Questions tagged [ipsec]

The tag has no usage guidance, but it has a tag wiki.

Filter by
Sorted by
Tagged with
0 votes
1 answer
13 views

Ipsec setting button is seen disabled while adding VPN on Suse 15.3

Not able to enable Ipsec settings buttons, as per some suggestion i have tried installing stringswan package even that didn't resolve the issue Anyone having idea please help to resolve this at the ...
user avatar
1 vote
1 answer
58 views

Undoing full cone NAT using IPtables for IPsec

I currently have a free VPS hosted in Oracle Cloud. This machine sits in a so-called "Virtual Cloud Network", which is just a virtual LAN with an address in the range of 10.0.0.0/8 (10.0.0....
user avatar
0 votes
0 answers
22 views

OpenBSD ipsec routing working only in one direction

I have an OpenBSD Server and a Ubiquity Edge Router connected via ipsec & PSK. The problem is that the tunnel is working only in one direction: from Edge Router to OpenBSD. When i try to ping 192....
user avatar
0 votes
1 answer
211 views

IPsec PSK VPN with strongSwan to FortiGate with one-time-password(Fortitoken)

So I am using Strongswan to connect to remote Fortigate since native Fortinet VPN client does not support IPsec. I also have hardware FortiToken 200 that provides a OTP. My current config is the ...
user avatar
  • 1
0 votes
1 answer
83 views

Redirect DNS traffic via tunnel interface, all other traffic to use kernel routing table

How do I redirect only DNS traffic to use a tunnel interface when active? Any other type of traffic should use the kernel's routing table instead. Whenever the tunnel interface is not active, DNS ...
user avatar
  • 285
0 votes
0 answers
37 views

IPSec VPN client connection fails

My router VPN setting for my user: The router supports: IPSec with ESP, IKEv1 Does NOT support: Authentification Header, AH and Perfect Forward Security, PFS Linux Centos 8 Secret: sabf6... ...
user avatar
  • 432
-1 votes
1 answer
25 views

Possible to establish Ipsec connection when configure with different aes encryption bit size

I want to setup ipsec in my network, for that i am using racoon in linux devices. If i configure racoon with 2 different PC with different aes encryption will establish connection ? for eg. If PC-A ...
user avatar
0 votes
1 answer
179 views

Random SSH Agent Generates on Boot in tmp Directory Even with Networking Disabled

On a recently installed Debian system I noticed that every boot, even with no networking, a folder and empty socket file are generated in /tmp/ssh-(random_letters)/agent.xxx. On every boot the random ...
user avatar
0 votes
0 answers
35 views

VPN Tunnel Through Strongswan between Clients on same Network

I have a client with ip(192.168.137.19) behind my left ubuntu server and have another client with ip(192.168.137.20) behind my right ubuntu server. I have to build a vpn tunnel between two clients and ...
user avatar
0 votes
1 answer
492 views

StrongSwan IPsec VPN slow connection speed on Manjaro Linux(Arch)

On Manjaro Linux (arch), the speed of connecting to corporate resources under vpn (ipsec) dropped to almost 0, but everything was fine before I have already tried different configurations, but nothing ...
user avatar
0 votes
0 answers
48 views

IPsecVPN + PPP over ssh routing problem

I have two Debian hosts A and B. On A, I start IPsec VPN and my VPN clients can connect to it. In the same time, I start a PPP over ssh between A and B. So on host A, I can see ppp0 as the new Iface ...
user avatar
1 vote
1 answer
263 views

rekey ipsec using "ip xfrm"

I built a simple ipsec between two Linux boxes: SHAKEY=0xd3413c31c7d19c93d04db1c6ae8d73d9a64910c2e76297129acde44aaa9de5c5 AESKEY=0xcd191fac520878852e15647dce3456ba9857e2dfd6ed56421eb50cb58d7a1e5a SPI=...
user avatar
  • 21
0 votes
1 answer
451 views

Why does ipsec want me to disable redirects?

I've just configured a vpn connection (l2tp), but when I run ipsec verify I get: $ ipsec verify ... NETKEY: Testing XFRM related proc values ICMP default/send_redirects [NOT ...
user avatar
  • 2,893
1 vote
1 answer
1k views

strongswan: received NO_PROPOSAL_CHOSEN notify error

I have two private network. network A router: TL-WVR3200L public IP: 223.71.239.218 subnet: 192.168.1.0/24 IPSec config: network B router: TL-WDR5620 public IP: 119.90.63.105 subnet: 192.168.100.0/...
user avatar
  • 223
1 vote
1 answer
245 views

strongswan: What is the difference between left and leftid?

This tutorial use left parameter when setup strongswan, while this tutorial also use leftid parameter. What is the difference between left and leftid? Update I setup strongswan on aws ec2 with the ...
user avatar
  • 223
0 votes
1 answer
39 views

Strongswan tunnel is up but not pinging to each others

im facing weird problem i have configured site to site VPN tunnel on Centos 8 on the same network and its connected but unable to ping each others here is below my configuration and status. Site A [...
user avatar
0 votes
2 answers
44 views

How to fix csv string format

I have line of ipsec statusall <conn_name> output. Depends on traffic flow it could be: sr_mesh_aws_22{10}: AES_CBC_256/HMAC_SHA2_256_128/MODP_1024, 0 bytes_i, 0 bytes_o, rekeying in 32 minutes ...
user avatar
  • 162
0 votes
1 answer
199 views

StrongSwan IPSEC Policy

I have working connection A->B and B->C I need a little help after 3 days of trying, still can't get the desired effect what should I set in SITE B to get connection from A->C and C->A ...
user avatar
  • 1
0 votes
1 answer
591 views

Connecting Windows 10 to IPSec/L2TP on Debian 10

Trying to get Windows 10 (192.168.1.11) to connect to IPSec/L2TP on Debian 10 (192.168.1.31). Windows firewall is off and I have added AssumeUDPEncapsulationContextOnSendRule (value 2) to the registry ...
user avatar
2 votes
1 answer
771 views

L2TP over IPSec on Debian 10

My Debian 10 box has a Wifi interface, wlx08beac0a6c1d running a WEP AP for old hardware that doens't wupport WPA. My main network is 192.168.1.0/24 and this interface is configured to be 192.168.2.1. ...
user avatar
1 vote
0 answers
482 views

Specify multiple right subnets on libreswan ipsec vpn using ikev1

I want to connect to a ipsec vpn server, and it allows me to connect to different ips (not a ip range), lets say y.y.y.1, y.y.y.2, y.y.y.3, y.y.y.4. I have the following config: conn toing-to-toing ...
user avatar
-1 votes
1 answer
2k views

Unable to connect to company VPN using L2TP over ipsec on Fedora 32

My company gave me ip address, username, password & pre-shared key to connect to vpn using L2TP. My workstation: Fedora 32 + Gnome. Installed xl2tpd, NetworkManager-l2tp, NetworkManager-l2tp-gnome,...
user avatar
0 votes
0 answers
475 views

IPSec multithreading via pcrypt worse than single thread

According to this document: https://www.strongswan.org/docs/Steffen_Klassert_Parallelizing_IPsec.pdf parallelizing IPSec using pcrypt kernel module will make the connection much more efficient (graphs ...
user avatar
0 votes
0 answers
193 views

Building strongSwan from source

I'm having huge trouble with getting strongswan to work. I'd like to try the newest version and customize it with plugins. I'm following the instruction available here: https://wiki.strongswan.org/...
user avatar
1 vote
0 answers
954 views

Ubuntu IKEv1 IPSec alternative to strongSwan

I'm trying to connect to my work VPN which uses IKEv1/IPSec and authenticates with a preshared key however it appears strongSwan has a PSK limitation restricting PSKs to 20 characters or longer (even ...
user avatar
  • 11
0 votes
0 answers
679 views

No response from target (vpnc)

I'm setting up a new VPN, provided by my university, using vpnc. I enter all the details exactly as they tell me, including gateway domain, ID, secret group password, plus my Xauth details. Then run ...
user avatar
0 votes
1 answer
125 views

How do I route traffic back over a VPN to other servers

I am currently setting up an environment in 2 sites. all servers are linux/ubuntu. First site is my office and second site is AWS. I have 2 servers in AWS within a VPC with site to site VPN Web01 - ...
user avatar
2 votes
0 answers
102 views

OpenBSD ipsec routing

I have an OpenBSD VM that I wish to connect to my OpenBSD home router with ipsec. The objective is to have a secure channel between my home network and the VM. So I have the following ike conf' on ...
user avatar
1 vote
0 answers
541 views

How to configure Libreswan IPsec for multiple connections?

I'm trying to set up Xauth IPsec on my linux machine. This IPsec server is behind a NAT. My goal is to have two types of users that can authenticate with a password and a PSK. The first group (...
user avatar
0 votes
1 answer
635 views

Roadwarrior scenario strongswan- Iphone setup

I'm working on trying to set up a roadwarrior client scenarion VPN with Stringswan on a raspberry pi. The server config looks like this: pi@raspberrypi:~ $ sudo cat /etc/ipsec.conf # ipsec.conf - ...
user avatar
3 votes
1 answer
1k views

IPsec IKEv2 succesful but Linux VTI does not work with SNAT

If you think troubleshooting IPsec is tedious, please forget about my logs and just let me know the implementation process, I'm still confused and any information is helpful. I removed SPIs and here ...
user avatar
1 vote
1 answer
644 views

Install Linux Kernel modules

I'm setting up IPSec VPN and I have met an error which upon searching I found the error actually means required kernel modules are missing. That prompted me to check that with lsmod and kmod list but ...
user avatar
0 votes
1 answer
126 views

Ipsec tunnel with solaris10..what I miss?

I want to create a two Solaris10 tunnel encrypted with ipsec.Configuration is simple: 2 solaris10 nodes,lan not encrypted,tunnel encrypted. Lan is e1000g0 and tunnel is ip.tun0 Ip "clear" for node1 is ...
user avatar
  • 10.9k
0 votes
1 answer
444 views

FreeBSD 11.2: how to add the aesni plugin to strongswan?

I installed strongswan using pkg install strongswan But now I've realized I need to have the aesni plugin enabled to optimize my IPsec tunnel. I've already enabled aesni at the OS level. The ...
user avatar
0 votes
0 answers
997 views

how to optimize performance of nfs running inside Strongswan ipsec transport on 10Gb network

Host1: Ubuntu 18.04 Host2: Freebsd 11.2 Here is my situation... I have 2 hosts on a 10G lan that have Strongswan IPsec transport configured between them to secure nfsv3. (Yes, I know nfsv3 is old ...
user avatar
0 votes
0 answers
196 views

Ask for password for IPSec VPN connection with netctl

TL;DR: How can I connect to a VPN with IPSec without writing the password and secret in the config file, but providing it from the outside (in my case a call to my password manager pass)? I already ...
user avatar
  • 181
2 votes
1 answer
330 views

StrongSwan - ipsec pki command

I would like to know why the first time I run the "ipsec pki" command to get a private key this key is generated quickly, but the next time you try to run the same command to get this key because you ...
user avatar
2 votes
1 answer
2k views

Routing traffic through VPN using Raspberry PI

I have a setup like this: - Raspberry PI connected to router via LAN cable - Created a bridged connection between eth0 and wlan0 - using hostapd for wifi hotstop - configured l2tp/ipsec connection ...
user avatar
  • 121
6 votes
1 answer
1k views

NAT outbound IPSEC packets using pf on FreeBSD 11 and StrongSwan x FortiGATE

I've been working for more than a week trying to get outbound packets nat'ed to fit a Security Association. This is my (example) scenario: LAN: 1.1.1.0/24 FreeBSD interface: xn0 (Amazon EC2 ...
user avatar
0 votes
0 answers
2k views

IPSec over L2TP: key derivation for pre-shared key failed

I set up a VPN to my Uni (using IPSec over L2TP) before using ~Ubunutu (GalliumOS), Strongswan, and NetworkManager, but this time I keep getting an error about my PSK, see this log output: Jun 22 11:...
user avatar
  • 251
-1 votes
1 answer
237 views

Configure IPSec so the user identity is passed to iptables rule

Hi I'm pretty new to this so you'll have to be very explicit. I set up IPSec on CentOS so that I can VPN. User identities are stored in the /etc/ppp/chap-secrets, mainly because that's how things ...
user avatar
0 votes
1 answer
289 views

strongswan get RANDOM dns

I'm getting a really strange issue on fresh Fedora 28 MATE with an IKEv2 IPSEC VPN. First thing: this VPN is currently used by some other clients (some windows and my old Fedora 26) with NO issue. ...
user avatar
  • 126
1 vote
0 answers
561 views

Masquerading strongswan ipsec ikev2 RAS clients

I've a VPS in sweden and I want to establish an IKEv2 RAS connection. The connection is established and a valid SA was created. Now I want to masquerade the traffic for 0.0.0.0/0 through the wan ...
user avatar
2 votes
2 answers
6k views

Connecting to 'unix"//var/run/charon.ctl' failed: connection refused

I have tried to find some answers on this and other sites trying to find out the problem, but my attempts failed. The rule is very simple: I want to establish my Ipsec tunnel when my Yubikey is ...
user avatar
0 votes
0 answers
489 views

How to create IPSec ethernet tunnel between two machines

I've been searching about IPSec. I know that there are two modes: transport layer and ethernet layer. I'd like to create an ethernet tunnel between two machines using AES and SHA256, and specify that ...
user avatar
8 votes
1 answer
13k views

IPsec VPN with strongSwan to FortiGate

I'm trying to connect to a FortiGate and access our continuous integration server via an IPsec VPN tunnel. I have no control over the FortiGate's configuration. On my laptop running Windows 10, I ...
user avatar
0 votes
1 answer
1k views

how overlapping subnet in 2 SA in strongswan determine which tunnel to go?

i have 2 tunnels of ikev1, with overlapping in leftsubnet and rightsubnet ,how the packet that send know to which tunnel it forward to tunnel first_4a010003 whay is that and how i decide i nwhch ...
user avatar
0 votes
2 answers
73 views

ipsec on linux,a simple and fast question

Is my first VPN, for testing this is my simple network scheme LAN1(private 10.10.0.0/24) --->VPN-----internet---<VPN---<LAN2(private 10.20.0.0/24) on /etc/ipsec.conf i use.. ... ...
user avatar
  • 10.9k
6 votes
2 answers
25k views

IPSec/L2TP VPN connection fails

I'm currently trying to establish a VPN connection to the network of my office using IPSec/L2TP with Ubuntu 16.04 (and/or Fedora 26) which fails with the following syslog entries (complete log below): ...
user avatar
0 votes
1 answer
177 views

using IPsec behind NAT in freebsd 7.3

I have a FreeBSD 7.3 server and I configured IPsec on it but now I need to put my server behind a NAT. I know in order to using NAT I should add IPsec_NAT_T to my kernel but the problem is IPsec_NAT_T ...
user avatar