Questions tagged [ipsec]

The tag has no usage guidance, but it has a tag wiki.

Filter by
Sorted by
Tagged with
0 votes
0 answers
20 views

IPv6 transport security for a group of hosts with strongswan

I have two sets of about a dozen servers each at a different site. I know I have the option of configuring a VPN tunnel, but I'm trying to see if there is a viable way to use IPv6 "transport mode&...
  • 143
0 votes
1 answer
24 views

Specific need for tcp/ip routing with iptables

I would like to do the following thing: One server with public IP (say 1.2.3.4) and internal IP (say 192.168.1.1) Multiple VPN routers connecting (IPSEC and OPENVPN) (port 500/1194/4500) Internal VPN ...
0 votes
0 answers
29 views

Iptables - VPN firewall to firewall

I am new to the Linux world and I would like to ask a question regarding the iptables firewall. A customer asks me to create a firewall-to-firewall connection to their VPN. What rules should I set to ...
  • 1
1 vote
0 answers
26 views

Weird Ipsec behavior

I am running into something interesting which I am not able to explain well. I brought up a simple Ubuntu 20.04 box and attempting to protect all traffic via an IPSec tunnel. I am not using VTI or ...
  • 41
0 votes
1 answer
23 views

Ipsec setting button is seen disabled while adding VPN on Suse 15.3

Not able to enable Ipsec settings buttons, as per some suggestion i have tried installing stringswan package even that didn't resolve the issue Anyone having idea please help to resolve this at the ...
1 vote
1 answer
140 views

Undoing full cone NAT using IPtables for IPsec

I currently have a free VPS hosted in Oracle Cloud. This machine sits in a so-called "Virtual Cloud Network", which is just a virtual LAN with an address in the range of 10.0.0.0/8 (10.0.0....
0 votes
0 answers
41 views

OpenBSD ipsec routing working only in one direction

I have an OpenBSD Server and a Ubiquity Edge Router connected via ipsec & PSK. The problem is that the tunnel is working only in one direction: from Edge Router to OpenBSD. When i try to ping 192....
0 votes
1 answer
464 views

IPsec PSK VPN with strongSwan to FortiGate with one-time-password(Fortitoken)

So I am using Strongswan to connect to remote Fortigate since native Fortinet VPN client does not support IPsec. I also have hardware FortiToken 200 that provides a OTP. My current config is the ...
  • 1
0 votes
1 answer
188 views

Redirect DNS traffic via tunnel interface, all other traffic to use kernel routing table

How do I redirect only DNS traffic to use a tunnel interface when active? Any other type of traffic should use the kernel's routing table instead. Whenever the tunnel interface is not active, DNS ...
  • 428
0 votes
0 answers
71 views

IPSec VPN client connection fails

My router VPN setting for my user: The router supports: IPSec with ESP, IKEv1 Does NOT support: Authentification Header, AH and Perfect Forward Security, PFS Linux Centos 8 Secret: sabf6... ...
  • 452
-1 votes
1 answer
30 views

Possible to establish Ipsec connection when configure with different aes encryption bit size

I want to setup ipsec in my network, for that i am using racoon in linux devices. If i configure racoon with 2 different PC with different aes encryption will establish connection ? for eg. If PC-A ...
0 votes
1 answer
324 views

Random SSH Agent Generates on Boot in tmp Directory Even with Networking Disabled

On a recently installed Debian system I noticed that every boot, even with no networking, a folder and empty socket file are generated in /tmp/ssh-(random_letters)/agent.xxx. On every boot the random ...
0 votes
1 answer
633 views

StrongSwan IPsec VPN slow connection speed on Manjaro Linux(Arch)

On Manjaro Linux (arch), the speed of connecting to corporate resources under vpn (ipsec) dropped to almost 0, but everything was fine before I have already tried different configurations, but nothing ...
0 votes
0 answers
69 views

IPsecVPN + PPP over ssh routing problem

I have two Debian hosts A and B. On A, I start IPsec VPN and my VPN clients can connect to it. In the same time, I start a PPP over ssh between A and B. So on host A, I can see ppp0 as the new Iface ...
1 vote
1 answer
384 views

rekey ipsec using "ip xfrm"

I built a simple ipsec between two Linux boxes: SHAKEY=0xd3413c31c7d19c93d04db1c6ae8d73d9a64910c2e76297129acde44aaa9de5c5 AESKEY=0xcd191fac520878852e15647dce3456ba9857e2dfd6ed56421eb50cb58d7a1e5a SPI=...
  • 21
0 votes
1 answer
627 views

Why does ipsec want me to disable redirects?

I've just configured a vpn connection (l2tp), but when I run ipsec verify I get: $ ipsec verify ... NETKEY: Testing XFRM related proc values ICMP default/send_redirects [NOT ...
  • 2,953
1 vote
1 answer
2k views

strongswan: received NO_PROPOSAL_CHOSEN notify error

I have two private network. network A router: TL-WVR3200L public IP: 223.71.239.218 subnet: 192.168.1.0/24 IPSec config: network B router: TL-WDR5620 public IP: 119.90.63.105 subnet: 192.168.100.0/...
  • 223
1 vote
1 answer
380 views

strongswan: What is the difference between left and leftid?

This tutorial use left parameter when setup strongswan, while this tutorial also use leftid parameter. What is the difference between left and leftid? Update I setup strongswan on aws ec2 with the ...
  • 223
0 votes
1 answer
78 views

Strongswan tunnel is up but not pinging to each others

im facing weird problem i have configured site to site VPN tunnel on Centos 8 on the same network and its connected but unable to ping each others here is below my configuration and status. Site A [...
0 votes
2 answers
49 views

How to fix csv string format

I have line of ipsec statusall <conn_name> output. Depends on traffic flow it could be: sr_mesh_aws_22{10}: AES_CBC_256/HMAC_SHA2_256_128/MODP_1024, 0 bytes_i, 0 bytes_o, rekeying in 32 minutes ...
  • 162
0 votes
1 answer
288 views

StrongSwan IPSEC Policy

I have working connection A->B and B->C I need a little help after 3 days of trying, still can't get the desired effect what should I set in SITE B to get connection from A->C and C->A ...
  • 1
0 votes
1 answer
747 views

Connecting Windows 10 to IPSec/L2TP on Debian 10

Trying to get Windows 10 (192.168.1.11) to connect to IPSec/L2TP on Debian 10 (192.168.1.31). Windows firewall is off and I have added AssumeUDPEncapsulationContextOnSendRule (value 2) to the registry ...
2 votes
2 answers
931 views

L2TP over IPSec on Debian 10

My Debian 10 box has a Wifi interface, wlx08beac0a6c1d running a WEP AP for old hardware that doens't wupport WPA. My main network is 192.168.1.0/24 and this interface is configured to be 192.168.2.1. ...
1 vote
0 answers
643 views

Specify multiple right subnets on libreswan ipsec vpn using ikev1

I want to connect to a ipsec vpn server, and it allows me to connect to different ips (not a ip range), lets say y.y.y.1, y.y.y.2, y.y.y.3, y.y.y.4. I have the following config: conn toing-to-toing ...
-1 votes
1 answer
3k views

Unable to connect to company VPN using L2TP over ipsec on Fedora 32

My company gave me ip address, username, password & pre-shared key to connect to vpn using L2TP. My workstation: Fedora 32 + Gnome. Installed xl2tpd, NetworkManager-l2tp, NetworkManager-l2tp-gnome,...
0 votes
0 answers
565 views

IPSec multithreading via pcrypt worse than single thread

According to this document: https://www.strongswan.org/docs/Steffen_Klassert_Parallelizing_IPsec.pdf parallelizing IPSec using pcrypt kernel module will make the connection much more efficient (graphs ...
  • 111
0 votes
0 answers
256 views

Building strongSwan from source

I'm having huge trouble with getting strongswan to work. I'd like to try the newest version and customize it with plugins. I'm following the instruction available here: https://wiki.strongswan.org/...
  • 111
1 vote
0 answers
1k views

Ubuntu IKEv1 IPSec alternative to strongSwan

I'm trying to connect to my work VPN which uses IKEv1/IPSec and authenticates with a preshared key however it appears strongSwan has a PSK limitation restricting PSKs to 20 characters or longer (even ...
  • 11
0 votes
0 answers
757 views

No response from target (vpnc)

I'm setting up a new VPN, provided by my university, using vpnc. I enter all the details exactly as they tell me, including gateway domain, ID, secret group password, plus my Xauth details. Then run ...
0 votes
1 answer
174 views

How do I route traffic back over a VPN to other servers

I am currently setting up an environment in 2 sites. all servers are linux/ubuntu. First site is my office and second site is AWS. I have 2 servers in AWS within a VPC with site to site VPN Web01 - ...
2 votes
0 answers
124 views

OpenBSD ipsec routing

I have an OpenBSD VM that I wish to connect to my OpenBSD home router with ipsec. The objective is to have a secure channel between my home network and the VM. So I have the following ike conf' on ...
1 vote
0 answers
626 views

How to configure Libreswan IPsec for multiple connections?

I'm trying to set up Xauth IPsec on my linux machine. This IPsec server is behind a NAT. My goal is to have two types of users that can authenticate with a password and a PSK. The first group (...
0 votes
1 answer
650 views

Roadwarrior scenario strongswan- Iphone setup

I'm working on trying to set up a roadwarrior client scenarion VPN with Stringswan on a raspberry pi. The server config looks like this: pi@raspberrypi:~ $ sudo cat /etc/ipsec.conf # ipsec.conf - ...
3 votes
1 answer
1k views

IPsec IKEv2 succesful but Linux VTI does not work with SNAT

If you think troubleshooting IPsec is tedious, please forget about my logs and just let me know the implementation process, I'm still confused and any information is helpful. I removed SPIs and here ...
1 vote
1 answer
690 views

Install Linux Kernel modules

I'm setting up IPSec VPN and I have met an error which upon searching I found the error actually means required kernel modules are missing. That prompted me to check that with lsmod and kmod list but ...
0 votes
1 answer
147 views

Ipsec tunnel with solaris10..what I miss?

I want to create a two Solaris10 tunnel encrypted with ipsec.Configuration is simple: 2 solaris10 nodes,lan not encrypted,tunnel encrypted. Lan is e1000g0 and tunnel is ip.tun0 Ip "clear" for node1 is ...
  • 11.2k
0 votes
1 answer
484 views

FreeBSD 11.2: how to add the aesni plugin to strongswan?

I installed strongswan using pkg install strongswan But now I've realized I need to have the aesni plugin enabled to optimize my IPsec tunnel. I've already enabled aesni at the OS level. The ...
0 votes
0 answers
1k views

how to optimize performance of nfs running inside Strongswan ipsec transport on 10Gb network

Host1: Ubuntu 18.04 Host2: Freebsd 11.2 Here is my situation... I have 2 hosts on a 10G lan that have Strongswan IPsec transport configured between them to secure nfsv3. (Yes, I know nfsv3 is old ...
0 votes
0 answers
212 views

Ask for password for IPSec VPN connection with netctl

TL;DR: How can I connect to a VPN with IPSec without writing the password and secret in the config file, but providing it from the outside (in my case a call to my password manager pass)? I already ...
  • 181
2 votes
1 answer
378 views

StrongSwan - ipsec pki command

I would like to know why the first time I run the "ipsec pki" command to get a private key this key is generated quickly, but the next time you try to run the same command to get this key because you ...
2 votes
1 answer
2k views

Routing traffic through VPN using Raspberry PI

I have a setup like this: - Raspberry PI connected to router via LAN cable - Created a bridged connection between eth0 and wlan0 - using hostapd for wifi hotstop - configured l2tp/ipsec connection ...
  • 121
6 votes
1 answer
1k views

NAT outbound IPSEC packets using pf on FreeBSD 11 and StrongSwan x FortiGATE

I've been working for more than a week trying to get outbound packets nat'ed to fit a Security Association. This is my (example) scenario: LAN: 1.1.1.0/24 FreeBSD interface: xn0 (Amazon EC2 ...
0 votes
0 answers
2k views

IPSec over L2TP: key derivation for pre-shared key failed

I set up a VPN to my Uni (using IPSec over L2TP) before using ~Ubunutu (GalliumOS), Strongswan, and NetworkManager, but this time I keep getting an error about my PSK, see this log output: Jun 22 11:...
  • 251
-1 votes
1 answer
242 views

Configure IPSec so the user identity is passed to iptables rule

Hi I'm pretty new to this so you'll have to be very explicit. I set up IPSec on CentOS so that I can VPN. User identities are stored in the /etc/ppp/chap-secrets, mainly because that's how things ...
0 votes
1 answer
292 views

strongswan get RANDOM dns

I'm getting a really strange issue on fresh Fedora 28 MATE with an IKEv2 IPSEC VPN. First thing: this VPN is currently used by some other clients (some windows and my old Fedora 26) with NO issue. ...
  • 126
1 vote
0 answers
622 views

Masquerading strongswan ipsec ikev2 RAS clients

I've a VPS in sweden and I want to establish an IKEv2 RAS connection. The connection is established and a valid SA was created. Now I want to masquerade the traffic for 0.0.0.0/0 through the wan ...
2 votes
2 answers
6k views

Connecting to 'unix"//var/run/charon.ctl' failed: connection refused

I have tried to find some answers on this and other sites trying to find out the problem, but my attempts failed. The rule is very simple: I want to establish my Ipsec tunnel when my Yubikey is ...
0 votes
0 answers
502 views

How to create IPSec ethernet tunnel between two machines

I've been searching about IPSec. I know that there are two modes: transport layer and ethernet layer. I'd like to create an ethernet tunnel between two machines using AES and SHA256, and specify that ...
8 votes
1 answer
13k views

IPsec VPN with strongSwan to FortiGate

I'm trying to connect to a FortiGate and access our continuous integration server via an IPsec VPN tunnel. I have no control over the FortiGate's configuration. On my laptop running Windows 10, I ...
0 votes
1 answer
1k views

how overlapping subnet in 2 SA in strongswan determine which tunnel to go?

i have 2 tunnels of ikev1, with overlapping in leftsubnet and rightsubnet ,how the packet that send know to which tunnel it forward to tunnel first_4a010003 whay is that and how i decide i nwhch ...