an open source, multi-platform IPSec stack, with IKEv2 & 1 support

learn more… | top users | synonyms

0
votes
0answers
40 views

How to fix failing connection to VPN(ipsec+ikev2)?

Auth made with certificates ubuntu 16.04 + strongswan. Client connecting from win7, certificate was added like said in strongswan Wiki. Config made also like in strongswan wiki, but i got error: '...
1
vote
0answers
22 views

Two users behind same NAT (PSK or EAP) - strongswan

I have a strongswan implementation and am running into an issue where when there are two users behind the same NAT, the second one "kicks off" the first one. I was able to resolve the issue using: ...
0
votes
0answers
31 views

IPSec - Is it possible to have remote access clients (road warriors) all behind the same NAT device?

This is a topic that I find mixed information on. Is it possible to have two IPSec road warriors that are behind the same NAT, even with an ASA as the VPN endpoint? I have been trying with Libreswan ...
0
votes
0answers
84 views

Forwarding UPnP, DLNA traffic via computer to server

I'm about to tear out what is left of my hair with this. I was able to finally see traffic coming through, but not working in full, when using socat but this setup is not ideal. The idea: I have a ...
0
votes
0answers
66 views

Two road warrior clients behind the same NAT device (IKEv2, StrongSwan, LibreSwan)

I have an IKEv2 VPN that is set up and works properly, however I run into issues when I have two road warriors behind the same NAT device. Both devices connect however the second device seems to kick ...
0
votes
1answer
55 views

Why does 'ipsec statusall' not show any connections?

I've finally been able to get a tunnel between my computer (strongswan) and a Zyxel Zywall 110 up and running. I'm connecting using certificates, and judging from the logs the actual VPN connection ...
0
votes
0answers
16 views

IPsec tunnel, receiving data with wrong destination address

I've managed to stablish an IPsec tunnel using strongswan to a Cisco router. My server is an Azure VM, so it is behind NAT. I do not have control over the Cisco router. This is my /etc/ipsec.conf: ...
1
vote
1answer
52 views

How to redirect traffic through IPv6 IPSec (strongswan) gateway?

I'm trying to set up IPSec secured connection to the gateway. Have three hosts: A: eth1 - fec0:1::1/64 B: eth1 - fec0:1::2/64 eth2 - fec0:2::2/64 which is gateway between A and C; forwarding is set ...
0
votes
0answers
49 views

IPSEC help using Strongswan on CENTOS 6.6

I have been tasked with setting up an IPSEC tunnel to our remote data provider. They require my Phase 2 traffic to be PAT'd behind a public address. I am using strongswan 5.3.2 on CentOS 6.6 on a ...
4
votes
1answer
150 views

How do i get Strongswan / IPTables to route data back to my road warrior client correctly?

I have a simple VPN. I have a client on 10.185.28.241 who gets a virtual IP of 10.42.42.0/24 from the VPN which is located at 10.112.18.105 and is providing access to machines in the 10.112.0.0/16 ...
0
votes
0answers
30 views

IOS + StrongSwan + Windows RADIUS (NAP)

We've got Windows NAP, Windows Certification Services and many kind of clients wich uses Windows, android, OS X and iOS. All clients have certificates issued Windows CA, and I need that they connect ...
0
votes
0answers
68 views

StrongSwan IPsec and NAT

I have an IPSec tunnel to the network of our customer running on a Linux box with StrongSwan. On there I have to do source NAT to translate our network addresses to the subnet they assigned us. This ...
2
votes
1answer
81 views

Strongswan RA and Strongswan site-2-site with ASA

Task: Establish communication between remote clients (192.168.79.0/24) that are connecting to VPN server (on Ubuntu) and corporate network (10.1.2.0/24) connected to Cisco ASA. Schema: 192.168.79.0/...
0
votes
0answers
106 views

strongSwan site2site to a docker subnet

The problem I'm running docker on a public server and want to connect the subnet of the docker containers to a private subnet on a remote site and use strongSwan with a modified IKEv1 net2net PSK ...
0
votes
0answers
76 views

migrate from openswan to strongswan (linux - windows ipsec)

i have working openswan ipsec on linux router in our office, which is connected to few remote windows 2008/2012 servers using psk. i need to migrate it to strongswan ipsec (4.5.2). this is my ...
0
votes
0answers
27 views

Strongswan using FQDN

I currently have a VPN server with Stongswan running. We use this to make sure that you can reach some of our internal tools, only when connected to the VPN. Let's assume we have the following URLs, ...
0
votes
0answers
63 views

How to troubleshoot strongswan error: “unable to allocate SPIs from kernel”?

I am trying to setup an IPsec tunnel to a Juniper security gateway using a strongswan client on a Linux machine and preshared keys. This is what I get when trying to bring the connection up: root@...
0
votes
1answer
183 views

Enable IKE tracing on windows 10 VPN

I have an IKEV2 VPN setup (including certs) that worked fine on windows 7. On Windows 10, the same config fails with 'IKE authentication credentials are unacceptable'. Server is StrongSwan. The last ...
2
votes
0answers
179 views

Strongswan to Cisco ASA

I have a problem with connection two nets with IPsec. On the one side is Cisco ASA 55xx on the other TP-Link router with Debian 8.3 with StrongSwan behind the NAT. The problem also that I have ...
0
votes
0answers
1k views

Strongswan VPN: no matching peer config found

I'm trying to setup a Strongswan VPN but can't get it to work. It does not find a matching peer config and I don't know why: LOG: [ENC] <1> generating IKE_SA_INIT response 0 [ SA KE No N(...
1
vote
1answer
297 views

ipsec/strongswan - how to use remote router as local gateway using the route command

Ok, this should be an easy one, but its driving me nuts. Scenario: Site A (San Francisco) Site B (Colombia) Both sites are connected successfully via IPSec (openswan, debian 8): SiteA-...
0
votes
0answers
219 views

Setting Up StrongSwan on CentOS 6 to Connect to Amazon VPC VPN

NB: This questions pertains to connecting Strongswan to AWS hardware VPN, NOT between two servers running Strongswan I tried following the tutorial here: http://www.mynameistoby.com/ It won't work ...
0
votes
1answer
394 views

Connection of a Server to my home network via Strongswan (received INVALID_ID_INFORMATION error notify)

I try to establish a VPN connection from my root server to my home network via strongswan. I've configured my router (FritzBox 7490) for VPN PSK XAUTH connections. A VPN connection from my Android-...
0
votes
0answers
41 views

IPSec host2host transport-mode

I want to secure all traffic between our servers that are distrubuted through various datacenters. We don't have VLANs, just plain Debian 7 & Debian 8 based Virtual Private Servers (around 20), ...
1
vote
0answers
80 views

Is it possible to use certificate from public CA for IKEv2 without importing intermediate cert?

I have configured ikev2 vpn on a strongswan server and a Windows 10 client, and it works fine. The authorization method is leftauth=pubkey and rightauth=eap-mschapv2. Because the leftcert to ...
0
votes
0answers
80 views

How to copy TOS/QoS field from IPsec payload to outside tunnel packet?

Using e.g. strongswan to build an IPsec tunnel (i.e. tunnel mode, ESP), how do I copy the TOS/QoS/DSCP field from the unencrypted original packet to the outer wrapping packet? There is this ...
-1
votes
1answer
106 views

Strongswan - IOS Roadwarrior cannot access hosts on the internet

I'm having a rather strange problem with a Strongswan IPSec VPN not being able to access hosts on the internet. I can connect to the VPN fine, and I can access hosts on my local network. I also ...
1
vote
0answers
554 views

Connect Ubuntu 14.04 with Strongswan to Microsoft Azure

I want to connect my Ubuntu 14.04 server with Strongswan to Microsoft Azure Gateway. I only want to establish a connection between Azure and that Ubuntu server. In Azure I configured a dynamic gateway....
0
votes
0answers
94 views

Strongswan inside Amazon EC2 Classic

This is my first question, so please be gentle ;) I've got a Strongswan vpn tunnel set up to connect to a Check point server. The checkpoint sysadmin told that I'm already connected to the tunnel but ...
1
vote
0answers
319 views

CentOS + strongswan + iOS VPN API, hal

I'm trying to setup StrongSwan on CentOS for iOS with VPN API. This API uses IKEv2 protocol. Here is my logs + configuration files. When i press connect in iOS device it's getting off in a few moments....
1
vote
1answer
567 views

Two tunnels with same rightsubnet for StrongSWAN/OpenSWAN

I'm trying to set up the "Option 3" configuration for Google Cloud VPN, with two Google Cloud VPN gateways on the left and StrongSWAN or OpenSWAN on the right: If you have two Peer VPN gateways ...
0
votes
1answer
359 views

Strongswan: clients can connect to server but no internet access

I've set up an ipsec server and after a while I could connect to it from my android device. but there is no internet connection in client side. I have also added NAT rules to forward traffics from ...
2
votes
1answer
314 views

Public key authentication with strongswan

I have two systems r1 and r2, and I want to establish an ESP tunnel between them with Strongswan using public key authentication. I have generated public keys, store in r1-pub.pem and r2-pub.pem ...
1
vote
1answer
255 views

Can one use a MySQL backend for user authentication in a strongswan VPN server?

We have installed and configured a strongswan VPN server with username / password authentication. Is it possible to store the users' credentials in a MySQL backend and configure strongswan to use the ...
0
votes
0answers
380 views

Strongswan IPsec: routing arbitrary subnets over /32 IPsec endpoints

I have a basic setup between two sites A (FreeBSD, 10.0.0.1/24 nat'd to 1.1.1.1), B (Linux, 2.2.2.2), with only A behind NAT. I've only been able to get it working in tunnel mode. Here's my ipsec.conf:...
0
votes
2answers
622 views

Docker & StrongSwan: Destination Host Unreachable

I'm having a bit of trouble communicating between containers using my IPsec tunnels. Here's my setup: I have Docker installed on multiple Ubuntu 14.04 hosts and I'm running various containers on each....
0
votes
1answer
859 views

Allow Strongswan roadwarrior to access local LAN

I have successfully established an IPSec tunnel between my local Linux host and a remote VPN gateway. I am using virtual IPs assign by the gateway because being a roadwarrior my local LAN subnet is ...
0
votes
1answer
175 views

How can I tell strongswan that left is local (independent of IPs)?

Is there something like local = left which I could use in the strongSwan configuration? I don’t want to use any IP-addresses, as they might change. And I don’t want the server to guess it, I want to ...
1
vote
1answer
189 views

When and with which parameters does strongSwan select a connection?

StrongSwan (as responder) selects a configured connection (conn section in ipsec.conf) for each incoming initiator key exchange intent. At which times does strongSwan pick a connection configuration? ...
2
votes
1answer
725 views

OS X 10.10 to StrongSwan VPN

I'm trying to to test a new (in progress) StrongSwan IPSec VPN server by connecting from OS X 10.10. This is very frustrating because the the logs show a series of "success" messages, but then the ...
0
votes
0answers
413 views

Missing /etc/init.d/ipsec script after installing strongswan 5.3.2 from source

Ubuntu 14.04 (Amazon's Ubuntu AMI). Installed strongswan 5.3.2 from source (latest version in repo is too old and doesn't work). 1 question: 1) Noticed that the /init.d/ipsec (or /init/) script is ...
0
votes
0answers
276 views

Strongswan IPSec + XL2TP connection not working

I am trying to set up a VPN (Strongswan + xl2tpd) between my desktop and a server in AWS both running Linux (Ubuntu) but I really am getting lost. I believe I have the IPSec part working but I am not ...
0
votes
1answer
874 views

Configure StrongSwan to work with DHCP

I have implemented a StrongSwan VPN server and would like to configure it to dynamically assign IPs to the end client. The VPN works if I give it an IP range however not if I set it to DHCP. This is ...
0
votes
0answers
196 views

Strongswan: Connection established but one way data transfer

Posting Updated: 26.06 11:22 I'm trying to use a rasperry pi on arch linux as strongswan ikev2 server for my windows phone 8.1 smartphone. I would like to use a client certificate for authentication. ...
1
vote
1answer
550 views

Docker container can not access hosts behind VPN

I have a VPN gateway which allows remote access to a network with subnet 171.30.0.0/16. I have a local machine setup with ubuntu 14.04 and strongswan which connects to that VPN server using IKEv2 RSA ...
3
votes
2answers
2k views

Strongswan VPN tunnel between two AWS instances won't connect

I am trying to set up a VPN tunnel using StrongSwan 5.1.2 between two Amazon AWS EC2 instances running Ubuntu 14.04.2 LTS. Prior to using StrongSwan, I used open(libre)swan on an Amazon RedHat AMI, ...
0
votes
2answers
384 views

Accounting IPSec connections with RSA authentication

Apple iOS has "VPN On Demand" function. With this function the VPN connection is made whenever the device tries to connect to certain domains or to the internet at all. iOS supports "VPN On Demand" ...
0
votes
1answer
125 views

Can not connect into a subnet across a StrongSWAN VPN

This is a simplification of a bigger problem I'm experiencing, but I think it covers everything. The production issue is between a StrongSWAN VPN and a Juniper SSG550. The network setup is clearly not ...
0
votes
1answer
2k views

Route all traffic through StrongSwan VPN

I'm new to this - please excuse my ignorance. I have looked through many other similar questions to no avail. Trying to set up a StrongSwan VPN such that client C can connect to host H, be assigned ...
1
vote
0answers
534 views

Virtual IP Pool for NAT with StrongSwan VPN

I'm trying to wrap my head around a site-to-site VPN configuration using StrongSwan that will allow remote sites to connect to our AWS VPC. The catch is, the remote gateways will potentially be using ...