Questions tagged [ipsec]

The tag has no usage guidance, but it has a tag wiki.

Filter by
Sorted by
Tagged with
0
votes
0answers
15 views

improving IPSec traffic on Centos 7

I need suggestions for improving IPSec performance on Centos 7 with Strongswan. I got quite good server with 4 x X710 (10GbE). So far - with ~4 IPSec tunnels i'm able to get ~2GB/s of mixed in and out ...
1
vote
0answers
53 views

How to configure Libreswan IPsec for multiple connections?

I'm trying to set up Xauth IPsec on my linux machine. This IPsec server is behind a NAT. My goal is to have two types of users that can authenticate with a password and a PSK. The first group (...
0
votes
1answer
195 views

Roadwarrior scenario strongswan- Iphone setup

I'm working on trying to set up a roadwarrior client scenarion VPN with Stringswan on a raspberry pi. The server config looks like this: pi@raspberrypi:~ $ sudo cat /etc/ipsec.conf # ipsec.conf - ...
0
votes
0answers
79 views

capture phase 1 of IPSEC with tcpdump

I'm capturing the incoming/outgoing traffic from GW-A/GW-B on GW-A. The way I'm doing so is by using tcpdump with these options" tcpdump -i any port 500. This way it gives me the renegotiation ...
3
votes
1answer
306 views

IPsec IKEv2 succesful but Linux VTI does not work with SNAT

If you think troubleshooting IPsec is tedious, please forget about my logs and just let me know the implementation process, I'm still confused and any information is helpful. I removed SPIs and here ...
0
votes
0answers
34 views

ASA/Racoon VPN setup (FreeBSD) troubleshooting - sanity check setup

I am setting up VPN between a Cisco ASA and a freebsd server as our routing/firewall appliance. The server is using racoon to set the VPN and is already used for another VPN that was set up years ago ...
0
votes
0answers
16 views

Why is netfilter not applying rule to these packets?

There are 4 servers: A - partner server with public IP B - our server with public IP C - our another server, but in LAN D - external third party server for testing I control B, C and D. There is GRE ...
0
votes
0answers
35 views

routing vpn connection via gateway1 but vpn traffic via gateway2

Situation: network via dhcp internet gateway 192.168.x.1 dhcp server 192.168.x.10 dhcp gateway 192.168.x.2 => this gateway has a permanent vpn tunnel via openvpn to vpn provider, so I want to ...
1
vote
1answer
263 views

Install Linux Kernel modules

I'm setting up IPSec VPN and I have met an error which upon searching I found the error actually means required kernel modules are missing. That prompted me to check that with lsmod and kmod list but ...
0
votes
1answer
81 views

Ipsec tunnel with solaris10..what I miss?

I want to create a two Solaris10 tunnel encrypted with ipsec.Configuration is simple: 2 solaris10 nodes,lan not encrypted,tunnel encrypted. Lan is e1000g0 and tunnel is ip.tun0 Ip "clear" for node1 is ...
0
votes
1answer
233 views

FreeBSD 11.2: how to add the aesni plugin to strongswan?

I installed strongswan using pkg install strongswan But now I've realized I need to have the aesni plugin enabled to optimize my IPsec tunnel. I've already enabled aesni at the OS level. The ...
0
votes
0answers
353 views

how to optimize performance of nfs running inside Strongswan ipsec transport on 10Gb network

Host1: Ubuntu 18.04 Host2: Freebsd 11.2 Here is my situation... I have 2 hosts on a 10G lan that have Strongswan IPsec transport configured between them to secure nfsv3. (Yes, I know nfsv3 is old ...
0
votes
0answers
79 views

Ask for password for IPSec VPN connection with netctl

TL;DR: How can I connect to a VPN with IPSec without writing the password and secret in the config file, but providing it from the outside (in my case a call to my password manager pass)? I already ...
2
votes
1answer
164 views

StrongSwan - ipsec pki command

I would like to know why the first time I run the "ipsec pki" command to get a private key this key is generated quickly, but the next time you try to run the same command to get this key because you ...
2
votes
1answer
501 views

Routing traffic through VPN using Raspberry PI

I have a setup like this: - Raspberry PI connected to router via LAN cable - Created a bridged connection between eth0 and wlan0 - using hostapd for wifi hotstop - configured l2tp/ipsec connection ...
6
votes
1answer
694 views

NAT outbound IPSEC packets using pf on FreeBSD 11 and StrongSwan x FortiGATE

I've been working for more than a week trying to get outbound packets nat'ed to fit a Security Association. This is my (example) scenario: LAN: 1.1.1.0/24 FreeBSD interface: xn0 (Amazon EC2 ...
0
votes
0answers
834 views

IPSec over L2TP: key derivation for pre-shared key failed

I set up a VPN to my Uni (using IPSec over L2TP) before using ~Ubunutu (GalliumOS), Strongswan, and NetworkManager, but this time I keep getting an error about my PSK, see this log output: Jun 22 11:...
-1
votes
1answer
86 views

Configure IPSec so the user identity is passed to iptables rule

Hi I'm pretty new to this so you'll have to be very explicit. I set up IPSec on CentOS so that I can VPN. User identities are stored in the /etc/ppp/chap-secrets, mainly because that's how things ...
0
votes
1answer
247 views

strongswan get RANDOM dns

I'm getting a really strange issue on fresh Fedora 28 MATE with an IKEv2 IPSEC VPN. First thing: this VPN is currently used by some other clients (some windows and my old Fedora 26) with NO issue. ...
0
votes
0answers
337 views

Masquerading strongswan ipsec ikev2 RAS clients

I've a VPS in sweden and I want to establish an IKEv2 RAS connection. The connection is established and a valid SA was created. Now I want to masquerade the traffic for 0.0.0.0/0 through the wan ...
2
votes
2answers
3k views

Connecting to 'unix"//var/run/charon.ctl' failed: connection refused

I have tried to find some answers on this and other sites trying to find out the problem, but my attempts failed. The rule is very simple: I want to establish my Ipsec tunnel when my Yubikey is ...
0
votes
0answers
399 views

How to create IPSec ethernet tunnel between two machines

I've been searching about IPSec. I know that there are two modes: transport layer and ethernet layer. I'd like to create an ethernet tunnel between two machines using AES and SHA256, and specify that ...
7
votes
1answer
7k views

IPsec VPN with strongSwan to FortiGate

I'm trying to connect to a FortiGate and access our continuous integration server via an IPsec VPN tunnel. I have no control over the FortiGate's configuration. On my laptop running Windows 10, I ...
0
votes
1answer
580 views

how overlapping subnet in 2 SA in strongswan determine which tunnel to go?

i have 2 tunnels of ikev1, with overlapping in leftsubnet and rightsubnet ,how the packet that send know to which tunnel it forward to tunnel first_4a010003 whay is that and how i decide i nwhch ...
0
votes
2answers
58 views

ipsec on linux,a simple and fast question

Is my first VPN, for testing this is my simple network scheme LAN1(private 10.10.0.0/24) --->VPN-----internet---<VPN---<LAN2(private 10.20.0.0/24) on /etc/ipsec.conf i use.. ... ...
4
votes
2answers
16k views

IPSec/L2TP VPN connection fails

I'm currently trying to establish a VPN connection to the network of my office using IPSec/L2TP with Ubuntu 16.04 (and/or Fedora 26) which fails with the following syslog entries (complete log below): ...
1
vote
1answer
146 views

using IPsec behind NAT in freebsd 7.3

I have a FreeBSD 7.3 server and I configured IPsec on it but now I need to put my server behind a NAT. I know in order to using NAT I should add IPsec_NAT_T to my kernel but the problem is IPsec_NAT_T ...
2
votes
1answer
2k views

enabling ipsec, ah and esp on CentOS with firewalld in place

On my CentOS I have firewalld running and my eth0 is in default zone. I use dockers for my services to communicate and in dockers I have enabled encryption. Docker creates an overlay network and uses ...
0
votes
1answer
2k views

How ping -b works?

I'm connected to a network switch directly. When I'm running ping -b 172.20.0.255 command, where 172.20.0.255 is my broadcast address, I'm getting the list of IPs iteratively: 64 bytes from 172.20.0....
1
vote
1answer
3k views

Why does /usr/sbin/racoon require inbound connections when a VPN is active on MacOS Sierra

Today, I was monitoring my network accesses using Little Snitch and connecting to an Avast SecureVPN when Little Snitch warned me that it was blocking inbound attempts to contact /usr/sbin/racoon. I ...
4
votes
2answers
13k views

IPSec over L2TP: received NO_PROPOSAL_CHOSEN error notify

Environment: # uname -a Linux shrimpwagon 3.16.0-4-amd64 #1 SMP Debian 3.16.39-1+deb8u1 (2017-02-22) x86_64 GNU/Linux I have already installed: # apt-get install strongswan xl2tpd I'm trying to ...
6
votes
1answer
11k views

Strongswan: several right subnets

I have a Strongswan installation on CentOS7 connecting to a Palo Alto router. I have no access to the config on the remote router. I want to configure two subnets on the other side - one is only a ...
3
votes
0answers
482 views

PING error through enc0: Frag needed and DF set (mtu = 0)

I'm up ipsec vpn client to remote host. Since the remote host accepts only one ip i'm up nat for local net on enc0. Ping from ipsec host is ok: PING 172.20.162.150 (172.20.162.150): 56 data bytes 64 ...
4
votes
0answers
1k views

IPSec end-point sends ICMP “unreachable; frag needed” messages while it's not routing

I have a simple site-to-site IPSec VPN where "server-A" is connected to a "fw-A" over an IPSec tunnel. In front of "server-A" there is a switch with has a 1500 byte MTU interface facing the server. ...
4
votes
1answer
2k views

Why use strongswan rather than native vpn support

As far as I understand, FreeBSD comes with the native ability to make vpn connections. Ist strongswan a package, that comes on top of the freebsd ipsec stack or is it a replacement?
1
vote
0answers
286 views

Is there a way to configure Libreswan to opportunistically create an IPSec SA with a remote host by preloading certificates or keys?

Is there a way to configure Libreswan to opportunistically create an IPSec SA with a remote host by preloading certificates or keys from hosts we trust? I'm looking for Libreswan configuration that ...
2
votes
0answers
610 views

Configuring IPSec with PSK

I'm struggling with IPSec while trying to configure to a Windows server. I need to use IPSec only in the 172.30.1.0/24 network. Linux Settings Running in AWS EB 4.4.15-25.57.amzn1.x86_64 GNU/Linux, ...
3
votes
1answer
6k views

strongSwan - gives error “no known IPsec stack detected, ignoring!”

I'm trying to connect to my university's VPN using strongSwan on Arch Linux. They have given example ipsec.conf and ipsec.secrets files and I've installed strongSwan from the AUR. As far as I'm aware,...
2
votes
0answers
2k views

CentOS IPsec: We cannot identify ourselves with either end of this connection [closed]

I have problem with IPsec on centOS. While adding a connection using ipsec auto --add cx It gives multiple ip addresses, using 127.0.0.1 on venet0 On using ipsec auto --up cx I get We cannot ...
1
vote
0answers
374 views

IPTables Rules for Routing VPN Traffic Through Proxy

I have a public VPN server up and running with StrongSwan 5.3.5. My VPN network is 10.10.10.0/24. The way that the VPN tunnel is setup currently is with split tunneling. What I'm trying to do is to ...
1
vote
1answer
661 views

StrongSwan 5.2.1 on Debian Jessie vs Juniper SSG 550M - Short connection life time

We are trying to establish a persistent VPN connection against a Juniper box. However there is some misconfiguration. When we start the StrongSwan service, the tunnel is up and all traffic go fine. ...
3
votes
0answers
474 views

Apparmor: does complain mode enable capability dac_override?

I'm trying to adjust an AppArmor profile after I found some guidance that it should be disabled for my use-case (not too happy running an IPSec daemon naked). So I've tried to put it in complain mode ...
2
votes
0answers
163 views

Encrypting Linux LPD to Windows (ipsec/ssh tunnel/other)

I have a Windows print server running LPD. My Linux clients are all configured to point to a separate Linux server running Cups (TCP 631), and then the Cups config points to an LPD URI which directs ...
2
votes
1answer
1k views

Connect as client to Ipsec with OpenSuse Linux

A former co-worker established a set of AWS instances. One of these is an IPSec VSetup a IPSec/L2TP VPN server. I can SSH into this ec2 instance, and on this machine. I do have a username and ...
1
vote
1answer
393 views

IPsec tunnel blocks after a while without error. Where to find details?

There is an IPsec Tunnel created with OpenSwan that works perfectly well packets going through answers received etc until at some point in time traffic stops. I can regenerate the tunnel doing ipsec ...
1
vote
1answer
653 views

How to run a command when a libreswan tunnel connects?

I would like to run a command (or wake up a process, or similar) when libreswan succeeds in connecting an IPSec tunnel (or connection, to use the configuration file's term). My requirement is to run ...
3
votes
1answer
4k views

Cannot connect to VPN with ipsec after upgrade

I'm using Debian Stretch, which is current testing release. Some time ago I set up a VPN connection using IPsec and it worked correctly. It suddenly stopped. It is possible that in the meantime some ...
3
votes
1answer
2k views

ipsec rightsubnet to wide, cannot override routing table | IPSec route some packets 'locally', not via tunnel; ip xfrm change?

I'd like to override part of the (IPSec) routing table (routing to 10.108.0.0/16 locally via eth0, not via IPSec tunnel) my IPSEC config conn vpc type=tunnel authby=secret left=172.16....
2
votes
0answers
2k views

IPSec VPN problem with tunnel [closed]

My connection IPSec have problem. This is my Diagram. Connect VPN is not OK must be restart IPsec ==> OK and after that not OK root@vungtau:~# telnet 10.225.198.3 3900 Trying 10.225.198.3... ...
2
votes
1answer
710 views

unable to add IPSec IKEv2 profile on Fedora 22/23

it should be something really simple, but I cannot add IPSec IKEv2 profile in Network Manager settings, Add button is greyed out. Does anyone know?