Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have got problems setting up a StrongSwan IpSec network. I use arno-iptables-firewall with the IpSec module and have added rules for NAT and to the routing table. When pinging a host in the remote network, I get the following charon log messages:

Jan 15 19:22:09 07[KNL] creating acquire job for policy[icmp/8] ===[icmp] with reqid {1}
Jan 15 19:22:09 04[IKE] initiating IKE_SA tunnel[1] to <REMOTE_IP>
Jan 15 19:22:09 04[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
Jan 15 19:22:09 04[NET] sending packet: from <MY_EXT_IP>[500] to <REMOTE_IP>[500]
Jan 15 19:22:13 03[IKE] retransmit 1 of request with message ID 0
Jan 15 19:22:13 03[NET] sending packet: from <MY_EXT_IP>[500] to <REMOTE_IP>[500]

So it seems StrongSwan tries to establish the VPN connection and tries to start the IKE, but does not receive responses to the UPD packets it sends.

I added a log message to the OUTPUT chain and indeed I can see the packets on port 500, so I am sure the firewall tries to send the packet:

[6488507.353258] IpSec IN= OUT=ppp0 SRC=<MY_EXT_IP> DST=<REMOTE_IP> LEN=812 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=500 DPT=500 LEN=792

But, my connection partner (unfortunately, I do not have access to his logs) does not see these packets arrive. Have you got any idea where the packets might get lost?

The firewall is a Debian 7.3 (kernel 3.2) virtual linux machine, running on ESXi 5. The firewall is directly connected to the Internet via a PPP dialup line.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.