Skip to main content

Questions tagged [ipsec]

The tag has no usage guidance, but it has a tag wiki.

Filter by
Sorted by
Tagged with
0 votes
0 answers
40 views

Strongswan - Communication doesn't work between hosts

I have created a SITE-TO-SITE IPSEC tunnel between my two branches, the tunnel is up and running and I can ping bidirectional both routers, the problem is that I can't do any type of communications (...
André Bolinhas's user avatar
3 votes
1 answer
68 views

What's the "new" way of checking the established connections in strongswan

Previously it was in ipsec statusall. Now with swanctl I can only see swanctl --list-conns but it only shows the configuration details, not the runtime statistics: eg bytes transferred, negotiated ...
zerkms's user avatar
  • 829
0 votes
1 answer
241 views

Connect IPSEC VPN to network interface

I have a StrongSwan IPSEC VPN configured on my Ubuntu 22.04.4 LTS server. The VPN starts up and connects to the primary interface (eno1) successfully. Using qBittorrent, I bind to the IP Address that ...
furnaceX's user avatar
0 votes
0 answers
61 views

Gre over IPsec Throuput performance

I am testing FRR DMVPN using Strongswan IPSec + GRE. Tunnels work great and they are easily established between the branch offices. Tunnels work great and they are easily established between the ...
Isravel Raja's user avatar
-1 votes
1 answer
376 views

Fix "unmanaged" network interface if it worked before

TL;DR; Maybe I clicked vpn connect wrong and got disconnected from the network. That's why the answer is easy. As usual I wanted to connect to my work network using ipsec via network manager applet. ...
woojiq's user avatar
  • 1
0 votes
0 answers
49 views

OPNsense as an IPsec client

I want to setup a permanent VPN connection from one site to another. I already correctly set up an IPsec server on one site, reachable with a fixed IPv4 and IPv6, and domain. What I want to do now, is ...
Fluttershy's user avatar
0 votes
0 answers
15 views

Packets not going through vpn (in net2net-same network) scenario

I have followed the guide for an implementation having the same network on both sides ( https://www.strongswan.org/testing/testresults/ikev2/net2net-same-nets/) And below are my configuration, I think ...
Charm_quark's user avatar
1 vote
0 answers
24 views

Unclear delays pinging over IPsec VPN

What could be the cause if every second ping is delayed for a second when pinging through the host-to-network VPN while at the same time pinging the security gateway outside the VPN takes 13 ms on ...
Juergen's user avatar
  • 722
0 votes
0 answers
87 views

Using Strongswan IPSEC in Nvidia Jetson Device causes kernel crash - BUG: scheduling while atomic: swapper

I have an Nvidia Jetson Orin Nano with Linux for Tegra kernel 5.12. I'm trying to use Strongswan which requires some modules to be set, which I did. However, it seems that it is missing other kernel ...
Spider's user avatar
  • 101
1 vote
1 answer
884 views

IPSec tunnel works until rekeying, then gets NO_PROPOSAL_CHOSEN

Context I have set up a site-to-site IPSec tunnel between a Raspberry Pi located in an office and a pfSense firewall in the cloud. I am using Strongswan for the Raspberry Pi side. Issue My tunnel ...
The Coding Penguin's user avatar
0 votes
0 answers
569 views

Debian 11: setting up L2TP + IPSec - IPSec fails?

I'm trying to configure a new VPN client (L2TP and IPSec) on a very small AWS EC2 system running Debian 11 without a desktop. I've got as far as getting NetworkManager to work, but the VPN connection ...
j4nd3r53n's user avatar
  • 717
0 votes
1 answer
247 views

ip xfrm state update not changing auth/enc keys

I was testing the xfrm framework through the ip xfrm commands, and when testing the state update operation, I did not manage to change either the encryption keys or the authentication keys. A similar ...
dcrypt's user avatar
  • 1
0 votes
0 answers
58 views

Does `top` account for all CPU usage?

Does the linux top command account for all CPU time used by the system? I'm trying to understand bottlenecks for IPsec processing on a linux system. In a particular case in point, the system is a VM ...
Jeff Learman's user avatar
0 votes
1 answer
603 views

CA certificate misses CA basicConstraint

I am trying to create a self signed CA by doing the following: ipsec pki --issue --cacert selfCA.pem --cakey ecdsaKEY.pem --ca --dn "..." --flag ikeintermediate --flag serverAuth --outform ...
Idomeneas's user avatar
0 votes
1 answer
628 views

ipsec pki error (plugin-openssl-failed-to-load-openssl-plugin-create-not found and no plugin file available)

Im trying to establish a vpn connection with a self signed certificate between 2 virtual machines in my M1 mac and it seems that its impossible to create the keys and the certificate due to the titles ...
Idomeneas's user avatar
2 votes
2 answers
527 views

IPSec settings greuyed out in Add new connection dialog - Fedora36

I would like to add a Layer 2 Tunneling Protocol (L2TP) VPN connection in Network Manager and need to change the IPSec settings but the button is greyed out: I've installed the NetworkManager-...
MisdeBug's user avatar
0 votes
1 answer
51 views

Specific need for tcp/ip routing with iptables

I would like to do the following thing: One server with public IP (say 1.2.3.4) and internal IP (say 192.168.1.1) Multiple VPN routers connecting (IPSEC and OPENVPN) (port 500/1194/4500) Internal VPN ...
JG Cabanas's user avatar
0 votes
0 answers
123 views

Iptables - VPN firewall to firewall

I am new to the Linux world and I would like to ask a question regarding the iptables firewall. A customer asks me to create a firewall-to-firewall connection to their VPN. What rules should I set to ...
Pidi's user avatar
  • 1
1 vote
0 answers
76 views

Weird Ipsec behavior

I am running into something interesting which I am not able to explain well. I brought up a simple Ubuntu 20.04 box and attempting to protect all traffic via an IPSec tunnel. I am not using VTI or ...
vtewari's user avatar
  • 41
0 votes
1 answer
103 views

Ipsec setting button is seen disabled while adding VPN on Suse 15.3

Not able to enable Ipsec settings buttons, as per some suggestion i have tried installing stringswan package even that didn't resolve the issue Anyone having idea please help to resolve this at the ...
Nagesh Rao's user avatar
1 vote
1 answer
312 views

Undoing full cone NAT using IPtables for IPsec

I currently have a free VPS hosted in Oracle Cloud. This machine sits in a so-called "Virtual Cloud Network", which is just a virtual LAN with an address in the range of 10.0.0.0/8 (10.0.0....
Marcos Vives Del Sol's user avatar
2 votes
1 answer
3k views

IPsec PSK VPN with strongSwan to FortiGate with one-time-password(Fortitoken)

So I am using Strongswan to connect to remote Fortigate since native Fortinet VPN client does not support IPsec. I also have hardware FortiToken 200 that provides a OTP. My current config is the ...
fteox's user avatar
  • 21
0 votes
1 answer
607 views

Redirect DNS traffic via tunnel interface, all other traffic to use kernel routing table

How do I redirect only DNS traffic to use a tunnel interface when active? Any other type of traffic should use the kernel's routing table instead. Whenever the tunnel interface is not active, DNS ...
Dave's user avatar
  • 621
0 votes
0 answers
150 views

IPSec VPN client connection fails

My router VPN setting for my user: The router supports: IPSec with ESP, IKEv1 Does NOT support: Authentification Header, AH and Perfect Forward Security, PFS Linux Centos 8 Secret: sabf6... ...
None's user avatar
  • 647
-1 votes
1 answer
57 views

Possible to establish Ipsec connection when configure with different aes encryption bit size

I want to setup ipsec in my network, for that i am using racoon in linux devices. If i configure racoon with 2 different PC with different aes encryption will establish connection ? for eg. If PC-A ...
Dhaneesh lal.D.R's user avatar
0 votes
1 answer
1k views

Random SSH Agent Generates on Boot in tmp Directory Even with Networking Disabled

On a recently installed Debian system I noticed that every boot, even with no networking, a folder and empty socket file are generated in /tmp/ssh-(random_letters)/agent.xxx. On every boot the random ...
emptysocket's user avatar
0 votes
1 answer
1k views

StrongSwan IPsec VPN slow connection speed on Manjaro Linux(Arch)

On Manjaro Linux (arch), the speed of connecting to corporate resources under vpn (ipsec) dropped to almost 0, but everything was fine before I have already tried different configurations, but nothing ...
HouseInTheForest's user avatar
0 votes
0 answers
143 views

IPsecVPN + PPP over ssh routing problem

I have two Debian hosts A and B. On A, I start IPsec VPN and my VPN clients can connect to it. In the same time, I start a PPP over ssh between A and B. So on host A, I can see ppp0 as the new Iface ...
neuron mac's user avatar
2 votes
1 answer
872 views

rekey ipsec using "ip xfrm"

I built a simple ipsec between two Linux boxes: SHAKEY=0xd3413c31c7d19c93d04db1c6ae8d73d9a64910c2e76297129acde44aaa9de5c5 AESKEY=0xcd191fac520878852e15647dce3456ba9857e2dfd6ed56421eb50cb58d7a1e5a SPI=...
Bill's user avatar
  • 51
1 vote
1 answer
1k views

Why does ipsec want me to disable redirects?

I've just configured a vpn connection (l2tp), but when I run ipsec verify I get: $ ipsec verify ... NETKEY: Testing XFRM related proc values ICMP default/send_redirects [NOT ...
x-yuri's user avatar
  • 3,453
1 vote
1 answer
4k views

strongswan: received NO_PROPOSAL_CHOSEN notify error

I have two private network. network A router: TL-WVR3200L public IP: 223.71.239.218 subnet: 192.168.1.0/24 IPSec config: network B router: TL-WDR5620 public IP: 119.90.63.105 subnet: 192.168.100.0/...
Ren's user avatar
  • 273
1 vote
1 answer
1k views

strongswan: What is the difference between left and leftid?

This tutorial use left parameter when setup strongswan, while this tutorial also use leftid parameter. What is the difference between left and leftid? Update I setup strongswan on aws ec2 with the ...
Ren's user avatar
  • 273
0 votes
1 answer
421 views

Strongswan tunnel is up but not pinging to each others

im facing weird problem i have configured site to site VPN tunnel on Centos 8 on the same network and its connected but unable to ping each others here is below my configuration and status. Site A [...
Rizwan Saleem's user avatar
0 votes
2 answers
61 views

How to fix csv string format

I have line of ipsec statusall <conn_name> output. Depends on traffic flow it could be: sr_mesh_aws_22{10}: AES_CBC_256/HMAC_SHA2_256_128/MODP_1024, 0 bytes_i, 0 bytes_o, rekeying in 32 minutes ...
Petras L's user avatar
  • 272
0 votes
1 answer
628 views

StrongSwan IPSEC Policy

I have working connection A->B and B->C I need a little help after 3 days of trying, still can't get the desired effect what should I set in SITE B to get connection from A->C and C->A ...
prof's user avatar
  • 1
0 votes
1 answer
1k views

Connecting Windows 10 to IPSec/L2TP on Debian 10

Trying to get Windows 10 (192.168.1.11) to connect to IPSec/L2TP on Debian 10 (192.168.1.31). Windows firewall is off and I have added AssumeUDPEncapsulationContextOnSendRule (value 2) to the registry ...
Richard Barraclough's user avatar
2 votes
2 answers
2k views

L2TP over IPSec on Debian 10

My Debian 10 box has a Wifi interface, wlx08beac0a6c1d running a WEP AP for old hardware that doens't wupport WPA. My main network is 192.168.1.0/24 and this interface is configured to be 192.168.2.1. ...
Richard Barraclough's user avatar
2 votes
0 answers
2k views

Specify multiple right subnets on libreswan ipsec vpn using ikev1

I want to connect to a ipsec vpn server, and it allows me to connect to different ips (not a ip range), lets say y.y.y.1, y.y.y.2, y.y.y.3, y.y.y.4. I have the following config: conn toing-to-toing ...
toing_toing's user avatar
0 votes
1 answer
4k views

Unable to connect to company VPN using L2TP over ipsec on Fedora 32

My company gave me ip address, username, password & pre-shared key to connect to vpn using L2TP. My workstation: Fedora 32 + Gnome. Installed xl2tpd, NetworkManager-l2tp, NetworkManager-l2tp-gnome,...
ShashiKanth Chill's user avatar
0 votes
0 answers
805 views

IPSec multithreading via pcrypt worse than single thread

According to this document: https://www.strongswan.org/docs/Steffen_Klassert_Parallelizing_IPsec.pdf parallelizing IPSec using pcrypt kernel module will make the connection much more efficient (graphs ...
dywan666's user avatar
  • 111
0 votes
0 answers
861 views

Building strongSwan from source

I'm having huge trouble with getting strongswan to work. I'd like to try the newest version and customize it with plugins. I'm following the instruction available here: https://wiki.strongswan.org/...
dywan666's user avatar
  • 111
1 vote
0 answers
2k views

Ubuntu IKEv1 IPSec alternative to strongSwan

I'm trying to connect to my work VPN which uses IKEv1/IPSec and authenticates with a preshared key however it appears strongSwan has a PSK limitation restricting PSKs to 20 characters or longer (even ...
Eric's user avatar
  • 11
0 votes
0 answers
1k views

No response from target (vpnc)

I'm setting up a new VPN, provided by my university, using vpnc. I enter all the details exactly as they tell me, including gateway domain, ID, secret group password, plus my Xauth details. Then run ...
luchonacho's user avatar
1 vote
1 answer
498 views

How do I route traffic back over a VPN to other servers

I am currently setting up an environment in 2 sites. all servers are linux/ubuntu. First site is my office and second site is AWS. I have 2 servers in AWS within a VPC with site to site VPN Web01 - ...
LinuxVirgin's user avatar
2 votes
0 answers
223 views

OpenBSD ipsec routing

I have an OpenBSD VM that I wish to connect to my OpenBSD home router with ipsec. The objective is to have a secure channel between my home network and the VM. So I have the following ike conf' on ...
22decembre's user avatar
1 vote
0 answers
1k views

How to configure Libreswan IPsec for multiple connections?

I'm trying to set up Xauth IPsec on my linux machine. This IPsec server is behind a NAT. My goal is to have two types of users that can authenticate with a password and a PSK. The first group (...
j3141592653589793238's user avatar
0 votes
1 answer
733 views

Roadwarrior scenario strongswan- Iphone setup

I'm working on trying to set up a roadwarrior client scenarion VPN with Stringswan on a raspberry pi. The server config looks like this: pi@raspberrypi:~ $ sudo cat /etc/ipsec.conf # ipsec.conf - ...
user374135's user avatar
3 votes
1 answer
2k views

IPsec IKEv2 succesful but Linux VTI does not work with SNAT

If you think troubleshooting IPsec is tedious, please forget about my logs and just let me know the implementation process, I'm still confused and any information is helpful. I removed SPIs and here ...
user avatar
1 vote
1 answer
945 views

Install Linux Kernel modules

I'm setting up IPSec VPN and I have met an error which upon searching I found the error actually means required kernel modules are missing. That prompted me to check that with lsmod and kmod list but ...
Stefano Mtangoo's user avatar
0 votes
1 answer
172 views

Ipsec tunnel with solaris10..what I miss?

I want to create a two Solaris10 tunnel encrypted with ipsec.Configuration is simple: 2 solaris10 nodes,lan not encrypted,tunnel encrypted. Lan is e1000g0 and tunnel is ip.tun0 Ip "clear" for node1 is ...
elbarna's user avatar
  • 12.8k