Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I believe I've followed all the instructions, and my win 7 did get connected, but there's no Internet.

Background:

Server OS: ubuntu 12.04 on linode xen VPS

strongSwan Version: 4.6.4

configurations in /etc/ipsec.conf :

config setup
        charonstart=yes      
        plutostart=yes     
        nat_traversal=yes
        uniqueids=yes

conn ios
        keyexchange=ikev1
        authby=xauthpsk
        xauth=server
        left=%defaultroute
        leftsubnet=0.0.0.0/0
        leftfirewall=yes
        right=%any
        rightsubnet=10.11.0.0/24
        rightsourceip=10.11.0.0/24
        pfs=no
        auto=add

conn win7         
        keyexchange=ikev2
        ike=aes256-sha1-modp1024!
        esp=aes256-sha1!
        dpdaction=clear
        dpddelay=300s
        rekey=no
        left=%defaultroute
        leftsubnet=0.0.0.0/0
        leftauth=pubkey
        leftcert=serverCert.pem
        leftid="C=CH, O=strongSwan, CN=VPS ip"
        right=%any
        rightsourceip=10.11.1.0/24
        rightauth=eap-mschapv2
        rightsendcert=never
        eap_identity=%any
        auto=add

added dns in /etc/strongswan.conf :

charon {
dns1 = 8.8.8.8
dns2 = 208.67.222.222
...
pluto {
dns1 = 8.8.8.8
dns2 = 208.67.222.222
...

added user in /etc/ipsec.secrets :

: PSK "mypskpass"
user1 : XAUTH "pass1"

: RSA serverKey.pem
user2 : EAP "pass2"

#include /var/lib/strongswan/ipsec.secrets.inc

added some new rules in /etc/iptables.firewall.rules

*filter
# Accept IPsec VPN connections
-A INPUT -p udp --dport 500 -j ACCEPT
-A INPUT -p udp --dport 4500 -j ACCEPT

-A FORWARD -s 10.11.0.0/24 -j ACCEPT
-A FORWARD -s 10.11.1.0/24 -j ACCEPT
COMMIT

*nat

# Allow IPsec VPN connections

-A POSTROUTING -s 10.11.0.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.11.1.0/24 -o eth0 -j MASQUERADE

COMMIT

And then activated iptables rules:

iptables-restore < /etc/iptables.firewall.rules

Then restarted ipsec:

ipsec restart

Till this point, my iOS devices can connect to it and everything works all right.

After that I generated certificates for both server and client side, then converted .pem into .p12 and imported it into win 7.

The good part is that my win 7 can now connect to the vps, but there's no internet connection.

I really don't know which part went wrong, would anybody please help me out?

Thanks

share|improve this question

closed as off-topic by TomTom, Ward, mdpc, MadHatter, Jim B Jul 11 at 20:36

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – TomTom, Ward, mdpc, MadHatter, Jim B
If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

I know nothing but maybe you need to enable arp setting in sysctl.conf

Enable the following parameters in /etc/sysctl.conf (or the equivalent on your Linux distro):

net.ipv4.ip_forward = 1
net.ipv4.conf.default.proxy_arp = 1
net.ipv4.conf.default.arp_accept = 1
net.ipv4.conf.default.proxy_arp_pvlan = 1
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.