Protocol (L2TP) VPN connection in Network Manager and need to change the IPSec settings but the button is greyed out:
I've installed the NetworkManager-...
- 33
0
votes
1
answer
40
views
Specific need for tcp/ip routing with iptables
I would like to do the following thing:
One server with public IP (say 1.2.3.4) and internal IP (say 192.168.1.1)
Multiple VPN routers connecting (IPSEC and OPENVPN) (port 500/1194/4500)
Internal VPN ...
0
votes
0
answers
76
views
Iptables - VPN firewall to firewall
I am new to the Linux world and I would like to ask a question regarding the iptables firewall.
A customer asks me to create a firewall-to-firewall connection to their VPN.
What rules should I set to ...
- 1
1
vote
0
answers
63
views
Weird Ipsec behavior
I am running into something interesting which I am not able to explain well.
I brought up a simple Ubuntu 20.04 box and attempting to protect all traffic via an IPSec tunnel.
I am not using VTI or ...
- 41
0
votes
1
answer
68
views
Ipsec setting button is seen disabled while adding VPN on Suse 15.3
Not able to enable Ipsec settings buttons, as per some suggestion i have tried installing stringswan package even that didn't resolve the issue
Anyone having idea please help to resolve this at the ...
1
vote
1
answer
249
views
Undoing full cone NAT using IPtables for IPsec
I currently have a free VPS hosted in Oracle Cloud. This machine sits in a so-called "Virtual Cloud Network", which is just a virtual LAN with an address in the range of 10.0.0.0/8 (10.0.0....
2
votes
1
answer
2k
views
IPsec PSK VPN with strongSwan to FortiGate with one-time-password(Fortitoken)
So I am using Strongswan to connect to remote Fortigate since native Fortinet VPN client does not support IPsec. I also have hardware FortiToken 200 that provides a OTP.
My current config is the ...
- 21
0
votes
1
answer
467
views
Redirect DNS traffic via tunnel interface, all other traffic to use kernel routing table
How do I redirect only DNS traffic to use a tunnel interface when active?
Any other type of traffic should use the kernel's routing table instead.
Whenever the tunnel interface is not active, DNS ...
- 542
0
votes
0
answers
140
views
IPSec VPN client connection fails
My router VPN setting for my user:
The router supports: IPSec with ESP, IKEv1
Does NOT support: Authentification Header, AH and Perfect Forward Security, PFS
Linux Centos 8
Secret: sabf6...
...
- 617
-1
votes
1
answer
43
views
Possible to establish Ipsec connection when configure with different aes encryption bit size
I want to setup ipsec in my network, for that i am using racoon in linux devices. If i configure racoon with 2 different PC with different aes encryption will establish connection ?
for eg. If PC-A ...
0
votes
1
answer
766
views
Random SSH Agent Generates on Boot in tmp Directory Even with Networking Disabled
On a recently installed Debian system I noticed that every boot, even with no networking, a folder and empty socket file are generated in /tmp/ssh-(random_letters)/agent.xxx.
On every boot the random ...
0
votes
1
answer
1k
views
StrongSwan IPsec VPN slow connection speed on Manjaro Linux(Arch)
On Manjaro Linux (arch), the speed of connecting to corporate resources under vpn (ipsec) dropped to almost 0, but everything was fine before
I have already tried different configurations, but nothing ...
0
votes
0
answers
125
views
IPsecVPN + PPP over ssh routing problem
I have two Debian hosts A and B. On A, I start IPsec VPN and my VPN clients can connect to it. In the same time, I start a PPP over ssh between A and B. So on host A, I can see ppp0 as the new Iface ...
2
votes
1
answer
687
views
rekey ipsec using "ip xfrm"
I built a simple ipsec between two Linux boxes:
SHAKEY=0xd3413c31c7d19c93d04db1c6ae8d73d9a64910c2e76297129acde44aaa9de5c5
AESKEY=0xcd191fac520878852e15647dce3456ba9857e2dfd6ed56421eb50cb58d7a1e5a
SPI=...
- 51
1
vote
1
answer
1k
views
Why does ipsec want me to disable redirects?
I've just configured a vpn connection (l2tp), but when I run ipsec verify I get:
$ ipsec verify
...
NETKEY: Testing XFRM related proc values
ICMP default/send_redirects [NOT ...
- 3,233
1
vote
1
answer
3k
views
strongswan: received NO_PROPOSAL_CHOSEN notify error
I have two private network.
network A
router: TL-WVR3200L
public IP: 223.71.239.218
subnet: 192.168.1.0/24
IPSec config:
network B
router: TL-WDR5620
public IP: 119.90.63.105
subnet: 192.168.100.0/...
- 253
1
vote
1
answer
958
views
strongswan: What is the difference between left and leftid?
This tutorial use left parameter when setup strongswan, while this tutorial also use leftid parameter. What is the difference between left and leftid?
Update
I setup strongswan on aws ec2 with the ...
- 253
0
votes
1
answer
306
views
Strongswan tunnel is up but not pinging to each others
im facing weird problem i have configured site to site VPN tunnel on Centos 8 on the same network and its connected but unable to ping each others here is below my configuration and status.
Site A
[...
0
votes
2
answers
59
views
How to fix csv string format
I have line of ipsec statusall <conn_name> output. Depends on traffic flow it could be:
sr_mesh_aws_22{10}: AES_CBC_256/HMAC_SHA2_256_128/MODP_1024, 0 bytes_i, 0 bytes_o, rekeying in 32 minutes
...
- 172
0
votes
1
answer
503
views
StrongSwan IPSEC Policy
I have working connection A->B and B->C
I need a little help after 3 days of trying, still can't get the desired effect
what should I set in SITE B to get connection from A->C and C->A ...
- 1
0
votes
1
answer
1k
views
Connecting Windows 10 to IPSec/L2TP on Debian 10
Trying to get Windows 10 (192.168.1.11) to connect to IPSec/L2TP on Debian 10 (192.168.1.31).
Windows firewall is off and I have added AssumeUDPEncapsulationContextOnSendRule (value 2) to the registry ...
2
votes
2
answers
1k
views
L2TP over IPSec on Debian 10
My Debian 10 box has a Wifi interface, wlx08beac0a6c1d running a WEP AP for old hardware that doens't wupport WPA.
My main network is 192.168.1.0/24 and this interface is configured to be 192.168.2.1.
...
1
vote
0
answers
1k
views
Specify multiple right subnets on libreswan ipsec vpn using ikev1
I want to connect to a ipsec vpn server, and it allows me to connect to different ips (not a ip range), lets say y.y.y.1, y.y.y.2, y.y.y.3, y.y.y.4.
I have the following config:
conn toing-to-toing
...
- 111
0
votes
1
answer
4k
views
Unable to connect to company VPN using L2TP over ipsec on Fedora 32
My company gave me ip address, username, password & pre-shared key to connect to vpn using L2TP.
My workstation: Fedora 32 + Gnome.
Installed xl2tpd, NetworkManager-l2tp, NetworkManager-l2tp-gnome,...
0
votes
0
answers
720
views
IPSec multithreading via pcrypt worse than single thread
According to this document:
https://www.strongswan.org/docs/Steffen_Klassert_Parallelizing_IPsec.pdf parallelizing IPSec using pcrypt kernel module will make the connection much more efficient (graphs ...
- 111
0
votes
0
answers
562
views
Building strongSwan from source
I'm having huge trouble with getting strongswan to work. I'd like to try the newest version and customize it with plugins. I'm following the instruction available here: https://wiki.strongswan.org/...
- 111
1
vote
0
answers
1k
views
Ubuntu IKEv1 IPSec alternative to strongSwan
I'm trying to connect to my work VPN which uses IKEv1/IPSec and authenticates with a preshared key however it appears strongSwan has a PSK limitation restricting PSKs to 20 characters or longer (even ...
- 11
0
votes
0
answers
966
views
No response from target (vpnc)
I'm setting up a new VPN, provided by my university, using vpnc. I enter all the details exactly as they tell me, including gateway domain, ID, secret group password, plus my Xauth details. Then run ...
- 793
0
votes
1
answer
352
views
How do I route traffic back over a VPN to other servers
I am currently setting up an environment in 2 sites. all servers are linux/ubuntu. First site is my office and second site is AWS.
I have 2 servers in AWS within a VPC with site to site VPN
Web01 - ...
- 11
2
votes
0
answers
193
views
OpenBSD ipsec routing
I have an OpenBSD VM that I wish to connect to my OpenBSD home router with ipsec. The objective is to have a secure channel between my home network and the VM.
So I have the following ike conf' on ...
- 571
1
vote
0
answers
910
views
How to configure Libreswan IPsec for multiple connections?
I'm trying to set up Xauth IPsec on my linux machine.
This IPsec server is behind a NAT.
My goal is to have two types of users that can authenticate with a password and a PSK.
The first group (...
0
votes
1
answer
718
views
Roadwarrior scenario strongswan- Iphone setup
I'm working on trying to set up a roadwarrior client scenarion VPN with Stringswan on a raspberry pi.
The server config looks like this:
pi@raspberrypi:~ $ sudo cat /etc/ipsec.conf
# ipsec.conf - ...
3
votes
1
answer
2k
views
IPsec IKEv2 succesful but Linux VTI does not work with SNAT
If you think troubleshooting IPsec is tedious, please forget about my logs and just let me know the implementation process, I'm still confused and any information is helpful.
I removed SPIs and here ...
user363597
1
vote
1
answer
832
views
Install Linux Kernel modules
I'm setting up IPSec VPN and I have met an error which upon searching I found the error actually means required kernel modules are missing. That prompted me to check that with lsmod and kmod list but ...
- 121
0
votes
1
answer
165
views
Ipsec tunnel with solaris10..what I miss?
I want to create a two Solaris10 tunnel encrypted with ipsec.Configuration is simple: 2 solaris10 nodes,lan not encrypted,tunnel encrypted.
Lan is e1000g0 and tunnel is ip.tun0
Ip "clear" for node1 is ...
- 12.1k
0
votes
1
answer
552
views
FreeBSD 11.2: how to add the aesni plugin to strongswan?
I installed strongswan using
pkg install strongswan
But now I've realized I need to have the aesni plugin enabled to optimize my IPsec tunnel. I've already enabled aesni at the OS level. The ...
- 11
0
votes
0
answers
1k
views
how to optimize performance of nfs running inside Strongswan ipsec transport on 10Gb network
Host1: Ubuntu 18.04
Host2: Freebsd 11.2
Here is my situation... I have 2 hosts on a 10G lan that have Strongswan IPsec transport configured between them to secure nfsv3. (Yes, I know nfsv3 is old ...
- 11
0
votes
0
answers
270
views
Ask for password for IPSec VPN connection with netctl
TL;DR: How can I connect to a VPN with IPSec without writing the password and secret in the config file, but providing it from the outside (in my case a call to my password manager pass)?
I already ...
- 211
2
votes
1
answer
485
views
StrongSwan - ipsec pki command
I would like to know why the first time I run the "ipsec pki" command to get a private key this key is generated quickly, but the next time you try to run the same command to get this key because you ...
- 77
3
votes
1
answer
3k
views
Routing traffic through VPN using Raspberry PI
I have a setup like this:
- Raspberry PI connected to router via LAN cable
- Created a bridged connection between eth0 and wlan0
- using hostapd for wifi hotstop
- configured l2tp/ipsec connection ...
- 131
6
votes
1
answer
2k
views
NAT outbound IPSEC packets using pf on FreeBSD 11 and StrongSwan x FortiGATE
I've been working for more than a week trying to get outbound packets nat'ed to fit a Security Association.
This is my (example) scenario:
LAN: 1.1.1.0/24
FreeBSD interface: xn0 (Amazon EC2 ...
- 101