Questions tagged [ipsec]

The tag has no usage guidance, but it has a tag wiki.

Filter by
Sorted by
Tagged with
0
votes
1answer
52 views

StrongSwan IPSEC Policy

I have working connection A->B and B->C I need a little help after 3 days of trying, still can't get the desired effect what should I set in SITE B to get connection from A->C and C->A ...
0
votes
0answers
17 views

Connecting Windows 10 to IPSec/L2TP on Debian 10

Trying to get Windows 10 (192.168.1.11) to connect to IPSec/L2TP on Debian 10 (192.168.1.31). Windows firewall is off and I have added AssumeUDPEncapsulationContextOnSendRule (value 2) to the registry ...
2
votes
1answer
26 views

L2TP over IPSec on Debian 10

My Debian 10 box has a Wifi interface, wlx08beac0a6c1d running a WEP AP for old hardware that doens't wupport WPA. My main network is 192.168.1.0/24 and this interface is configured to be 192.168.2.1. ...
1
vote
0answers
35 views

Specify multiple right subnets on libreswan ipsec vpn using ikev1

I want to connect to a ipsec vpn server, and it allows me to connect to different ips (not a ip range), lets say y.y.y.1, y.y.y.2, y.y.y.3, y.y.y.4. I have the following config: conn toing-to-toing ...
0
votes
0answers
10 views

How do I create a VPN certificate (IPSec / IKEv2) which contains an FQDN as identifier?

Obviously, I have a serious lack of understanding of how X.509-based authentication in IPSec VPNs works. More than one time, I have setup VPNs, based on IPSec / IKEv2, where one of the gateways was ...
0
votes
0answers
19 views

How to enable fragmentation in ipsec tunnel for Ipv6 over ipv4

I have created a tunnel - IPv6 over IPv4 and things work fine. But if i send a large packets say 2000 bytes, it does not get transmitted. Is there something that i need to configure to allow large ...
-1
votes
1answer
446 views

Unable to connect to company VPN using L2TP over ipsec on Fedora 32

My company gave me ip address, username, password & pre-shared key to connect to vpn using L2TP. My workstation: Fedora 32 + Gnome. Installed xl2tpd, NetworkManager-l2tp, NetworkManager-l2tp-gnome,...
0
votes
0answers
92 views

IPSec multithreading via pcrypt worse than single thread

According to this document: https://www.strongswan.org/docs/Steffen_Klassert_Parallelizing_IPsec.pdf parallelizing IPSec using pcrypt kernel module will make the connection much more efficient (graphs ...
0
votes
0answers
34 views

Building strongSwan from source

I'm having huge trouble with getting strongswan to work. I'd like to try the newest version and customize it with plugins. I'm following the instruction available here: https://wiki.strongswan.org/...
1
vote
0answers
163 views

Ubuntu IKEv1 IPSec alternative to strongSwan

I'm trying to connect to my work VPN which uses IKEv1/IPSec and authenticates with a preshared key however it appears strongSwan has a PSK limitation restricting PSKs to 20 characters or longer (even ...
0
votes
0answers
141 views

strongSwan IPSec VPN connection - peer not responding

NOTE: IPs shown here are not the actual IPs I'm using. They are random just IPs. I have created a tunnel from an Ubuntu server to a Cisco device, using strongSwan. The tunnel looks ok. status of IKE ...
0
votes
0answers
211 views

No response from target (vpnc)

I'm setting up a new VPN, provided by my university, using vpnc. I enter all the details exactly as they tell me, including gateway domain, ID, secret group password, plus my Xauth details. Then run ...
0
votes
1answer
31 views

How do I route traffic back over a VPN to other servers

I am currently setting up an environment in 2 sites. all servers are linux/ubuntu. First site is my office and second site is AWS. I have 2 servers in AWS within a VPC with site to site VPN Web01 - ...
2
votes
0answers
52 views

OpenBSD ipsec routing

I have an OpenBSD VM that I wish to connect to my OpenBSD home router with ipsec. The objective is to have a secure channel between my home network and the VM. So I have the following ike conf' on ...
0
votes
0answers
28 views

improving IPSec traffic on Centos 7

I need suggestions for improving IPSec performance on Centos 7 with Strongswan. I got quite good server with 4 x X710 (10GbE). So far - with ~4 IPSec tunnels i'm able to get ~2GB/s of mixed in and out ...
1
vote
0answers
148 views

How to configure Libreswan IPsec for multiple connections?

I'm trying to set up Xauth IPsec on my linux machine. This IPsec server is behind a NAT. My goal is to have two types of users that can authenticate with a password and a PSK. The first group (...
0
votes
1answer
418 views

Roadwarrior scenario strongswan- Iphone setup

I'm working on trying to set up a roadwarrior client scenarion VPN with Stringswan on a raspberry pi. The server config looks like this: pi@raspberrypi:~ $ sudo cat /etc/ipsec.conf # ipsec.conf - ...
3
votes
1answer
691 views

IPsec IKEv2 succesful but Linux VTI does not work with SNAT

If you think troubleshooting IPsec is tedious, please forget about my logs and just let me know the implementation process, I'm still confused and any information is helpful. I removed SPIs and here ...
1
vote
1answer
422 views

Install Linux Kernel modules

I'm setting up IPSec VPN and I have met an error which upon searching I found the error actually means required kernel modules are missing. That prompted me to check that with lsmod and kmod list but ...
0
votes
1answer
97 views

Ipsec tunnel with solaris10..what I miss?

I want to create a two Solaris10 tunnel encrypted with ipsec.Configuration is simple: 2 solaris10 nodes,lan not encrypted,tunnel encrypted. Lan is e1000g0 and tunnel is ip.tun0 Ip "clear" for node1 is ...
0
votes
1answer
318 views

FreeBSD 11.2: how to add the aesni plugin to strongswan?

I installed strongswan using pkg install strongswan But now I've realized I need to have the aesni plugin enabled to optimize my IPsec tunnel. I've already enabled aesni at the OS level. The ...
0
votes
0answers
546 views

how to optimize performance of nfs running inside Strongswan ipsec transport on 10Gb network

Host1: Ubuntu 18.04 Host2: Freebsd 11.2 Here is my situation... I have 2 hosts on a 10G lan that have Strongswan IPsec transport configured between them to secure nfsv3. (Yes, I know nfsv3 is old ...
0
votes
0answers
128 views

Ask for password for IPSec VPN connection with netctl

TL;DR: How can I connect to a VPN with IPSec without writing the password and secret in the config file, but providing it from the outside (in my case a call to my password manager pass)? I already ...
2
votes
1answer
221 views

StrongSwan - ipsec pki command

I would like to know why the first time I run the "ipsec pki" command to get a private key this key is generated quickly, but the next time you try to run the same command to get this key because you ...
2
votes
1answer
1k views

Routing traffic through VPN using Raspberry PI

I have a setup like this: - Raspberry PI connected to router via LAN cable - Created a bridged connection between eth0 and wlan0 - using hostapd for wifi hotstop - configured l2tp/ipsec connection ...
6
votes
1answer
896 views

NAT outbound IPSEC packets using pf on FreeBSD 11 and StrongSwan x FortiGATE

I've been working for more than a week trying to get outbound packets nat'ed to fit a Security Association. This is my (example) scenario: LAN: 1.1.1.0/24 FreeBSD interface: xn0 (Amazon EC2 ...
0
votes
0answers
1k views

IPSec over L2TP: key derivation for pre-shared key failed

I set up a VPN to my Uni (using IPSec over L2TP) before using ~Ubunutu (GalliumOS), Strongswan, and NetworkManager, but this time I keep getting an error about my PSK, see this log output: Jun 22 11:...
-1
votes
1answer
103 views

Configure IPSec so the user identity is passed to iptables rule

Hi I'm pretty new to this so you'll have to be very explicit. I set up IPSec on CentOS so that I can VPN. User identities are stored in the /etc/ppp/chap-secrets, mainly because that's how things ...
0
votes
1answer
265 views

strongswan get RANDOM dns

I'm getting a really strange issue on fresh Fedora 28 MATE with an IKEv2 IPSEC VPN. First thing: this VPN is currently used by some other clients (some windows and my old Fedora 26) with NO issue. ...
0
votes
0answers
413 views

Masquerading strongswan ipsec ikev2 RAS clients

I've a VPS in sweden and I want to establish an IKEv2 RAS connection. The connection is established and a valid SA was created. Now I want to masquerade the traffic for 0.0.0.0/0 through the wan ...
2
votes
2answers
4k views

Connecting to 'unix"//var/run/charon.ctl' failed: connection refused

I have tried to find some answers on this and other sites trying to find out the problem, but my attempts failed. The rule is very simple: I want to establish my Ipsec tunnel when my Yubikey is ...
0
votes
0answers
421 views

How to create IPSec ethernet tunnel between two machines

I've been searching about IPSec. I know that there are two modes: transport layer and ethernet layer. I'd like to create an ethernet tunnel between two machines using AES and SHA256, and specify that ...
8
votes
1answer
9k views

IPsec VPN with strongSwan to FortiGate

I'm trying to connect to a FortiGate and access our continuous integration server via an IPsec VPN tunnel. I have no control over the FortiGate's configuration. On my laptop running Windows 10, I ...
0
votes
1answer
775 views

how overlapping subnet in 2 SA in strongswan determine which tunnel to go?

i have 2 tunnels of ikev1, with overlapping in leftsubnet and rightsubnet ,how the packet that send know to which tunnel it forward to tunnel first_4a010003 whay is that and how i decide i nwhch ...
0
votes
2answers
65 views

ipsec on linux,a simple and fast question

Is my first VPN, for testing this is my simple network scheme LAN1(private 10.10.0.0/24) --->VPN-----internet---<VPN---<LAN2(private 10.20.0.0/24) on /etc/ipsec.conf i use.. ... ...
4
votes
2answers
20k views

IPSec/L2TP VPN connection fails

I'm currently trying to establish a VPN connection to the network of my office using IPSec/L2TP with Ubuntu 16.04 (and/or Fedora 26) which fails with the following syslog entries (complete log below): ...
0
votes
1answer
154 views

using IPsec behind NAT in freebsd 7.3

I have a FreeBSD 7.3 server and I configured IPsec on it but now I need to put my server behind a NAT. I know in order to using NAT I should add IPsec_NAT_T to my kernel but the problem is IPsec_NAT_T ...
2
votes
1answer
3k views

enabling ipsec, ah and esp on CentOS with firewalld in place

On my CentOS I have firewalld running and my eth0 is in default zone. I use dockers for my services to communicate and in dockers I have enabled encryption. Docker creates an overlay network and uses ...
0
votes
1answer
2k views

How ping -b works?

I'm connected to a network switch directly. When I'm running ping -b 172.20.0.255 command, where 172.20.0.255 is my broadcast address, I'm getting the list of IPs iteratively: 64 bytes from 172.20.0....
1
vote
1answer
3k views

Why does /usr/sbin/racoon require inbound connections when a VPN is active on MacOS Sierra

Today, I was monitoring my network accesses using Little Snitch and connecting to an Avast SecureVPN when Little Snitch warned me that it was blocking inbound attempts to contact /usr/sbin/racoon. I ...
4
votes
2answers
16k views

IPSec over L2TP: received NO_PROPOSAL_CHOSEN error notify

Environment: # uname -a Linux shrimpwagon 3.16.0-4-amd64 #1 SMP Debian 3.16.39-1+deb8u1 (2017-02-22) x86_64 GNU/Linux I have already installed: # apt-get install strongswan xl2tpd I'm trying to ...
6
votes
1answer
14k views

Strongswan: several right subnets

I have a Strongswan installation on CentOS7 connecting to a Palo Alto router. I have no access to the config on the remote router. I want to configure two subnets on the other side - one is only a ...
3
votes
0answers
544 views

PING error through enc0: Frag needed and DF set (mtu = 0)

I'm up ipsec vpn client to remote host. Since the remote host accepts only one ip i'm up nat for local net on enc0. Ping from ipsec host is ok: PING 172.20.162.150 (172.20.162.150): 56 data bytes 64 ...
4
votes
0answers
2k views

IPSec end-point sends ICMP “unreachable; frag needed” messages while it's not routing

I have a simple site-to-site IPSec VPN where "server-A" is connected to a "fw-A" over an IPSec tunnel. In front of "server-A" there is a switch with has a 1500 byte MTU interface facing the server. ...
4
votes
1answer
2k views

Why use strongswan rather than native vpn support

As far as I understand, FreeBSD comes with the native ability to make vpn connections. Ist strongswan a package, that comes on top of the freebsd ipsec stack or is it a replacement?
1
vote
0answers
298 views

Is there a way to configure Libreswan to opportunistically create an IPSec SA with a remote host by preloading certificates or keys?

Is there a way to configure Libreswan to opportunistically create an IPSec SA with a remote host by preloading certificates or keys from hosts we trust? I'm looking for Libreswan configuration that ...
2
votes
0answers
666 views

Configuring IPSec with PSK

I'm struggling with IPSec while trying to configure to a Windows server. I need to use IPSec only in the 172.30.1.0/24 network. Linux Settings Running in AWS EB 4.4.15-25.57.amzn1.x86_64 GNU/Linux, ...
3
votes
1answer
7k views

strongSwan - gives error “no known IPsec stack detected, ignoring!”

I'm trying to connect to my university's VPN using strongSwan on Arch Linux. They have given example ipsec.conf and ipsec.secrets files and I've installed strongSwan from the AUR. As far as I'm aware,...
2
votes
0answers
3k views

CentOS IPsec: We cannot identify ourselves with either end of this connection [closed]

I have problem with IPsec on centOS. While adding a connection using ipsec auto --add cx It gives multiple ip addresses, using 127.0.0.1 on venet0 On using ipsec auto --up cx I get We cannot ...
1
vote
0answers
432 views

IPTables Rules for Routing VPN Traffic Through Proxy

I have a public VPN server up and running with StrongSwan 5.3.5. My VPN network is 10.10.10.0/24. The way that the VPN tunnel is setup currently is with split tunneling. What I'm trying to do is to ...