The tag has no wiki summary.

learn more… | top users | synonyms

5
votes
1answer
9k views

Strongswan vpn tunnel connected but the traffic is not routed through it

I have just set up a vpn tunnel site-to-site with strongswan (4.5). The tunnel looks fine and connected to the other side, but seems there is a problem routing traffic through the tunnel. Any idea? ...
4
votes
2answers
554 views

TCP connection through IPSec (Linux/Strongswan) stalls after exceeding PMTU

The backups (via Bacula) of one of my servers (“A”) connected via IPSec (Strongswan on Debian testing) to a storage daemon (“B”) don't finish 95% of the times they run. What apparently happens, is: ...
3
votes
1answer
3k views

strongSwan IPsec server with AWS EC2 VPC VPN client

I'm trying to create a VPN tunnel between 2 AWS regions. The way I'm trying to do this is by setting up a IPsec server in Linux with strongSwan in one region, and then a VPC VPN in the other region. ...
3
votes
1answer
775 views

Simultaneous IKEv1 and IKEv2 connection support in Strongswan

I'm using Strongswan to handle IPsec connections, and need a way to support both Windows (IKEv2) and OS X (IKEv1) clients. I would prefer to use pure IPsec (i.e. avoid having to setup L2TP) unless ...
3
votes
0answers
426 views

strongSwan 4.5.2 with iOS and Mavericks, Connection Troubles

I am having trouble configuring strongSwan 4.5.2 to work with iOS 7 and OS X Mavericks. I have followed these two guides, but am still encountering problems. ...
3
votes
1answer
3k views

Strongswan VPN Established but no Packets Routed

I'm setting up a VPN using strongSwan between a Linux instance on an Amazon EC2 instance and a remote network via its Cisco concentrator. I need to route packets from the Linux instance itself a ...
2
votes
1answer
2k views

strongSwan ipsec setup, couple of questions

i am trying to setup a IPsec bridge between my home network and my office network. I want to use StrongSwan to encrypt the traffic as IPsec i am trying to follow this guide A brief description of ...
2
votes
2answers
6k views

strongSwan IKEv2 + Windows 7 Agile VPN: What is causing Error 13801

I have an AWS instance that I want to be a VPN server. It will connect Windows 7 clients to a private network in the Amazon cloud. I have installed Ubuntu 12.04 and the strongswan-ikev2 package. ...
2
votes
2answers
2k views

Trying to replicate a working IPSec/L2TP config from OpenSWAN to StrongSWAN

I have a working OpenSWAN implementation for RA, using IPsec transport and l2tp for the tunnel, running in AWS. The instance has a private IP, with a public EIP mapped to it. I use the private ip for ...
2
votes
1answer
191 views

AWS StrongSwan IPSec VPN

I've been playing around with StrongSwan recently as a replacement to Amazons VPN which cost money. I'm having trouble completely configuring a IPSec tunnel between a remote server and a Ubuntu EC2 ...
2
votes
0answers
230 views

Having trouble installing Racoon and Strongswan on the same system

I have two applications that I need to run, one uses Racoon for establishing IPSec tunnels and the other uses Strongswan. Therefore, I need both Racoon and Strongswan installed simultaneously on my ...
1
vote
2answers
5k views

strongSwan - how do i generate pre shared keys?

I'm using the strongswan documentation right here I've added to /etc/ipsec.secrets the following line: : RSA moonKey.pem "SomePwd" however i don't know how to create moonKey.pem. Any ideas? this ...
1
vote
1answer
1k views

strongswan can't push DNS resolver to OSX Mountain Lion (split tunnel)

I'd like to set up an IPSec responder (VPN server) for OSX desktops and laptops. Everything seems to work fine, except I cannot push a DNS server to be used system-wide on the initiator (VPN client). ...
1
vote
1answer
2k views

Filtering incoming Strongswan VPN packets with iptables

I am using a Strongswan VPN server on a Debian Squeeze machine. The incoming VPN clients get an IP of the 192.168.99.0/24 subnet. As I am using this VPN mainly to have encryption when using ...
1
vote
1answer
4k views

strongSwan setup where both sides are behind NAT

I'm trying to setup a strongSwan server in my home and connect to it from another network. Let's say sun is the VPN server and venus is the client. Both sun and venus are behind NAT networks. sun is ...
1
vote
2answers
2k views

strongSwan without password on iOS [closed]

I have the following problem: I need to authenticate on VPN with iOS without password, but with certificate only. The reason is I need "VPN on demand", which is active on certificate authentication ...
1
vote
1answer
145 views

Is using EAP-MD5 in strongSwan a security risk?

Quoting Wikipedia: It offers minimal security; the MD5 hash function is vulnerable to dictionary attacks, and does not support key generation, which makes it unsuitable for use with dynamic WEP, ...
1
vote
1answer
868 views

Running a custom script when StrongSwan connection is established

I have StrongSwan VPN server set up on a Debian host, and would like to run a custom script when a client connects to it. The only thing I have come up with is periodically checking the contents of ...
1
vote
1answer
402 views

Issues with StrongSwan on FreeBSD 10.0. Charon refuses to start

The charon.log with full debug levels (4) is as follows: Jan 21 16:09:47 00[DMN] Starting IKE charon daemon (strongSwan 5.0.4, FreeBSD 10.0-RELEASE, amd64) Jan 21 16:09:47 00[LIB] plugin 'aes': ...
1
vote
1answer
2k views

How do I resolved “Error 13843: Invalid Payload Received.”?

When Windows 8 tries to connect to my Strongswan VPN I get the following error, Error 13843: Invalid Payload Received. I'm not sure how to resolve it or what causes it. My charon log has this, ...
1
vote
2answers
388 views

Windows 8 and SSL's EKU serverAuth flag?

I'm reading this tutorial which says, Your gateway certificate must have: An Extended Key Usage flag explicitly allowing the certificate to be used for authentication purposes. The serverAuth EKU ...
1
vote
1answer
87 views

How to centrally manage routing info?

I'm trying to build a VPN setup, where there are several Road-Warriors (various OSes) want to communicate to internal network behind a VPN gateway. The key facts are these: Internal network is ...
1
vote
0answers
143 views

Virtual IP Pool for NAT with StrongSwan VPN

I'm trying to wrap my head around a site-to-site VPN configuration using StrongSwan that will allow remote sites to connect to our AWS VPC. The catch is, the remote gateways will potentially be using ...
1
vote
1answer
138 views

Strongswan to OpenBSD isakmpd IPSec VPN

At my end I have a StrongSwan installation, connecting to an IPSec VPN hosted by an OpenBSD box running stock isakmpd. The OpenBSD box already hosts multiple other associations, but the StrongSwan box ...
1
vote
1answer
578 views

Windows 7/8 Strongswan IKEv2 Wrong Gateway

I have setup Strongswan on Ubuntu 14.04 from the official package. I use IKEv2 with PKI authentication and a custom authorization plugin. This works great for Android and Ubuntu clients using ...
1
vote
1answer
155 views

Is there a way to use an external program to authenticate XAuth with StrongSwan IPSec?

I'm currently using StrongSwan for my iOS devices to connect. I was wondering if there is a way to use an external program for XAUTH? I currently have the following configuration: : RSA server.pem ...
1
vote
2answers
3k views

Strongswan (IKEv2) connection established, but no traffic routing

I've seen this sort of question posted a few times before, but so far, none of them have solved my issue. I'm trying to set up an IKEv2 VPN on my Ubuntu Server to use with my Windows Phone using ...
1
vote
0answers
150 views

strongswan packet get natted when ufw is enabled

I'm using strongswan 4.6.4 to connect road warriors to my server (ubuntu 13.10), which is natted behind a firewall. left=%defaultroute leftsubnet=10.10.1.0/24 right=%any ...
0
votes
2answers
2k views

Using strongswan, what's the difference between auto=add, and auto=start?

The docs on this are pretty vague, what operation, if any, should be done automatically at IPsec startup. add loads a connection without starting it. route loads a connection and installs kernel ...
0
votes
1answer
2k views

strongSwan server with Windows 7 clients doesn't route traffic

I have a server running strongSwan on an Amazon EC2 instance that I want to connect to with Windows 7. The strongSwan server is on a private network (IP address 172.16.1.15 on the network ...
0
votes
1answer
1k views

strongswan: entirely virtual subnet [closed]

I recently set up a strongswan IPSec VPN to access some non-public services of my home server from my android smartphone. I am using OpenVPN on some other devices for the same task, but chose ...
0
votes
2answers
37 views

Strongswan VPN tunnel between two AWS instances won't connect

I am trying to set up a VPN tunnel using StrongSwan 5.1.2 between two Amazon AWS EC2 instances running Ubuntu 14.04.2 LTS. Prior to using StrongSwan, I used open(libre)swan on an Amazon RedHat AMI, ...
0
votes
1answer
1k views

SSH not working over IPSec tunnel (Strongswan)

I configured a small network on a cloud virtual machine. This virtual machine has a static IP address assigned to eth0 interface that I'll call $EXTIP. mydomain.com points to $EXTIP. Inside, I have ...
0
votes
1answer
282 views

EAP password prompt in strongSwan

I'm trying to setup a host-host configuration using strongSwan. I did manage to set it up using certificates and now I wish to set it up using certificates + EAP authentication. I mixed this ...
0
votes
2answers
1k views

what does “openssl FIPS mode(0) unavailable” mean?

I compiled and installed strongswan ipsec vpn successfully, as demonstrated by the fact that the service starts successfully: as3:~# ipsec restart Stopping strongSwan IPsec... Starting ...
0
votes
0answers
17 views

Strongswan: Connection established but one way data transfer

Posting Updated: 26.06 11:22 I'm trying to use a rasperry pi on arch linux as strongswan ikev2 server for my windows phone 8.1 smartphone. I would like to use a client certificate for authentication. ...
0
votes
1answer
30 views

Docker container can not access hosts behind VPN

I have a VPN gateway which allows remote access to a network with subnet 171.30.0.0/16. I have a local machine setup with ubuntu 14.04 and strongswan which connects to that VPN server using IKEv2 RSA ...
0
votes
0answers
11 views

How does IPSec right=%any setup the SA?

I've seen lots of examples where each gateway in an IPSec is configured with right=%any. I'm perplexed how these gateways find the IP to connect to (assuming both gateways are set up that way). The ...
0
votes
2answers
77 views

Accounting IPSec connections with RSA authentication

Apple iOS has "VPN On Demand" function. With this function the VPN connection is made whenever the device tries to connect to certain domains or to the internet at all. iOS supports "VPN On Demand" ...
0
votes
0answers
34 views

strongswan/centos7: Don't get answer from other side (but IPSEC connection seems OK…)

My question: I can't access the other side server to get service, no ping, no telnet working. Is there something wrong on my side? I have problem with Strongswan on centos 7 (compiled version 5.3.2). ...
0
votes
1answer
49 views

Can not connect into a subnet across a StrongSWAN VPN

This is a simplification of a bigger problem I'm experiencing, but I think it covers everything. The production issue is between a StrongSWAN VPN and a Juniper SSG550. The network setup is clearly not ...
0
votes
1answer
85 views

Route all traffic through StrongSwan VPN

I'm new to this - please excuse my ignorance. I have looked through many other similar questions to no avail. Trying to set up a StrongSwan VPN such that client C can connect to host H, be assigned ...
0
votes
0answers
53 views

strongSwan on Angstrom

My problem is to establish a VPN tunnel between cRIO 9068 and a Cisco router. To accomplish this task I was planning to install strongswan on cRIO (opkg install strongswan). I have installed it on ...
0
votes
0answers
124 views

Strongswan transport mode ipsec within subnet

Is there any way to configure strongswan to automatically start encryption to a given subnet rather than specific host? For example, if I know that my hosts at w.x.y.z/28 will be have the same PSK ...
0
votes
0answers
62 views

strongSwan IKEv2 external authentication

I use Linux IPSec VPN-server based on strongSwan 5.2.1 with eap-mschapv2 authentication using passwords in ipsec.secrets file. Now I need to add one more VPN-server for the same users and I want to ...
0
votes
1answer
687 views

No traffic routing between Cisco CSR1000v and Strongswan IPSec end points on AWS

I am trying to configure a Cisco CSR1000V on AWS to create an IPSec VPN with Strongswan 5.1.2 (on Ubuntu 14.04) on another AWS machine. I can establish the VPN from the Strongswan end and it appears ...
0
votes
0answers
56 views

Strongswan + Iptables: rules for INPUT chain?

I'm struggling to adapt my firewall to restrictively allow VPN traffic of a Strongswan installation. The problem seems to be with the INPUT chain: if I add saddr $VPN_PARTNERS ACCEPT, then it works ...
0
votes
0answers
56 views

Dropped TCP Packets over two-stage IKEv2 VPNs

Something of a weird setup this: There are two Virtual Private Clouds (10.100.240.0/20 = prod1 and 10.101.0.0/24 = control), which have a valid router between them. Control hosts a VPN that is meant ...
0
votes
0answers
289 views

Centos and Strongswan

I'm trying to implement a strongswan solution for a site to site tunnel between me and a third party vendor. My tunnel establishes fine between myself and the vendor however I am wondering if this is ...
0
votes
0answers
549 views

Missing iptables rules for Strongswan routing for VPN for phone

I have a Centos 6.6 VPS out on the Internet that has a public IP. I have installed StrongSwan 5.1.3 to allow my BlackBerry10 phone to connect from hotspots and use the VPS' connection. The VPS' IP ...