Questions tagged [strongswan]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
7 views

connecting strongswan to amazon VPC

i've established BGP connection from my Linux box to Amazon VPC - using this guide: https://www.edge-cloud.net/2019/07/18/aws-site-2-site-vpn-with-strongswan-frrouting/#strongswan-setup The only ...
0
votes
1answer
28 views

StrongSwan IPsec VPN slow connection speed on Manjaro Linux(Arch)

On Manjaro Linux (arch), the speed of connecting to corporate resources under vpn (ipsec) dropped to almost 0, but everything was fine before I have already tried different configurations, but nothing ...
0
votes
1answer
31 views

How to allow VPN client to use their local internet for browsing

I have configured Ikev2 VPN server road warrior using strongswan package on centos 8 and it works fine. when clients connect they use remote site internet for browsing how to allow client to use their ...
0
votes
0answers
35 views

Linux routing with StrongSwan

My goal is to logon to 172.31.31.241 and be able to ping 192.168.102.92 I have setup a VPN on a raspberry PI (192.168.1.102) into AWS with StrongSwan IPSEC. I have managed to setup the VPN using ...
0
votes
1answer
81 views

strongswan: received NO_PROPOSAL_CHOSEN notify error

I have two private network. network A router: TL-WVR3200L public IP: 223.71.239.218 subnet: 192.168.1.0/24 IPSec config: network B router: TL-WDR5620 public IP: 119.90.63.105 subnet: 192.168.100.0/...
1
vote
1answer
36 views

strongswan: What is the difference between left and leftid?

This tutorial use left parameter when setup strongswan, while this tutorial also use leftid parameter. What is the difference between left and leftid? Update I setup strongswan on aws ec2 with the ...
0
votes
0answers
11 views

Strongswan tunnel is up but not pinging to each others

im facing weird problem i have configured site to site VPN tunnel on Centos 8 on the same network and its connected but unable to ping each others here is below my configuration and status. Site A [...
0
votes
1answer
79 views

networkmanager-strongswan vpn - IKEv2 routing issue

Until today, my VPN connection to my company was working out of the box using networkmanager-strongswan. But today (on linux mint 20.1 with kernel 5.8.0-38), I can establish connection to the VPN host,...
1
vote
2answers
89 views

ipsec binary on Centos 8

I've set up an ubuntu VM which connects to a Microsoft IKEv2 VPN, with the strongswan package (which depends on strongswan-charon and strongswan-starter). I control the vpn with the ipsec command, ...
0
votes
1answer
129 views

Connecting Windows 10 to IPSec/L2TP on Debian 10

Trying to get Windows 10 (192.168.1.11) to connect to IPSec/L2TP on Debian 10 (192.168.1.31). Windows firewall is off and I have added AssumeUDPEncapsulationContextOnSendRule (value 2) to the registry ...
2
votes
1answer
97 views

L2TP over IPSec on Debian 10

My Debian 10 box has a Wifi interface, wlx08beac0a6c1d running a WEP AP for old hardware that doens't wupport WPA. My main network is 192.168.1.0/24 and this interface is configured to be 192.168.2.1. ...
0
votes
0answers
50 views

How do I create a VPN certificate (IPSec / IKEv2) which contains an FQDN as identifier?

Obviously, I have a serious lack of understanding of how X.509-based authentication in IPSec VPNs works. More than one time, I have setup VPNs, based on IPSec / IKEv2, where one of the gateways was ...
0
votes
0answers
62 views

Building strongSwan from source

I'm having huge trouble with getting strongswan to work. I'd like to try the newest version and customize it with plugins. I'm following the instruction available here: https://wiki.strongswan.org/...
1
vote
0answers
466 views

Ubuntu IKEv1 IPSec alternative to strongSwan

I'm trying to connect to my work VPN which uses IKEv1/IPSec and authenticates with a preshared key however it appears strongSwan has a PSK limitation restricting PSKs to 20 characters or longer (even ...
0
votes
1answer
42 views

How do I route traffic back over a VPN to other servers

I am currently setting up an environment in 2 sites. all servers are linux/ubuntu. First site is my office and second site is AWS. I have 2 servers in AWS within a VPC with site to site VPN Web01 - ...
1
vote
1answer
661 views

networkmanager-strongswan vpn - routing specific ip through VPN

I'm trying to setting a VPN on Linux Mint 19.2. I'm using the network-manager-strongswan so I added this file named VPN under /etc/NetworkManager/system-connections/ [connection] id=VPN uuid=...
0
votes
1answer
83 views

Strongswan only last person connected routed through tunnel

I have site2site VPN tunnel using StrongSwan. Everything seems to work - except only last connected person gets the access. I.e. I connect from PC1, can ping server on the other side, connect from PC2,...
2
votes
0answers
124 views

Strongswan AUTH_FAILED

I am trying to configure VPN server Strongswan and have a problem: the server always sends to the clients the following response: IKE_AUTH [ N(AUTH_FAILED) ] I've tried to change log level editing ...
1
vote
1answer
417 views

Network Manager plugin for Strongswan won't show pre shred key authentication option

this was originally the second part of my question here How to start a swanctl.conf configured tunnel automatically Environment: Debian 10, KDE, Full desktop # ipsec --version Linux strongSwan U5.7....
1
vote
1answer
4k views

How to start a swanctl.conf configured tunnel automatically

Environment: Debian 10, KDE, Full desktop # ipsec --version Linux strongSwan U5.7.2/K4.19.0-6-amd64 # swanctl --version strongSwan swanctl 5.7.2 # systemctl status strongswan ● strongswan.service - ...
0
votes
1answer
533 views

Replace racoon with strongswan

I should switch from the racoon daemon (discarded) to the new demove charon strongswan. In practice I have about a dozen suppliers with which to change all the vpn in a "single" shot. I recreated all ...
2
votes
1answer
182 views

Strongswan several subnet problem with vpn racoon

I should migrate the current racoon daemon to strongswan on some routers. To do this in operation I have to be able to install strongswan a little at a time, which will have to run a vpn with the ...
0
votes
2answers
1k views

Route (docker) container traffic through IPSec

I have a ipsec (strongswan) connection to work, which in itself works fine, however traffic from containers doesn't seem to go through the ipsec tunnel. This is not expected from an end-user ...
0
votes
1answer
491 views

Roadwarrior scenario strongswan- Iphone setup

I'm working on trying to set up a roadwarrior client scenarion VPN with Stringswan on a raspberry pi. The server config looks like this: pi@raspberrypi:~ $ sudo cat /etc/ipsec.conf # ipsec.conf - ...
1
vote
0answers
231 views

Connecting Win 10 roadwarrior to AWS strongSwan VPN - not able to find a certificate usable with Extensible Authentication Protocol

I managed to connect two AWS subnets in different zones over strongSwan VPN using ike2 with the aes256 encryption. So, Master CA key is created, self-signed CA certificate, as well as private and ...
2
votes
0answers
423 views

strongSwan lan to lan / PKI RSA self CA - tunnel (0 up, 1 connecting), just the RSA tunnel without using of the self CA works fine

I am trying to create an x.509 based tunnel by using a self-signed CA certificate. I am creating the solution at the AWS, and VPN gateways are Debian Stretch machines version Linux ip-10-0-0-208 4....
3
votes
1answer
942 views

IPsec IKEv2 succesful but Linux VTI does not work with SNAT

If you think troubleshooting IPsec is tedious, please forget about my logs and just let me know the implementation process, I'm still confused and any information is helpful. I removed SPIs and here ...
1
vote
1answer
521 views

Install Linux Kernel modules

I'm setting up IPSec VPN and I have met an error which upon searching I found the error actually means required kernel modules are missing. That prompted me to check that with lsmod and kmod list but ...
1
vote
0answers
545 views

Fedora 30 - VPN L2TP IPSEC disconnects short after connection successfully

I am having some problems when configuring VPN in my envrionment. For Mac and Windows users works normally but for me it connects and disconnects shortly after. The Router alghoritm: My IPSEC ...
0
votes
1answer
291 views

fedora strongswan resolvconf: Interface can't be the loopback interface

I am getting this error when trying to use sudo strongswan up CONNECTION_NAME on Fedora 29 installing DNS server ###.##.#.## via resolvconf resolvconf: Interface can't be the loopback interface (lo). ...
0
votes
1answer
369 views

FreeBSD 11.2: how to add the aesni plugin to strongswan?

I installed strongswan using pkg install strongswan But now I've realized I need to have the aesni plugin enabled to optimize my IPsec tunnel. I've already enabled aesni at the OS level. The ...
0
votes
0answers
687 views

how to optimize performance of nfs running inside Strongswan ipsec transport on 10Gb network

Host1: Ubuntu 18.04 Host2: Freebsd 11.2 Here is my situation... I have 2 hosts on a 10G lan that have Strongswan IPsec transport configured between them to secure nfsv3. (Yes, I know nfsv3 is old ...
0
votes
1answer
2k views

Logs starting “ipsec start” command

I am trying to take the Mobile IPv6 HOWTO (https://wiki.strongswan.org/projects/strongswan/wiki/HomeAgentSetup) as an example of configuration but when I run the "ipsec start" command I have just one ...
2
votes
1answer
251 views

StrongSwan - ipsec pki command

I would like to know why the first time I run the "ipsec pki" command to get a private key this key is generated quickly, but the next time you try to run the same command to get this key because you ...
1
vote
1answer
59 views

Routes removed when connecting to multiple VPN connections

When I connect to multiple VPN connections, I lose routes (of the first connected VPN).. Setup 2 strongSwan servers - local_ts: 10.0.64.0/20 - local_ts: 10.0.80.0/20 1 osx client Routing ...
6
votes
1answer
1k views

NAT outbound IPSEC packets using pf on FreeBSD 11 and StrongSwan x FortiGATE

I've been working for more than a week trying to get outbound packets nat'ed to fit a Security Association. This is my (example) scenario: LAN: 1.1.1.0/24 FreeBSD interface: xn0 (Amazon EC2 ...
0
votes
1answer
279 views

strongswan get RANDOM dns

I'm getting a really strange issue on fresh Fedora 28 MATE with an IKEv2 IPSEC VPN. First thing: this VPN is currently used by some other clients (some windows and my old Fedora 26) with NO issue. ...
1
vote
0answers
451 views

Masquerading strongswan ipsec ikev2 RAS clients

I've a VPS in sweden and I want to establish an IKEv2 RAS connection. The connection is established and a valid SA was created. Now I want to masquerade the traffic for 0.0.0.0/0 through the wan ...
0
votes
0answers
297 views

Track traffic usage for StrongSwan connection using telegraf

I'm looking to track total traffic usage by a StrongSwan IPSec connection. The initiators and responder are behind NAT so my plan was to have an updown script which adds the necessary firewall rule, ...
1
vote
1answer
1k views

strongswan loads connections but cannot act on them [closed]

I have strongswan setup with a couple of connections in a Centos 7 box. When I do strongswan restart --debug-all it shows me that it's restarting the service and includes the connections in the output....
0
votes
1answer
487 views

VPN site to site via VPS [closed]

I would like to do connection: MY_PC (Private IP) <==> VPS (Public IP) <==> Raspberry Pi (GSM - Private IP). What soultion are You prefare for this connection? I would like to have a MY_PC and a ...
8
votes
1answer
11k views

IPsec VPN with strongSwan to FortiGate

I'm trying to connect to a FortiGate and access our continuous integration server via an IPsec VPN tunnel. I have no control over the FortiGate's configuration. On my laptop running Windows 10, I ...
0
votes
0answers
547 views

Iptables commands causes crash and hangs the root account

I'm setting up a StrongSwan VPN server on an Amazon Ubuntu Server (16.04LTS) instance. I am using this guide. I've completed almost all of the steps, I'm now trying to create iptables rules to allow ...
0
votes
1answer
908 views

how overlapping subnet in 2 SA in strongswan determine which tunnel to go?

i have 2 tunnels of ikev1, with overlapping in leftsubnet and rightsubnet ,how the packet that send know to which tunnel it forward to tunnel first_4a010003 whay is that and how i decide i nwhch ...
0
votes
2answers
7k views

How to create a strongswan VPN connection in Ubuntu 16.04?

The drop down in Edit connections... -> Add -> choose connection type of the network-manager only shows the Point-to-Point Tunneling Protocol (PPTP) although strongswan VPN is installed. Why and ...
1
vote
1answer
486 views

Which vpn service can be implemented without need for Win/Android/iOS client software?

I've configured OpenVPN on CentOS7 to access my office network and it's working fine too. For authentication, it queries an LDAP server and it requires third-party software "OpenVPN client" in windows....
1
vote
1answer
2k views

strongswan ikev2 cisco traffic selectors inacceptable [closed]

Trying to connect StrongSwan to a Cisco ASA (not mine) But I get traffic selectors inacceptable In the following logs Shouldn't 172.17.100.198/32 be a public ip address? looking for a child config ...
2
votes
3answers
1k views

bind mounts get removed with network namespaces?

Strongswan daemon puts its .pid and .ctl files in /var/run to detect if it is already running. I want to run multiple of these daemons on the same machine within different network namespaces. I am ...
2
votes
1answer
4k views

How to install missing kernel modules? Is it possible?

My machine: An Ubuntu server 16.04 LTS on a PINE64 with an ARM 64-bit processor (Linux pine64 3.10.105-0-pine64-longsleep #3 SMP PREEMPT Sat Mar 11 16:05:53 CET 2017 aarch64 aarch64 aarch64 GNU/Linux)...
0
votes
1answer
2k views

Strongswan VPN not working unless pinging out manually

We have successfully set up a strongswan vpn on our network to communicate with Google Cloud VPN. Sometimes we leave it idle for a while, let's say a night, that's when the issue appear. If I try to ...