0
votes
0answers
80 views

Openswan sessions hanging with multi user VPN configuration (ipsec/l2tpd)

I've got a linux box running openswan and xl2tpd. It's a simple configuration with multiple users connecting using a sharedKey, and then establishing an L2TP connection with PPPD providing the ...
0
votes
0answers
110 views

How to set up ipsec esp tunnel between two linux host machine using ip xfrm

I have created a ESP tunnel using ip xfrm command between two linux machine such that if I ping from one machine to other then I am seeing ESP packets. Now what I am trying to do is that I have three ...
2
votes
2answers
663 views

Is it possible for L2TP VPN to do auto route configuration for client during connected?

We've setup a L2TP VPN server with this tutorial, everything works like a charm. The only issue is We don't want client to route all traffic using this VPN, only a particular subnet, e.g. ...
2
votes
1answer
112 views

DNSSEC and IPSec DNS Server and DNS Client Configuration

I'm about to deploy DNSSEC for some of my domains and as I was getting ready I did some reading on the subject. I came across some Microsoft Technet articles talking about Name Resolution Policy Table ...
0
votes
0answers
183 views

IPSec tunnel not working when set up asynchronously

I'm trying to create a tunnel using StrongSwan. In order to do this, I'm creating two sh files, one for each gateway router. All I'm doing in the sh files is creating the tunnel, configuring it, and ...
0
votes
0answers
50 views

Does ipsec-tools-0.8.0 support for hybrid_rsa_server?

I'am trying to configure ipsec-tools into certificate auth, here are my configurations: cat racoon.conf: path pre_shared_key "/var/psk.txt"; path certificate "/var/cert"; remote anonymous { ...
0
votes
0answers
54 views

No such device error when trying to create IPSec tunnels

I'm trying to establish parallel tunnels between the same two routers, each of which route traffic from slightly different subnets. I can always set up the first tunnel without a problem, however when ...
0
votes
0answers
73 views

Examples of running VPN clients in Amazon EC2

There are a thousand examples of VPN server setups on EC2 - but what are the limitations for running VPN clients on ec2? (to an existing VPN concentrator outside of EC2, for example). OpenVPN is known ...
1
vote
1answer
181 views

What do transmit errors on Linux IPsec virtual tunnel interfaces indicate?

Our monitoring system is indicating transmit errors on the IPsec VTIs on our Vyatta Core routers when they are under high load. They only appear fairly occasionally, and don't appear to seriously ...
1
vote
1answer
357 views

How do I allow only certain IPSet set's to access a certain port with iptables?

I'm using IPSet to build IP ranges for different countries as follows : # Canada ipset -F ca.zone ipset -N ca.zone nethash for IP in $(wget -O - http://www.ipdeny.com/ipblocks/data/countries/ca.zone) ...
1
vote
0answers
172 views

Complicated OpenVPN/IPSec passthrough setup to solve

I currently have some sort of complicated setup to do. I have a dedicated server, installed with OpenVPN server. There is one OpenWRT router connected to the dedicated server via OpenVPN. On the other ...
0
votes
0answers
169 views

Connecting a Linux client to an IPSec VPN (Vyatta)

I have just setup an IPSec on a Vyatta server and now I am trying to connect a Linux client to this router. What I basically am trying to do is to be able to make that Vyatta machine a physically ...
-1
votes
1answer
34 views

Openswan stopped writing to /var/log/secure after log deletion

I deleted the log intentionally but it seems like Openswan is not creating a new one on it's own. I tried restarting the service or even creating an empty file. Nothing works. What can I do besides ...
0
votes
1answer
476 views

xauth with ipsec-tools on openwrt: authentication failing?

I'am trying to set up xauth with ipsec-tools on openwrt, my settings show below: cat /etc/racoon.conf: path include "/etc/racoon"; path pre_shared_key "/etc/racoon/psk.txt"; path certificate ...
2
votes
1answer
2k views

Configure ipsec vpn tunnel (network to network with IKE with preshared key) on Centos 6 with openswan

I have Cisco Linksys router configured as VPN gateway (network to network) : Now I wanna configure ipsec VPN similarly on Centos 6 with openswan. I was looking in internet but have no luck (there ...
0
votes
1answer
111 views

ipsec routing / strange routing behavior

I have following network configuration: Office1 <-- openvpn --> office2 <-- ipsec tunnel --> branch office Office1 and office2 are on Debian, Branch office: juniper srx100 Office1 ...
1
vote
2answers
2k views

Openswan tunnel up, but works only in one direction

I've successfully established an IPsec connection, but it works only partially. One side does not send out packets through the tunnel. It seems as if the network topology is unclear to this side. ...
5
votes
1answer
719 views

With iptables, match packets arrived via IPSEC tunnel

I'm using IPSEC in a tunnel mode. How to make an iptables rule that will match only packets which arrived via IPSEC tunnel (i.e. after IPSEC decrypted them - not the IPSEC packets when they arrive ...
0
votes
1answer
130 views

IPsec tunnel selection base on UDP port

I have 2 Linux hosts and each has 2 services, X and Y. The X services communicate between them on UDP port x. The Y services communicate between them on UDP port y. I would like to encrypted the ...
0
votes
1answer
303 views

Traffic shaping L2TP/IPsec VPN (via accounts not connection)

I need to be able to control the amount of bandwidth a specific user account can use on a VPN connection. One account I want to be able to use the VPN with no restrictions and another account I want ...
0
votes
2answers
889 views

Which ports for IPSEC/LT2P?

I have a firewall/router (not doing NAT). I've googled and seen conflicting answers. It seems UDP 500 is the common one. But the others are confusing. 1701, 4500. And some say I need to also ...
0
votes
1answer
221 views

Specify IPSEC port range using ipsec-tools

Is it possible to require IPSEC on a port range ? I want to require IPSEC for all incoming connections except a few public ports like 80 and 443, but don't want to restrict outgoing connections. My ...
1
vote
1answer
2k views

Centos 6.3 OpenSWAN doesn't find my connection

I've been tearing my hair off in frustration for too long and decided Serverfault might be able to help. Could anyone somehow explain this? I've reinstalled openswan/ipsec with purge multiple times, ...
1
vote
0answers
1k views

Strongswan configuration to Cisco

We have an issue configuring Strongswan to a Cisco router. The connection is made, but I'm not getting the routing correct. There are multiple networks behind the router on the remote side (operated ...
2
votes
1answer
1k views

Ipsec reload fails to load ipsec.conf Strongswan 5.0

I am having trouble configuring a connection to an Android device using a fedora 17 linux machine and strongSwanv5.0.1dr2. I have made some progress but when I try adding the configuration to support ...
1
vote
0answers
278 views

Linux IPsec VPN and SNAT

I'm trying to connect my network to an IPSec VPN, and for this my connexions need to come from a given domain. The network is the following: Internal network eth1:10.0.0.1/14 eth0:1.2.3.4 ...
1
vote
2answers
225 views

Unable to connect from Windows to VPN while Android and iPad can

I've got a L2TP/IPSec VPN set up on CentOS (Amazon AMI) with racoon, ipsec-tools and xl2tp. I'm using a version of racoon from this repo, as it allows the use of IPSec ID wildcards (or no ...
0
votes
1answer
698 views

Is there a free linux distribution that provides network services with an Web interface? [closed]

What I have in mind and used is a commercial gateway/firewall with an web-interface for configuration that has this specifications: Administration Network Monitoring and logging Authentication ...
1
vote
0answers
483 views

No private key and IKEv2

I'm trying to run a linux server with ikev2 (by using strongswan ) . It seems the exact problem is about certificate and private key . I've used so many topics about doing it such as this topic when ...
1
vote
0answers
274 views

Deciphering IPSEC errors

I have a host I am trying to setup for ipsec. But I am finding some errors in the log that don't make much sense to me. The system are Rhel 5.5 boxes. I followed RHEL's IPSec deployment directions ...
0
votes
0answers
143 views

L2TP VPN server using Linux

I have had trouble deploying L2TP+IPSEC on Linux; my server is running kernel 2.6.38. But my problem is this -- Sometimes my Mac and iPhone won't reconnect after disconnecting. This was supposed to ...
0
votes
1answer
2k views

Connecting debian and windows via IPsec VPN with Racoon and ipsec-tools

I've some trouble with the IPsec configuration on my debian server (6 squeeze). This server should connect via IPsec VPN to an windows server, which is protected by an firewall. I've used racoon and ...
3
votes
1answer
492 views

selective routing through a VPN tunnel

The problem: after establishing an IPsec VPN tunnel all traffic is routed to the remote endpoint, while I only need to route the packets destined to that internal network and still be able to access ...
0
votes
1answer
8k views

OpenSwan IPSec phase #2 complications

Phase #1 (IKE) succeeds without any problems (verified at the target host). Phase #2 (IPSec), however, is erroneous at some point (apparently due to misconfiguration on localhost). This should be an ...
1
vote
2answers
306 views

netfilter: How to mark packet by reqid?

I have the following problem. I have SAs that use firewall marks. So only packets that have that mark get encoded and decoded. I managed to set the mark for packets that shall be encoded but I cannot ...
3
votes
1answer
21k views

IPsec VPN site-to-site: How should I configure the ipsec.conf files on both sites to get the tunnel up?

What I am trying to do is to create a site-to-site IPsec VPN between my network and my friend's network. We both have a router and two computers on each router, with all computers running Linux. So I ...
5
votes
1answer
3k views

ASA site-to-site IPSec vpn to linux ipsec-tools endpoints stops working after a random period of time

We swapped to ASA's over the weekend, and we replaced our VPN infrastructure which was previously based on openvpn and are now using IPSec between our ASA 5520's and our other sites that have linux ...
2
votes
1answer
1k views

VPN iptables Forwarding: Net-to-net

I've tried to look elsewhere on this site but I couldn't find anything matching this problem. Right now I have an ipsec tunnel open between our local network and a remote network. Currently, the ...
1
vote
2answers
196 views

How to test if a vpn has been established correctly between two pc's?

I'm trying to connect two pc's using IPsec and StrongSwan. The first pc, which I want it to be the server runs openSUSE and the client pc runs Fedora. So after installing StrongSwan in the first pc ...
3
votes
0answers
686 views

How do I configure OpenSwan to allow pure IPsec (not L2TP) connections from an iPhone?

Similar to this question, I want to configure an IPsec server on Linux which will accept connections from the iPhone. However, unlike the other question, I want to be able to test with pre-shared keys ...
1
vote
0answers
1k views

IPSec VPN login failing with certificate authentication

I am working on an IPSec VPN solution allowing iPhones / iPads to connect to a Linux server running Gentoo. I have been able to get the VPN functioning as expected using PSK authentication (PSK + ...
1
vote
1answer
105 views

Linux networking and routing

I have 3 networks: 192.168.1.0/24 192.168.11.0/24 192.168.50.0/24 192.168.1.0/24 and 192.168.11.0/24 are connected to each other through an IPSec tunnel, and 192.168.11.0/24 and 192.168.50.0/24 are ...
0
votes
1answer
242 views

Linux IPSec Tunnels does not forward IP Packet with ECN bit set to CE (Congestion Experienced)

I have a Linux IPSec Tunnel between a GGSN of a network operator and our data center. The IPSec works fine for all traffic but IP Packets coming from our side and are marked with ECN bit set to 0x3 ...
2
votes
1answer
265 views

L2TP and multiple interfaces on the machine

We have setup ipsec and l2tp on linux. One question came up (due to firewall management policy) is whether it's possible to have 1 virtual interface instead of one per connected client. Now we have: ...
0
votes
1answer
538 views

Linux 2.6 IPSEC does not forward packets from LAN to VPN

I have site to site VPN from 10.132.2.0/24 to 10.132.1.0/24. The problem I am facing is that the packets from VPN are forwarded to LAN, as I can see them on the LAN server, but packets from LAN are ...
1
vote
1answer
934 views

Does Linux support IPsec service out of the box?

As per subject. I have heard of default IPsec support on later versions of Linux kernel (without need to recompile or install special packages) but maybe it's a rumour? Interested in both VPN ...
0
votes
1answer
194 views

openswan installation

on a Linux machine with kernel 2.6.32, how to enable klips i found that for enable klips mus enable CONFIG_KLIPS_ALG=y in kernel config. but patch only available for 2.6.23- and for newer kernels, ...
2
votes
2answers
627 views

Racoon on Linux - Initial packet loss

I have configured two Linux boxes so they automatically use a transport-level IPSec connection whenever they need to communicate. The configuration is based on Racoon with X509 authentication and the ...
0
votes
2answers
340 views

How do I load the dummy network adapter in linux if it's not as a module?

I want to build a roadwarrior ipsec gateway for routing traffic securely through my server. For this, I plan to use racooon and debian linux. I have a VPS with a monolithic kernel (no kernel ...
2
votes
0answers
503 views

Getting ipsec-tools to work between Ubuntu Lucid hosts

I have two hosts, one is Charity with IP 67.207.128.184, the other is Hope with IP 67.207.130.204. I've installed the ipsec-tools package on each host. I have not installed racoon on either host. ...