Questions tagged [ipsec]

The tag has no usage guidance, but it has a tag wiki.

Filter by
Sorted by
Tagged with
0
votes
1answer
36 views

StrongSwan IPsec VPN slow connection speed on Manjaro Linux(Arch)

On Manjaro Linux (arch), the speed of connecting to corporate resources under vpn (ipsec) dropped to almost 0, but everything was fine before I have already tried different configurations, but nothing ...
0
votes
0answers
17 views

IPsecVPN + PPP over ssh routing problem

I have two Debian hosts A and B. On A, I start IPsec VPN and my VPN clients can connect to it. In the same time, I start a PPP over ssh between A and B. So on host A, I can see ppp0 as the new Iface ...
0
votes
1answer
16 views

rekey ipsec using “ip xfrm”

I built a simple ipsec between two Linux boxes: SHAKEY=0xd3413c31c7d19c93d04db1c6ae8d73d9a64910c2e76297129acde44aaa9de5c5 AESKEY=0xcd191fac520878852e15647dce3456ba9857e2dfd6ed56421eb50cb58d7a1e5a SPI=...
0
votes
0answers
25 views

Fedora firewalld : allowing ipsec traffic through

I am trying to use an old laptop running fedora 31 as my main wifi router. Everything is working fine except when I have to connect to work via VPN. My work laptop is a windows machine that has been ...
0
votes
1answer
46 views

Why does ipsec want me to disable redirects?

I've just configured a vpn connection (l2tp), but when I run ipsec verify I get: $ ipsec verify ... NETKEY: Testing XFRM related proc values ICMP default/send_redirects [NOT ...
0
votes
1answer
94 views

strongswan: received NO_PROPOSAL_CHOSEN notify error

I have two private network. network A router: TL-WVR3200L public IP: 223.71.239.218 subnet: 192.168.1.0/24 IPSec config: network B router: TL-WDR5620 public IP: 119.90.63.105 subnet: 192.168.100.0/...
1
vote
1answer
36 views

strongswan: What is the difference between left and leftid?

This tutorial use left parameter when setup strongswan, while this tutorial also use leftid parameter. What is the difference between left and leftid? Update I setup strongswan on aws ec2 with the ...
0
votes
0answers
11 views

Strongswan tunnel is up but not pinging to each others

im facing weird problem i have configured site to site VPN tunnel on Centos 8 on the same network and its connected but unable to ping each others here is below my configuration and status. Site A [...
0
votes
2answers
38 views

How to fix csv string format

I have line of ipsec statusall <conn_name> output. Depends on traffic flow it could be: sr_mesh_aws_22{10}: AES_CBC_256/HMAC_SHA2_256_128/MODP_1024, 0 bytes_i, 0 bytes_o, rekeying in 32 minutes ...
0
votes
1answer
70 views

StrongSwan IPSEC Policy

I have working connection A->B and B->C I need a little help after 3 days of trying, still can't get the desired effect what should I set in SITE B to get connection from A->C and C->A ...
0
votes
1answer
137 views

Connecting Windows 10 to IPSec/L2TP on Debian 10

Trying to get Windows 10 (192.168.1.11) to connect to IPSec/L2TP on Debian 10 (192.168.1.31). Windows firewall is off and I have added AssumeUDPEncapsulationContextOnSendRule (value 2) to the registry ...
2
votes
1answer
100 views

L2TP over IPSec on Debian 10

My Debian 10 box has a Wifi interface, wlx08beac0a6c1d running a WEP AP for old hardware that doens't wupport WPA. My main network is 192.168.1.0/24 and this interface is configured to be 192.168.2.1. ...
1
vote
0answers
175 views

Specify multiple right subnets on libreswan ipsec vpn using ikev1

I want to connect to a ipsec vpn server, and it allows me to connect to different ips (not a ip range), lets say y.y.y.1, y.y.y.2, y.y.y.3, y.y.y.4. I have the following config: conn toing-to-toing ...
0
votes
0answers
53 views

How do I create a VPN certificate (IPSec / IKEv2) which contains an FQDN as identifier?

Obviously, I have a serious lack of understanding of how X.509-based authentication in IPSec VPNs works. More than one time, I have setup VPNs, based on IPSec / IKEv2, where one of the gateways was ...
0
votes
0answers
28 views

How to enable fragmentation in ipsec tunnel for Ipv6 over ipv4

I have created a tunnel - IPv6 over IPv4 and things work fine. But if i send a large packets say 2000 bytes, it does not get transmitted. Is there something that i need to configure to allow large ...
-1
votes
1answer
1k views

Unable to connect to company VPN using L2TP over ipsec on Fedora 32

My company gave me ip address, username, password & pre-shared key to connect to vpn using L2TP. My workstation: Fedora 32 + Gnome. Installed xl2tpd, NetworkManager-l2tp, NetworkManager-l2tp-gnome,...
0
votes
0answers
209 views

IPSec multithreading via pcrypt worse than single thread

According to this document: https://www.strongswan.org/docs/Steffen_Klassert_Parallelizing_IPsec.pdf parallelizing IPSec using pcrypt kernel module will make the connection much more efficient (graphs ...
0
votes
0answers
66 views

Building strongSwan from source

I'm having huge trouble with getting strongswan to work. I'd like to try the newest version and customize it with plugins. I'm following the instruction available here: https://wiki.strongswan.org/...
1
vote
0answers
474 views

Ubuntu IKEv1 IPSec alternative to strongSwan

I'm trying to connect to my work VPN which uses IKEv1/IPSec and authenticates with a preshared key however it appears strongSwan has a PSK limitation restricting PSKs to 20 characters or longer (even ...
0
votes
0answers
449 views

No response from target (vpnc)

I'm setting up a new VPN, provided by my university, using vpnc. I enter all the details exactly as they tell me, including gateway domain, ID, secret group password, plus my Xauth details. Then run ...
0
votes
1answer
42 views

How do I route traffic back over a VPN to other servers

I am currently setting up an environment in 2 sites. all servers are linux/ubuntu. First site is my office and second site is AWS. I have 2 servers in AWS within a VPC with site to site VPN Web01 - ...
2
votes
0answers
66 views

OpenBSD ipsec routing

I have an OpenBSD VM that I wish to connect to my OpenBSD home router with ipsec. The objective is to have a secure channel between my home network and the VM. So I have the following ike conf' on ...
1
vote
0answers
286 views

How to configure Libreswan IPsec for multiple connections?

I'm trying to set up Xauth IPsec on my linux machine. This IPsec server is behind a NAT. My goal is to have two types of users that can authenticate with a password and a PSK. The first group (...
0
votes
1answer
494 views

Roadwarrior scenario strongswan- Iphone setup

I'm working on trying to set up a roadwarrior client scenarion VPN with Stringswan on a raspberry pi. The server config looks like this: pi@raspberrypi:~ $ sudo cat /etc/ipsec.conf # ipsec.conf - ...
3
votes
1answer
950 views

IPsec IKEv2 succesful but Linux VTI does not work with SNAT

If you think troubleshooting IPsec is tedious, please forget about my logs and just let me know the implementation process, I'm still confused and any information is helpful. I removed SPIs and here ...
1
vote
1answer
526 views

Install Linux Kernel modules

I'm setting up IPSec VPN and I have met an error which upon searching I found the error actually means required kernel modules are missing. That prompted me to check that with lsmod and kmod list but ...
0
votes
1answer
105 views

Ipsec tunnel with solaris10..what I miss?

I want to create a two Solaris10 tunnel encrypted with ipsec.Configuration is simple: 2 solaris10 nodes,lan not encrypted,tunnel encrypted. Lan is e1000g0 and tunnel is ip.tun0 Ip "clear" for node1 is ...
0
votes
1answer
371 views

FreeBSD 11.2: how to add the aesni plugin to strongswan?

I installed strongswan using pkg install strongswan But now I've realized I need to have the aesni plugin enabled to optimize my IPsec tunnel. I've already enabled aesni at the OS level. The ...
0
votes
0answers
691 views

how to optimize performance of nfs running inside Strongswan ipsec transport on 10Gb network

Host1: Ubuntu 18.04 Host2: Freebsd 11.2 Here is my situation... I have 2 hosts on a 10G lan that have Strongswan IPsec transport configured between them to secure nfsv3. (Yes, I know nfsv3 is old ...
0
votes
0answers
143 views

Ask for password for IPSec VPN connection with netctl

TL;DR: How can I connect to a VPN with IPSec without writing the password and secret in the config file, but providing it from the outside (in my case a call to my password manager pass)? I already ...
2
votes
1answer
253 views

StrongSwan - ipsec pki command

I would like to know why the first time I run the "ipsec pki" command to get a private key this key is generated quickly, but the next time you try to run the same command to get this key because you ...
2
votes
1answer
2k views

Routing traffic through VPN using Raspberry PI

I have a setup like this: - Raspberry PI connected to router via LAN cable - Created a bridged connection between eth0 and wlan0 - using hostapd for wifi hotstop - configured l2tp/ipsec connection ...
6
votes
1answer
1k views

NAT outbound IPSEC packets using pf on FreeBSD 11 and StrongSwan x FortiGATE

I've been working for more than a week trying to get outbound packets nat'ed to fit a Security Association. This is my (example) scenario: LAN: 1.1.1.0/24 FreeBSD interface: xn0 (Amazon EC2 ...
0
votes
0answers
1k views

IPSec over L2TP: key derivation for pre-shared key failed

I set up a VPN to my Uni (using IPSec over L2TP) before using ~Ubunutu (GalliumOS), Strongswan, and NetworkManager, but this time I keep getting an error about my PSK, see this log output: Jun 22 11:...
-1
votes
1answer
134 views

Configure IPSec so the user identity is passed to iptables rule

Hi I'm pretty new to this so you'll have to be very explicit. I set up IPSec on CentOS so that I can VPN. User identities are stored in the /etc/ppp/chap-secrets, mainly because that's how things ...
0
votes
1answer
280 views

strongswan get RANDOM dns

I'm getting a really strange issue on fresh Fedora 28 MATE with an IKEv2 IPSEC VPN. First thing: this VPN is currently used by some other clients (some windows and my old Fedora 26) with NO issue. ...
1
vote
0answers
455 views

Masquerading strongswan ipsec ikev2 RAS clients

I've a VPS in sweden and I want to establish an IKEv2 RAS connection. The connection is established and a valid SA was created. Now I want to masquerade the traffic for 0.0.0.0/0 through the wan ...
2
votes
2answers
5k views

Connecting to 'unix"//var/run/charon.ctl' failed: connection refused

I have tried to find some answers on this and other sites trying to find out the problem, but my attempts failed. The rule is very simple: I want to establish my Ipsec tunnel when my Yubikey is ...
0
votes
0answers
437 views

How to create IPSec ethernet tunnel between two machines

I've been searching about IPSec. I know that there are two modes: transport layer and ethernet layer. I'd like to create an ethernet tunnel between two machines using AES and SHA256, and specify that ...
8
votes
1answer
11k views

IPsec VPN with strongSwan to FortiGate

I'm trying to connect to a FortiGate and access our continuous integration server via an IPsec VPN tunnel. I have no control over the FortiGate's configuration. On my laptop running Windows 10, I ...
0
votes
1answer
911 views

how overlapping subnet in 2 SA in strongswan determine which tunnel to go?

i have 2 tunnels of ikev1, with overlapping in leftsubnet and rightsubnet ,how the packet that send know to which tunnel it forward to tunnel first_4a010003 whay is that and how i decide i nwhch ...
0
votes
2answers
68 views

ipsec on linux,a simple and fast question

Is my first VPN, for testing this is my simple network scheme LAN1(private 10.10.0.0/24) --->VPN-----internet---<VPN---<LAN2(private 10.20.0.0/24) on /etc/ipsec.conf i use.. ... ...
4
votes
2answers
22k views

IPSec/L2TP VPN connection fails

I'm currently trying to establish a VPN connection to the network of my office using IPSec/L2TP with Ubuntu 16.04 (and/or Fedora 26) which fails with the following syslog entries (complete log below): ...
0
votes
1answer
163 views

using IPsec behind NAT in freebsd 7.3

I have a FreeBSD 7.3 server and I configured IPsec on it but now I need to put my server behind a NAT. I know in order to using NAT I should add IPsec_NAT_T to my kernel but the problem is IPsec_NAT_T ...
2
votes
1answer
4k views

enabling ipsec, ah and esp on CentOS with firewalld in place

On my CentOS I have firewalld running and my eth0 is in default zone. I use dockers for my services to communicate and in dockers I have enabled encryption. Docker creates an overlay network and uses ...
0
votes
1answer
3k views

How ping -b works?

I'm connected to a network switch directly. When I'm running ping -b 172.20.0.255 command, where 172.20.0.255 is my broadcast address, I'm getting the list of IPs iteratively: 64 bytes from 172.20.0....
1
vote
1answer
3k views

Why does /usr/sbin/racoon require inbound connections when a VPN is active on MacOS Sierra

Today, I was monitoring my network accesses using Little Snitch and connecting to an Avast SecureVPN when Little Snitch warned me that it was blocking inbound attempts to contact /usr/sbin/racoon. I ...
4
votes
2answers
18k views

IPSec over L2TP: received NO_PROPOSAL_CHOSEN error notify

Environment: # uname -a Linux shrimpwagon 3.16.0-4-amd64 #1 SMP Debian 3.16.39-1+deb8u1 (2017-02-22) x86_64 GNU/Linux I have already installed: # apt-get install strongswan xl2tpd I'm trying to ...
7
votes
1answer
16k views

Strongswan: several right subnets

I have a Strongswan installation on CentOS7 connecting to a Palo Alto router. I have no access to the config on the remote router. I want to configure two subnets on the other side - one is only a ...
3
votes
0answers
603 views

PING error through enc0: Frag needed and DF set (mtu = 0)

I'm up ipsec vpn client to remote host. Since the remote host accepts only one ip i'm up nat for local net on enc0. Ping from ipsec host is ok: PING 172.20.162.150 (172.20.162.150): 56 data bytes 64 ...