Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ipsec]

The tag has no usage guidance, but it has a tag wiki.

0
votes
1answer
31 views

Ipsec tunnel with solaris10..what I miss?

I want to create a two Solaris10 tunnel encrypted with ipsec.Configuration is simple: 2 solaris10 nodes,lan not encrypted,tunnel encrypted. Lan is e1000g0 and tunnel is ip.tun0 Ip "clear" for node1 is ...
0
votes
0answers
13 views

ipsec libreswan weakest available params

what is the weakest value in libreswan for ike=? phase2alg=? i'd like to use ipsec/xauth/psk as only for transport purpose
0
votes
0answers
22 views

No test for echainiv(authenc(hmac(sha256),cbc(aes))) (echainiv(authenc(hmac(sha256-generic),cbc-aes-aesni)))

I am getting this message in my log file while trying to setup a tunnel between a home agent and a mobile node using StrongSwan with mip6d. I can't make the tunnel work between them so I'm wandering ...
0
votes
1answer
72 views

FreeBSD 11.2: how to add the aesni plugin to strongswan?

I installed strongswan using pkg install strongswan But now I've realized I need to have the aesni plugin enabled to optimize my IPsec tunnel. I've already enabled aesni at the OS level. The ...
0
votes
0answers
59 views

how to optimize performance of nfs running inside Strongswan ipsec transport on 10Gb network

Host1: Ubuntu 18.04 Host2: Freebsd 11.2 Here is my situation... I have 2 hosts on a 10G lan that have Strongswan IPsec transport configured between them to secure nfsv3. (Yes, I know nfsv3 is old ...
0
votes
0answers
32 views

ipsec per user id routing

could someone point me out how should look the config of ipsec (libreswan) the way that i could assign a static public ip per user id we use ipsec xauth/psk left (client) ipsec identifier based on ...
0
votes
0answers
26 views

Ask for password for IPSec VPN connection with netctl

TL;DR: How can I connect to a VPN with IPSec without writing the password and secret in the config file, but providing it from the outside (in my case a call to my password manager pass)? I already ...
2
votes
1answer
51 views

StrongSwan - ipsec pki command

I would like to know why the first time I run the "ipsec pki" command to get a private key this key is generated quickly, but the next time you try to run the same command to get this key because you ...
2
votes
1answer
245 views

Routing traffic through VPN using Raspberry PI

I have a setup like this: - Raspberry PI connected to router via LAN cable - Created a bridged connection between eth0 and wlan0 - using hostapd for wifi hotstop - configured l2tp/ipsec connection ...
1
vote
0answers
133 views

Problem to configure strongSwan on a new machine? [closed]

I'm trying to migrate my strongSwan VPN server to a new machine but it does not work. My public IP address is dynamic and I use DDNS to access my home network from the outside. When I establish a VPN ...
6
votes
1answer
417 views

NAT outbound IPSEC packets using pf on FreeBSD 11 and StrongSwan x FortiGATE

I've been working for more than a week trying to get outbound packets nat'ed to fit a Security Association. This is my (example) scenario: LAN: 1.1.1.0/24 FreeBSD interface: xn0 (Amazon EC2 ...
0
votes
0answers
501 views

IPSec over L2TP: key derivation for pre-shared key failed

I set up a VPN to my Uni (using IPSec over L2TP) before using ~Ubunutu (GalliumOS), Strongswan, and NetworkManager, but this time I keep getting an error about my PSK, see this log output: Jun 22 11:...
-1
votes
1answer
69 views

Configure IPSec so the user identity is passed to iptables rule

Hi I'm pretty new to this so you'll have to be very explicit. I set up IPSec on CentOS so that I can VPN. User identities are stored in the /etc/ppp/chap-secrets, mainly because that's how things ...
0
votes
1answer
175 views

strongswan get RANDOM dns

I'm getting a really strange issue on fresh Fedora 28 MATE with an IKEv2 IPSEC VPN. First thing: this VPN is currently used by some other clients (some windows and my old Fedora 26) with NO issue. ...
0
votes
0answers
158 views

Masquerading strongswan ipsec ikev2 RAS clients

I've a VPS in sweden and I want to establish an IKEv2 RAS connection. The connection is established and a valid SA was created. Now I want to masquerade the traffic for 0.0.0.0/0 through the wan ...
1
vote
0answers
140 views

Strongswan - 1:1 NAT [closed]

I would like to start with StrongSwan which looks like the best idea to create an IPSec tunnel with IKEv2, however I`m not sure for which way I should go with configuration. I want to connect 3 sites ...
2
votes
2answers
1k views

Connecting to 'unix"//var/run/charon.ctl' failed: connection refused

I have tried to find some answers on this and other sites trying to find out the problem, but my attempts failed. The rule is very simple: I want to establish my Ipsec tunnel when my Yubikey is ...
0
votes
0answers
298 views

How to create IPSec ethernet tunnel between two machines

I've been searching about IPSec. I know that there are two modes: transport layer and ethernet layer. I'd like to create an ethernet tunnel between two machines using AES and SHA256, and specify that ...
4
votes
0answers
4k views

IPsec VPN with strongSwan to FortiGate

I'm trying to connect to a FortiGate and access our continuous integration server via an IPsec VPN tunnel. I have no control over the FortiGate's configuration. On my laptop running Windows 10, I ...
0
votes
1answer
338 views

how overlapping subnet in 2 SA in strongswan determine which tunnel to go?

i have 2 tunnels of ikev1, with overlapping in leftsubnet and rightsubnet ,how the packet that send know to which tunnel it forward to tunnel first_4a010003 whay is that and how i decide i nwhch ...
0
votes
2answers
42 views

ipsec on linux,a simple and fast question

Is my first VPN, for testing this is my simple network scheme LAN1(private 10.10.0.0/24) --->VPN-----internet---<VPN---<LAN2(private 10.20.0.0/24) on /etc/ipsec.conf i use.. ... ...
0
votes
0answers
76 views

IPSec - src and dst mac don't change from encrypted to decrypted packets

I am trying to debug an IPSec setup. I have 4 virtualbox vms: client a in address 192.168.224.2/24 My own IPSec gateway with addresses 192.168.224.5/24 and 192.168.10.100/24 A strongswan IPSec ...
3
votes
1answer
10k views

IPSec/L2TP VPN connection fails

I'm currently trying to establish a VPN connection to the network of my office using IPSec/L2TP with Ubuntu 16.04 (and/or Fedora 26) which fails with the following syslog entries (complete log below): ...
1
vote
1answer
131 views

using IPsec behind NAT in freebsd 7.3

I have a FreeBSD 7.3 server and I configured IPsec on it but now I need to put my server behind a NAT. I know in order to using NAT I should add IPsec_NAT_T to my kernel but the problem is IPsec_NAT_T ...
2
votes
1answer
1k views

enabling ipsec, ah and esp on CentOS with firewalld in place

On my CentOS I have firewalld running and my eth0 is in default zone. I use dockers for my services to communicate and in dockers I have enabled encryption. Docker creates an overlay network and uses ...
0
votes
1answer
1k views

How ping -b works?

I'm connected to a network switch directly. When I'm running ping -b 172.20.0.255 command, where 172.20.0.255 is my broadcast address, I'm getting the list of IPs iteratively: 64 bytes from 172.20.0....
1
vote
1answer
2k views

Why does /usr/sbin/racoon require inbound connections when a VPN is active on MacOS Sierra

Today, I was monitoring my network accesses using Little Snitch and connecting to an Avast SecureVPN when Little Snitch warned me that it was blocking inbound attempts to contact /usr/sbin/racoon. I ...
3
votes
1answer
9k views

IPSec over L2TP: received NO_PROPOSAL_CHOSEN error notify

Environment: # uname -a Linux shrimpwagon 3.16.0-4-amd64 #1 SMP Debian 3.16.39-1+deb8u1 (2017-02-22) x86_64 GNU/Linux I have already installed: # apt-get install strongswan xl2tpd I'm trying to ...
6
votes
1answer
7k views

Strongswan: several right subnets

I have a Strongswan installation on CentOS7 connecting to a Palo Alto router. I have no access to the config on the remote router. I want to configure two subnets on the other side - one is only a ...
3
votes
0answers
364 views

PING error through enc0: Frag needed and DF set (mtu = 0)

I'm up ipsec vpn client to remote host. Since the remote host accepts only one ip i'm up nat for local net on enc0. Ping from ipsec host is ok: PING 172.20.162.150 (172.20.162.150): 56 data bytes 64 ...
4
votes
0answers
940 views

IPSec end-point sends ICMP “unreachable; frag needed” messages while it's not routing

I have a simple site-to-site IPSec VPN where "server-A" is connected to a "fw-A" over an IPSec tunnel. In front of "server-A" there is a switch with has a 1500 byte MTU interface facing the server. ...
3
votes
1answer
1k views

Why use strongswan rather than native vpn support

As far as I understand, FreeBSD comes with the native ability to make vpn connections. Ist strongswan a package, that comes on top of the freebsd ipsec stack or is it a replacement?
1
vote
0answers
269 views

Is there a way to configure Libreswan to opportunistically create an IPSec SA with a remote host by preloading certificates or keys?

Is there a way to configure Libreswan to opportunistically create an IPSec SA with a remote host by preloading certificates or keys from hosts we trust? I'm looking for Libreswan configuration that ...
3
votes
0answers
451 views

Configuring IPSec with PSK

I'm struggling with IPSec while trying to configure to a Windows server. I need to use IPSec only in the 172.30.1.0/24 network. Linux Settings Running in AWS EB 4.4.15-25.57.amzn1.x86_64 GNU/Linux, ...
3
votes
1answer
5k views

strongSwan - gives error “no known IPsec stack detected, ignoring!”

I'm trying to connect to my university's VPN using strongSwan on Arch Linux. They have given example ipsec.conf and ipsec.secrets files and I've installed strongSwan from the AUR. As far as I'm aware,...
2
votes
0answers
2k views

CentOS IPsec: We cannot identify ourselves with either end of this connection [closed]

I have problem with IPsec on centOS. While adding a connection using ipsec auto --add cx It gives multiple ip addresses, using 127.0.0.1 on venet0 On using ipsec auto --up cx I get We cannot ...
1
vote
0answers
300 views

IPTables Rules for Routing VPN Traffic Through Proxy

I have a public VPN server up and running with StrongSwan 5.3.5. My VPN network is 10.10.10.0/24. The way that the VPN tunnel is setup currently is with split tunneling. What I'm trying to do is to ...
1
vote
1answer
580 views

StrongSwan 5.2.1 on Debian Jessie vs Juniper SSG 550M - Short connection life time

We are trying to establish a persistent VPN connection against a Juniper box. However there is some misconfiguration. When we start the StrongSwan service, the tunnel is up and all traffic go fine. ...
3
votes
0answers
372 views

Apparmor: does complain mode enable capability dac_override?

I'm trying to adjust an AppArmor profile after I found some guidance that it should be disabled for my use-case (not too happy running an IPSec daemon naked). So I've tried to put it in complain mode ...
2
votes
0answers
111 views

Encrypting Linux LPD to Windows (ipsec/ssh tunnel/other)

I have a Windows print server running LPD. My Linux clients are all configured to point to a separate Linux server running Cups (TCP 631), and then the Cups config points to an LPD URI which directs ...
2
votes
1answer
1k views

Connect as client to Ipsec with OpenSuse Linux

A former co-worker established a set of AWS instances. One of these is an IPSec VSetup a IPSec/L2TP VPN server. I can SSH into this ec2 instance, and on this machine. I do have a username and ...
3
votes
1answer
330 views

IPsec tunnel blocks after a while without error. Where to find details?

There is an IPsec Tunnel created with OpenSwan that works perfectly well packets going through answers received etc until at some point in time traffic stops. I can regenerate the tunnel doing ipsec ...
1
vote
1answer
514 views

How to run a command when a libreswan tunnel connects?

I would like to run a command (or wake up a process, or similar) when libreswan succeeds in connecting an IPSec tunnel (or connection, to use the configuration file's term). My requirement is to run ...
3
votes
1answer
4k views

Cannot connect to VPN with ipsec after upgrade

I'm using Debian Stretch, which is current testing release. Some time ago I set up a VPN connection using IPsec and it worked correctly. It suddenly stopped. It is possible that in the meantime some ...
4
votes
1answer
2k views

ipsec rightsubnet to wide, cannot override routing table | IPSec route some packets 'locally', not via tunnel; ip xfrm change?

I'd like to override part of the (IPSec) routing table (routing to 10.108.0.0/16 locally via eth0, not via IPSec tunnel) my IPSEC config conn vpc type=tunnel authby=secret left=172.16....
2
votes
0answers
1k views

IPSec VPN problem with tunnel [closed]

My connection IPSec have problem. This is my Diagram. Connect VPN is not OK must be restart IPsec ==> OK and after that not OK root@vungtau:~# telnet 10.225.198.3 3900 Trying 10.225.198.3... ...
2
votes
1answer
597 views

unable to add IPSec IKEv2 profile on Fedora 22/23

it should be something really simple, but I cannot add IPSec IKEv2 profile in Network Manager settings, Add button is greyed out. Does anyone know?
1
vote
0answers
660 views

Setting up IPSEC on LAN between two hosts (OpenBSD)

I originally asked this on ServerFault, but got nothing. Hoping there are some OpenBSD experts here Trying to use IPSEC between two hosts on a LAN. No VPN involved Using OpenBSD 5.8 (in VirtualBox). ...
2
votes
0answers
1k views

racoon IPSec/L2TP Client

I am trying to configure a racoon IPSec/L2TP client to connect a Windows 2003 server. The server is originally intended to be used with Windows XP clients (successfully tested with Windows XP SP3 but ...
0
votes
0answers
3k views

strongSwan routing issue with roadwarrior behind NAT

Using the following ipsec.conf configuration: conn %default ikelifetime=60m keylife=20m keyingtries=3 rekeymargin=3m keyexchange=ikev2 esp=aes-aes256-...