Questions tagged [ipsec]
IPsec (Internet Protocol Security) is a protocol for securing IP communications by authenticating and encrypting each IP packet of a communication session.
396
questions with no upvoted or accepted answers
8
votes
0
answers
1k
views
How to limit bandwidth per VPN connection?
I have a StrongSwan (IKEv2) server setup and would like to limit each VPN connection to 512kb/s.
After researching I came across tc in Ubuntu. I don't quite understand it and am fighting through the ...
5
votes
0
answers
1k
views
IPSec bandwidth between two Pfsense hosts has predictable, variable bandwidth
I have a IPSec tunnel between two Pfsense machines. Both machines are connected to a 100mbps symmetrical connection. The latency between the two routers is ~70ms. I'm using AES-GCM-128 and SHA1, both ...
5
votes
0
answers
823
views
Firewall "Connection Security" when there is no trust and NATing between the two computers
First a little explanation of my network topology.
I have a internal domain, and edge network domain. There is no trust between the two domains (and IT will not allow a one way trust to be set up ...
5
votes
1
answer
987
views
Windows Server 2003 IPSec Tunnel Connected, But Not Working (Possibly NAT/RRAS Related)
Configuration
I have setup a "raw" IPSec tunnel between a Windows Server 2003 (SBS) machine and a Netgear FVG318 according to the instructions in Microsoft KB816514. The configuration is as follows (...
4
votes
2
answers
8k
views
subnet-to-subnet libreswan ipsec vpn
I'm configuring a "subnet to subnet VPN" between two Centos 7 server using libreswan.
Each server has two nic as showed in the following image.
I would allow secure communication between the subnets ...
4
votes
0
answers
331
views
Cisco ASA ipsec vs Anyconnect client issue
So I have an iPad that has a IPSec VPN created. I am able to connect from the outside fine and I can access my local LAN files just fine. When I connect with the Cisco AnyConnect client from the same ...
4
votes
0
answers
1k
views
configuring IPsec with IPV6
I am working with racoon tool and ipsec-tools and I have been able to connect two devices with IPSEC working in transport mode. However, I did it with IPv4 addresses and when I change them to IPV6 ...
4
votes
0
answers
1k
views
How do I configure OpenSwan to allow pure IPsec (not L2TP) connections from an iPhone?
Similar to this question, I want to configure an IPsec server on Linux which will accept connections from the iPhone. However, unlike the other question, I want to be able to test with pre-shared keys ...
4
votes
0
answers
696
views
Trying to get a new user up on pfSense IPSec VPN; Config file import failed, now getting gateway errors
Caveat: I am not a sysadmin, so please forgive the n00bness of the query. We have a new user and I'm trying to get them up on VPN. We use pfsense as an IPSEC endpoint. This person is using Shrewsoft ...
4
votes
2
answers
2k
views
Using Ubuntu Karmic as an L2TP Client for VPN
I'm trying to connect to a VPN service over L2TP using Karmic as a client and it's not working.
The only details I have are the remote IP address, username & password, and a shared secret string; ...
3
votes
0
answers
66
views
Spread IPsec decryption over multiple CPUs
All IPsec traffic being decrypted is processed on a single CPU, despite having multiple IPsec tunnels (SAs.) How can I get the load shared across multiple CPUs?
I'm running Strongswan IPsec on Ubuntu ...
3
votes
1
answer
2k
views
Cant connect to VPN via L2TP/IPsec on mac, but connection on windows works
I've setup connection on one of our mac computers running MacOS 10.13.6 High Sierra. I've entered user, password, preshared key ect. but I Cant connect to VPN (getting VPN server did not respond error)...
3
votes
0
answers
227
views
Libreswan Testbed in VirtualBox
I'm currently working to create a testbed in VirtualBox for two VMs with an isolated opportunistic IPSec network with LibreSwan. All services are coming up fine, but network traffic between the two ...
3
votes
0
answers
296
views
FreeBSD major update broke vpnc connectivity, incoming ESP traffic doesn't appear unencrypted on interfaces
I updated a FreeBSD box from 10.4 to 11.2-RELEASE-p4 recently and it seems to have broken the vpnc VPN connectivity.
Here's the vpnc.conf:
IPSec gateway 10.1.0.1
IPSec ID vpnuser
IPSec secret ...
3
votes
0
answers
1k
views
Route OpenVPN traffic through Site to Site IPSec connection for specific routes
We recently changed our firewall from a Sonicwall 3060 to a Meraki MX100. After changing we discovered that our work for one customer relied on a site to site vpn to their network with outbound nat ...
3
votes
0
answers
3k
views
Strongswan to Cisco ASA
I have a problem with connection two nets with IPsec. On the one side is Cisco ASA 55xx on the other TP-Link router with Debian 8.3 with StrongSwan behind the NAT. The problem also that I have ...
3
votes
0
answers
807
views
What is the ip xfrm tmpl and how is it different than an SA?
The Linux ip xfrm policy command creates an IPsec policy, associating particular traffic with an SA. It uses something called a "template" (tmpl), which, as far as I can tell, is just a means of ...
3
votes
0
answers
420
views
Windows Firewall Connection Security, require encryption with IPv6?
I've set up Windows Firewall on a Server 2012 R2 to always require IPSec Encryption for all Connection Security Rules.
I've then specified Inbound Rules for specific ports and services, and ...
3
votes
2
answers
1k
views
IPv6 IPsec between two native IPv6 networks
Assume I have two networks, A and B, on sites either side of the globe. Both have native IPv6 and are using (hypothetically) just IPv6. IPv4 no longer exists. They can both access the internet ...
3
votes
0
answers
649
views
Is there an extension of host to host ipsec to a many-many configuration?
Having a typical host to host transport mode ipsec configuration,
conn appserver01-to-swift01
[email protected]
left=10.133.176.246
leftrsasigkey=xxxxxxxxxxxxxxxxxxxxxxxx
...
3
votes
0
answers
4k
views
vpnc: no response from target
I have not be able to for a tunnel using vpnc or shrew soft to my pfsense box running IPSec. I have made sure that the correct ports are open, the user I'm trying to log in has the correct permissions ...
3
votes
0
answers
7k
views
Allowing LDAP authentication from DMZ to Active Directory. Is my idea secure?
I have a internet-facing application server that I want to use AD authentication. This is my first time doing this for a none MS application or without some sort of proxy. I already have a idea in my ...
3
votes
0
answers
560
views
Having trouble installing Racoon and Strongswan on the same system
I have two applications that I need to run, one uses Racoon for establishing IPSec tunnels and the other uses Strongswan. Therefore, I need both Racoon and Strongswan installed simultaneously on my ...
3
votes
1
answer
6k
views
L2TP over IPSec VPN (OpenSwan, CentOS 6) unable to connect via iPhone (iOS 5.1) and Android (JellyBean)
I have successfully installed L2TP over IPsec VPN (PSK) using OpenSwan 2.6.38 running on CentOS.
Connect DOES WORK perfectly from Windows 8.
But doesn't work AT ALL from iPhone 4 (ios 5.1) or ...
3
votes
0
answers
1k
views
Linux IPsec VPN and SNAT
I'm trying to connect my network to an IPSec VPN, and for this my connexions need to come from a given domain. The network is the following:
Internal network eth1:10.0.0.1/14 eth0:1.2.3.4
----...
3
votes
1
answer
4k
views
IKE Phase 1 Aggressive Mode exchange does not complete
I've configured a 3G IP Gateway of mine to connect using IKE Phase 1 Aggressive Mode with PSK to my openswan installation running on Ubuntu server 12.04. I've configured openswan as follows:
/etc/...
3
votes
0
answers
980
views
IPsec tunnels between Linux and Solaris
I have a Solaris machine sitting out in the ether somewhere that I would like to make part of my network via IPsec. I have this working between Solaris machines but not between Solaris and Linux.
I ...
2
votes
1
answer
113
views
what is the proposal string for aes-gem256 deffie helman group 20, esp
As a developer tasked with connecting to a vpn without preconfigured profile scripts, i'm fumbling through setting up a strongswan ipsec.conf file. My current hurdle is an "invalid proposal ...
2
votes
0
answers
249
views
ipsec duplicate policies: allow and block
I'm trying to set up u IPsec connection between two virtual machines using Strongswan. The configuration on my first machine is the following (ipsec.conf):
conn %default
ikelifetime=60m
...
2
votes
1
answer
2k
views
Wrong IP address on VPN with StrongSwan
I have server with Ubuntu 20.04 and installed and working IKEv2 VPN with Strongswan.
And i have one php system (installed on the same server with the VPN), that is locked by IP.
So i'm using my VPN to ...
2
votes
0
answers
937
views
Ubuntu Server 20.04 network-manager not starting VPN automatically
I am getting desperate here. I need to connect a Ubuntu Server Machine on a VPS to a network to monitor several machines. I can only connect to the network with L2TP over IPsec.
I have tried ...
2
votes
1
answer
264
views
IPSec in IPSec with strongswan
I have server connected with remote LAN1 over IPSec tunnel. Now I want to setup second tunnel to LAN2 which is connected to router in LAN1, so I need to create Ipsec tunnel inside existing ipsec ...
2
votes
1
answer
891
views
How to block an IP for IPSec VPN connections?
This is my current IpTables setup:
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,...
2
votes
0
answers
1k
views
How do I route internet traffic through an established L2TP connection?
I am struggling to connect and, more importantly, route traffic from an Ubuntu server (this means that Network-Manager and any GUI tools are out of the question) to an L2TP-IPSec VPN server running on ...
2
votes
1
answer
3k
views
AWS EC2 CentOS 7 with LibreSwan IPsec Tunnel UP (Established), No Traffic flow, cannot ping Peer encryption Domain Nodes
I have LibreSwan Setup on AWS EC2 CentOS7 instance, IPsec tunnel is established with the peer (Cisco ASA).
The Tunnel is up, but I no traffic. I cannot ping the nodes at the side of the peer.
Here is ...
2
votes
0
answers
638
views
Restrict all non-ipsec traffic with iptables
I'm using IPSEC in tunnel mode and I need to make sure that all traffic for a certain user on this computer is restricted to the VPN connection, and if the VPN is down the packets are rejected.
So ...
2
votes
0
answers
2k
views
Strongswan IPSec VPN tunnel with Public IP and no right subnet
I have to make VPN tunnel in which other party has sent me just their public IP(y.y.y.y) and no subnet. Am using Strongswan 5.3.5. I know the connection is possible is possible without rightsubnet ...
2
votes
0
answers
7k
views
IPsec fails with debian and strongswan with PSK
Im having a problem with my new IPsec setup, testing between two nodes. Eveery node is connected to internet using static IP and logs shows how there are prob lems with ipsec.secrets but I can't see ...
2
votes
0
answers
2k
views
MacOS native IKEv2 VPN client instead of AnyConnect?
Similar to this question from half a decade ago..
Can the native MacOS IKEv2 VPN client be used in lieu of Cisco AnyConnect client?
example anyconnect profile:
<AnyConnectProfile>
<...
2
votes
0
answers
413
views
Can't ping remote host through nat on ipsec enc0 (mtu=0)
I'm up ipsec vpn to remote host. Since the remote host accepts only one ip i'm up nat for local net on enc0.
Ping from ipsec host is ok:
PING 172.20.162.150 (172.20.162.150): 56 data bytes
64 bytes ...
2
votes
1
answer
4k
views
Routing between OpenSWAN / IPSEC tunnels
I am trying to connect multiple Amazon VPCs (across regions) together using OpenSWAN and Amazon VGW's. The router instance can ping to hosts in both VPCs, and traffic is attempting to cross the router,...
2
votes
0
answers
2k
views
IPSec tranport - ESP ping packet is sent but no reply is sent
I've tried to establish connection between two hosts but I cannot get it to work. When I send a ping packet I see that ESP packet is received but no reply is sent. What can be wrong?
conn core-02
...
2
votes
0
answers
1k
views
Cisco ASA VPN DH Groups for AWS VPC
AWS provides a neat function in its VPC that exposes a VPN service. I've configured this, and confirmed that it functions.
Our customer is using a Cisco 5500 Series ASA appliance to connect to the ...
2
votes
3
answers
11k
views
ipsec: Can't authenticate: no preshared key found for
I'm using Openswan with ipsec and ipsec keeps complaining about the shared-key not being present. I'm running Ubuntu 14.04 .
I'm just experimenting on a couple of internal systems since I'm new to ...
2
votes
0
answers
134
views
Dual path VPN on ASA 9.2
We have two sites that are joined by a VPN over two WAN links, one primary and one backup only. The VPN endpoints are a pair of active/standby ASA clusters at each site.
Each site also has multiple ...
2
votes
1
answer
860
views
Strongswan RA and Strongswan site-2-site with ASA
Task:
Establish communication between remote clients (192.168.79.0/24) that are connecting to VPN server (on Ubuntu) and corporate network (10.1.2.0/24) connected to Cisco ASA.
Schema:
192.168.79.0/...
2
votes
0
answers
108
views
Manually specify a tunnel gateway for an IPSec VPN Connection (ASA)
I have currently got several VPN's on-premise that are setup on the outside interface and using the default gateway on the interface as an originating source of the VPN tunnel.
Although the outside ...
2
votes
0
answers
309
views
What could cause racoonctl to show a Phase2 count higher than the number of ports racoon is listening on?
In my setup I have some EC2 instances in different regions linked by GRE tunnels, using ISAKMP via racoon. This setup is inherited, so bear with me if I fumble with terminology.
Sometimes I get weird ...
2
votes
0
answers
156
views
Dynamically enable IPSec for IP connections between many servers
For a given list of internet server (example):
S001 - 45.67.89.12
S002 - 67.78.90.34
S...
S999 - 98.76.65.54
I want to talk from each server to any other server to any TCP service using the public ...
2
votes
0
answers
1k
views
Openswan IPSec VPN on AWS tunnel established but no traffic
I am setting up a tunnel with a telco using AWS/VPC/EC2/Centos7/Libreswan and have been stuck for weeks. Appreciate any help!
I have 192.168.16.73 (VPN GW, EIP 52.76.x.x) and 192.168.16.116 (...