Questions tagged [ipsec]

IPsec (Internet Protocol Security) is a protocol for securing IP communications by authenticating and encrypting each IP packet of a communication session.

396 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8 votes
0 answers
1k views

How to limit bandwidth per VPN connection?

I have a StrongSwan (IKEv2) server setup and would like to limit each VPN connection to 512kb/s. After researching I came across tc in Ubuntu. I don't quite understand it and am fighting through the ...
Houman's user avatar
  • 1,675
5 votes
0 answers
1k views

IPSec bandwidth between two Pfsense hosts has predictable, variable bandwidth

I have a IPSec tunnel between two Pfsense machines. Both machines are connected to a 100mbps symmetrical connection. The latency between the two routers is ~70ms. I'm using AES-GCM-128 and SHA1, both ...
ensnare's user avatar
  • 2,232
5 votes
0 answers
823 views

Firewall "Connection Security" when there is no trust and NATing between the two computers

First a little explanation of my network topology. I have a internal domain, and edge network domain. There is no trust between the two domains (and IT will not allow a one way trust to be set up ...
Scott Chamberlain's user avatar
5 votes
1 answer
987 views

Windows Server 2003 IPSec Tunnel Connected, But Not Working (Possibly NAT/RRAS Related)

Configuration I have setup a "raw" IPSec tunnel between a Windows Server 2003 (SBS) machine and a Netgear FVG318 according to the instructions in Microsoft KB816514. The configuration is as follows (...
Kevinoid's user avatar
  • 171
4 votes
2 answers
8k views

subnet-to-subnet libreswan ipsec vpn

I'm configuring a "subnet to subnet VPN" between two Centos 7 server using libreswan. Each server has two nic as showed in the following image. I would allow secure communication between the subnets ...
NoNoNo's user avatar
  • 1,973
4 votes
0 answers
331 views

Cisco ASA ipsec vs Anyconnect client issue

So I have an iPad that has a IPSec VPN created. I am able to connect from the outside fine and I can access my local LAN files just fine. When I connect with the Cisco AnyConnect client from the same ...
Richard's user avatar
  • 153
4 votes
0 answers
1k views

configuring IPsec with IPV6

I am working with racoon tool and ipsec-tools and I have been able to connect two devices with IPSEC working in transport mode. However, I did it with IPv4 addresses and when I change them to IPV6 ...
user avatar
4 votes
0 answers
1k views

How do I configure OpenSwan to allow pure IPsec (not L2TP) connections from an iPhone?

Similar to this question, I want to configure an IPsec server on Linux which will accept connections from the iPhone. However, unlike the other question, I want to be able to test with pre-shared keys ...
mpontillo's user avatar
  • 924
4 votes
0 answers
696 views

Trying to get a new user up on pfSense IPSec VPN; Config file import failed, now getting gateway errors

Caveat: I am not a sysadmin, so please forgive the n00bness of the query. We have a new user and I'm trying to get them up on VPN. We use pfsense as an IPSEC endpoint. This person is using Shrewsoft ...
user avatar
4 votes
2 answers
2k views

Using Ubuntu Karmic as an L2TP Client for VPN

I'm trying to connect to a VPN service over L2TP using Karmic as a client and it's not working. The only details I have are the remote IP address, username & password, and a shared secret string; ...
James L's user avatar
  • 6,115
3 votes
0 answers
66 views

Spread IPsec decryption over multiple CPUs

All IPsec traffic being decrypted is processed on a single CPU, despite having multiple IPsec tunnels (SAs.) How can I get the load shared across multiple CPUs? I'm running Strongswan IPsec on Ubuntu ...
Jeff Learman's user avatar
3 votes
1 answer
2k views

Cant connect to VPN via L2TP/IPsec on mac, but connection on windows works

I've setup connection on one of our mac computers running MacOS 10.13.6 High Sierra. I've entered user, password, preshared key ect. but I Cant connect to VPN (getting VPN server did not respond error)...
Mantas's user avatar
  • 31
3 votes
0 answers
227 views

Libreswan Testbed in VirtualBox

I'm currently working to create a testbed in VirtualBox for two VMs with an isolated opportunistic IPSec network with LibreSwan. All services are coming up fine, but network traffic between the two ...
schrodingersket's user avatar
3 votes
0 answers
296 views

FreeBSD major update broke vpnc connectivity, incoming ESP traffic doesn't appear unencrypted on interfaces

I updated a FreeBSD box from 10.4 to 11.2-RELEASE-p4 recently and it seems to have broken the vpnc VPN connectivity. Here's the vpnc.conf: IPSec gateway 10.1.0.1 IPSec ID vpnuser IPSec secret ...
alo's user avatar
  • 31
3 votes
0 answers
1k views

Route OpenVPN traffic through Site to Site IPSec connection for specific routes

We recently changed our firewall from a Sonicwall 3060 to a Meraki MX100. After changing we discovered that our work for one customer relied on a site to site vpn to their network with outbound nat ...
Ben Gourarie's user avatar
3 votes
0 answers
3k views

Strongswan to Cisco ASA

I have a problem with connection two nets with IPsec. On the one side is Cisco ASA 55xx on the other TP-Link router with Debian 8.3 with StrongSwan behind the NAT. The problem also that I have ...
F M's user avatar
  • 31
3 votes
0 answers
807 views

What is the ip xfrm tmpl and how is it different than an SA?

The Linux ip xfrm policy command creates an IPsec policy, associating particular traffic with an SA. It uses something called a "template" (tmpl), which, as far as I can tell, is just a means of ...
SRobertJames's user avatar
3 votes
0 answers
420 views

Windows Firewall Connection Security, require encryption with IPv6?

I've set up Windows Firewall on a Server 2012 R2 to always require IPSec Encryption for all Connection Security Rules. I've then specified Inbound Rules for specific ports and services, and ...
Mikael Grönfelt's user avatar
3 votes
2 answers
1k views

IPv6 IPsec between two native IPv6 networks

Assume I have two networks, A and B, on sites either side of the globe. Both have native IPv6 and are using (hypothetically) just IPv6. IPv4 no longer exists. They can both access the internet ...
Matt Hamilton's user avatar
3 votes
0 answers
649 views

Is there an extension of host to host ipsec to a many-many configuration?

Having a typical host to host transport mode ipsec configuration, conn appserver01-to-swift01 [email protected] left=10.133.176.246 leftrsasigkey=xxxxxxxxxxxxxxxxxxxxxxxx ...
user22866's user avatar
  • 151
3 votes
0 answers
4k views

vpnc: no response from target

I have not be able to for a tunnel using vpnc or shrew soft to my pfsense box running IPSec. I have made sure that the correct ports are open, the user I'm trying to log in has the correct permissions ...
HAL9000's user avatar
  • 149
3 votes
0 answers
7k views

Allowing LDAP authentication from DMZ to Active Directory. Is my idea secure?

I have a internet-facing application server that I want to use AD authentication. This is my first time doing this for a none MS application or without some sort of proxy. I already have a idea in my ...
Sarge's user avatar
  • 502
3 votes
0 answers
560 views

Having trouble installing Racoon and Strongswan on the same system

I have two applications that I need to run, one uses Racoon for establishing IPSec tunnels and the other uses Strongswan. Therefore, I need both Racoon and Strongswan installed simultaneously on my ...
exxodus7's user avatar
3 votes
1 answer
6k views

L2TP over IPSec VPN (OpenSwan, CentOS 6) unable to connect via iPhone (iOS 5.1) and Android (JellyBean)

I have successfully installed L2TP over IPsec VPN (PSK) using OpenSwan 2.6.38 running on CentOS. Connect DOES WORK perfectly from Windows 8. But doesn't work AT ALL from iPhone 4 (ios 5.1) or ...
Neolo's user avatar
  • 61
3 votes
0 answers
1k views

Linux IPsec VPN and SNAT

I'm trying to connect my network to an IPSec VPN, and for this my connexions need to come from a given domain. The network is the following: Internal network eth1:10.0.0.1/14 eth0:1.2.3.4 ----...
ebernard's user avatar
3 votes
1 answer
4k views

IKE Phase 1 Aggressive Mode exchange does not complete

I've configured a 3G IP Gateway of mine to connect using IKE Phase 1 Aggressive Mode with PSK to my openswan installation running on Ubuntu server 12.04. I've configured openswan as follows: /etc/...
Isaac Sutherland's user avatar
3 votes
0 answers
980 views

IPsec tunnels between Linux and Solaris

I have a Solaris machine sitting out in the ether somewhere that I would like to make part of my network via IPsec. I have this working between Solaris machines but not between Solaris and Linux. I ...
Zanchey's user avatar
  • 3,061
2 votes
1 answer
113 views

what is the proposal string for aes-gem256 deffie helman group 20, esp

As a developer tasked with connecting to a vpn without preconfigured profile scripts, i'm fumbling through setting up a strongswan ipsec.conf file. My current hurdle is an "invalid proposal ...
T3.0's user avatar
  • 121
2 votes
0 answers
249 views

ipsec duplicate policies: allow and block

I'm trying to set up u IPsec connection between two virtual machines using Strongswan. The configuration on my first machine is the following (ipsec.conf): conn %default ikelifetime=60m ...
nightcrawler's user avatar
2 votes
1 answer
2k views

Wrong IP address on VPN with StrongSwan

I have server with Ubuntu 20.04 and installed and working IKEv2 VPN with Strongswan. And i have one php system (installed on the same server with the VPN), that is locked by IP. So i'm using my VPN to ...
Nicox's user avatar
  • 21
2 votes
0 answers
937 views

Ubuntu Server 20.04 network-manager not starting VPN automatically

I am getting desperate here. I need to connect a Ubuntu Server Machine on a VPS to a network to monitor several machines. I can only connect to the network with L2TP over IPsec. I have tried ...
Javi Hache's user avatar
2 votes
1 answer
264 views

IPSec in IPSec with strongswan

I have server connected with remote LAN1 over IPSec tunnel. Now I want to setup second tunnel to LAN2 which is connected to router in LAN1, so I need to create Ipsec tunnel inside existing ipsec ...
Jarek's user avatar
  • 121
2 votes
1 answer
891 views

How to block an IP for IPSec VPN connections?

This is my current IpTables setup: Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere state RELATED,...
Houman's user avatar
  • 1,675
2 votes
0 answers
1k views

How do I route internet traffic through an established L2TP connection?

I am struggling to connect and, more importantly, route traffic from an Ubuntu server (this means that Network-Manager and any GUI tools are out of the question) to an L2TP-IPSec VPN server running on ...
LLlAMnYP's user avatar
  • 223
2 votes
1 answer
3k views

AWS EC2 CentOS 7 with LibreSwan IPsec Tunnel UP (Established), No Traffic flow, cannot ping Peer encryption Domain Nodes

I have LibreSwan Setup on AWS EC2 CentOS7 instance, IPsec tunnel is established with the peer (Cisco ASA). The Tunnel is up, but I no traffic. I cannot ping the nodes at the side of the peer. Here is ...
sekayasin's user avatar
2 votes
0 answers
638 views

Restrict all non-ipsec traffic with iptables

I'm using IPSEC in tunnel mode and I need to make sure that all traffic for a certain user on this computer is restricted to the VPN connection, and if the VPN is down the packets are rejected. So ...
user1220109's user avatar
2 votes
0 answers
2k views

Strongswan IPSec VPN tunnel with Public IP and no right subnet

I have to make VPN tunnel in which other party has sent me just their public IP(y.y.y.y) and no subnet. Am using Strongswan 5.3.5. I know the connection is possible is possible without rightsubnet ...
Divyansh Singh's user avatar
2 votes
0 answers
7k views

IPsec fails with debian and strongswan with PSK

Im having a problem with my new IPsec setup, testing between two nodes. Eveery node is connected to internet using static IP and logs shows how there are prob lems with ipsec.secrets but I can't see ...
deconya's user avatar
  • 135
2 votes
0 answers
2k views

MacOS native IKEv2 VPN client instead of AnyConnect?

Similar to this question from half a decade ago.. Can the native MacOS IKEv2 VPN client be used in lieu of Cisco AnyConnect client? example anyconnect profile: <AnyConnectProfile> <...
goofology's user avatar
  • 392
2 votes
0 answers
413 views

Can't ping remote host through nat on ipsec enc0 (mtu=0)

I'm up ipsec vpn to remote host. Since the remote host accepts only one ip i'm up nat for local net on enc0. Ping from ipsec host is ok: PING 172.20.162.150 (172.20.162.150): 56 data bytes 64 bytes ...
Morry's user avatar
  • 21
2 votes
1 answer
4k views

Routing between OpenSWAN / IPSEC tunnels

I am trying to connect multiple Amazon VPCs (across regions) together using OpenSWAN and Amazon VGW's. The router instance can ping to hosts in both VPCs, and traffic is attempting to cross the router,...
Jason Martin's user avatar
  • 5,093
2 votes
0 answers
2k views

IPSec tranport - ESP ping packet is sent but no reply is sent

I've tried to establish connection between two hosts but I cannot get it to work. When I send a ping packet I see that ESP packet is received but no reply is sent. What can be wrong? conn core-02 ...
Maja Piechotka's user avatar
2 votes
0 answers
1k views

Cisco ASA VPN DH Groups for AWS VPC

AWS provides a neat function in its VPC that exposes a VPN service. I've configured this, and confirmed that it functions. Our customer is using a Cisco 5500 Series ASA appliance to connect to the ...
belial's user avatar
  • 263
2 votes
3 answers
11k views

ipsec: Can't authenticate: no preshared key found for

I'm using Openswan with ipsec and ipsec keeps complaining about the shared-key not being present. I'm running Ubuntu 14.04 . I'm just experimenting on a couple of internal systems since I'm new to ...
Dustin Oprea's user avatar
2 votes
0 answers
134 views

Dual path VPN on ASA 9.2

We have two sites that are joined by a VPN over two WAN links, one primary and one backup only. The VPN endpoints are a pair of active/standby ASA clusters at each site. Each site also has multiple ...
user1174838's user avatar
2 votes
1 answer
860 views

Strongswan RA and Strongswan site-2-site with ASA

Task: Establish communication between remote clients (192.168.79.0/24) that are connecting to VPN server (on Ubuntu) and corporate network (10.1.2.0/24) connected to Cisco ASA. Schema: 192.168.79.0/...
Coul's user avatar
  • 109
2 votes
0 answers
108 views

Manually specify a tunnel gateway for an IPSec VPN Connection (ASA)

I have currently got several VPN's on-premise that are setup on the outside interface and using the default gateway on the interface as an originating source of the VPN tunnel. Although the outside ...
PM99's user avatar
  • 21
2 votes
0 answers
309 views

What could cause racoonctl to show a Phase2 count higher than the number of ports racoon is listening on?

In my setup I have some EC2 instances in different regions linked by GRE tunnels, using ISAKMP via racoon. This setup is inherited, so bear with me if I fumble with terminology. Sometimes I get weird ...
2rs2ts's user avatar
  • 325
2 votes
0 answers
156 views

Dynamically enable IPSec for IP connections between many servers

For a given list of internet server (example): S001 - 45.67.89.12 S002 - 67.78.90.34 S... S999 - 98.76.65.54 I want to talk from each server to any other server to any TCP service using the public ...
cytrinox's user avatar
  • 121
2 votes
0 answers
1k views

Openswan IPSec VPN on AWS tunnel established but no traffic

I am setting up a tunnel with a telco using AWS/VPC/EC2/Centos7/Libreswan and have been stuck for weeks. Appreciate any help! I have 192.168.16.73 (VPN GW, EIP 52.76.x.x) and 192.168.16.116 (...
Tai Shih Chau's user avatar

1
2 3 4 5
8