The tag has no wiki summary.

learn more… | top users | synonyms

5
votes
1answer
10k views

Strongswan vpn tunnel connected but the traffic is not routed through it

I have just set up a vpn tunnel site-to-site with strongswan (4.5). The tunnel looks fine and connected to the other side, but seems there is a problem routing traffic through the tunnel. Any idea? ...
4
votes
2answers
612 views

TCP connection through IPSec (Linux/Strongswan) stalls after exceeding PMTU

The backups (via Bacula) of one of my servers (“A”) connected via IPSec (Strongswan on Debian testing) to a storage daemon (“B”) don't finish 95% of the times they run. What apparently happens, is: ...
4
votes
1answer
810 views

Simultaneous IKEv1 and IKEv2 connection support in Strongswan

I'm using Strongswan to handle IPsec connections, and need a way to support both Windows (IKEv2) and OS X (IKEv1) clients. I would prefer to use pure IPsec (i.e. avoid having to setup L2TP) unless ...
4
votes
0answers
449 views

strongSwan 4.5.2 with iOS and Mavericks, Connection Troubles

I am having trouble configuring strongSwan 4.5.2 to work with iOS 7 and OS X Mavericks. I have followed these two guides, but am still encountering problems. ...
3
votes
1answer
3k views

strongSwan IPsec server with AWS EC2 VPC VPN client

I'm trying to create a VPN tunnel between 2 AWS regions. The way I'm trying to do this is by setting up a IPsec server in Linux with strongSwan in one region, and then a VPC VPN in the other region. ...
3
votes
1answer
3k views

Strongswan VPN Established but no Packets Routed

I'm setting up a VPN using strongSwan between a Linux instance on an Amazon EC2 instance and a remote network via its Cisco concentrator. I need to route packets from the Linux instance itself a ...
2
votes
1answer
2k views

strongSwan ipsec setup, couple of questions

i am trying to setup a IPsec bridge between my home network and my office network. I want to use StrongSwan to encrypt the traffic as IPsec i am trying to follow this guide A brief description of ...
2
votes
2answers
7k views

strongSwan IKEv2 + Windows 7 Agile VPN: What is causing Error 13801

I have an AWS instance that I want to be a VPN server. It will connect Windows 7 clients to a private network in the Amazon cloud. I have installed Ubuntu 12.04 and the strongswan-ikev2 package. ...
2
votes
1answer
41 views

OS X 10.10 to StrongSwan VPN

I'm trying to to test a new (in progress) StrongSwan IPSec VPN server by connecting from OS X 10.10. This is very frustrating because the the logs show a series of "success" messages, but then the ...
2
votes
2answers
2k views

Trying to replicate a working IPSec/L2TP config from OpenSWAN to StrongSWAN

I have a working OpenSWAN implementation for RA, using IPsec transport and l2tp for the tunnel, running in AWS. The instance has a private IP, with a public EIP mapped to it. I use the private ip for ...
2
votes
1answer
170 views

Is there a way to use an external program to authenticate XAuth with StrongSwan IPSec?

I'm currently using StrongSwan for my iOS devices to connect. I was wondering if there is a way to use an external program for XAUTH? I currently have the following configuration: : RSA server.pem ...
2
votes
1answer
267 views

AWS StrongSwan IPSec VPN

I've been playing around with StrongSwan recently as a replacement to Amazons VPN which cost money. I'm having trouble completely configuring a IPSec tunnel between a remote server and a Ubuntu EC2 ...
2
votes
0answers
234 views

Having trouble installing Racoon and Strongswan on the same system

I have two applications that I need to run, one uses Racoon for establishing IPSec tunnels and the other uses Strongswan. Therefore, I need both Racoon and Strongswan installed simultaneously on my ...
1
vote
2answers
5k views

strongSwan - how do i generate pre shared keys?

I'm using the strongswan documentation right here I've added to /etc/ipsec.secrets the following line: : RSA moonKey.pem "SomePwd" however i don't know how to create moonKey.pem. Any ideas? this ...
1
vote
1answer
2k views

strongswan can't push DNS resolver to OSX Mountain Lion (split tunnel)

I'd like to set up an IPSec responder (VPN server) for OSX desktops and laptops. Everything seems to work fine, except I cannot push a DNS server to be used system-wide on the initiator (VPN client). ...
1
vote
1answer
1k views

strongswan: entirely virtual subnet [closed]

I recently set up a strongswan IPSec VPN to access some non-public services of my home server from my android smartphone. I am using OpenVPN on some other devices for the same task, but chose ...
1
vote
1answer
2k views

Filtering incoming Strongswan VPN packets with iptables

I am using a Strongswan VPN server on a Debian Squeeze machine. The incoming VPN clients get an IP of the 192.168.99.0/24 subnet. As I am using this VPN mainly to have encryption when using ...
1
vote
1answer
4k views

strongSwan setup where both sides are behind NAT

I'm trying to setup a strongSwan server in my home and connect to it from another network. Let's say sun is the VPN server and venus is the client. Both sun and venus are behind NAT networks. sun is ...
1
vote
2answers
2k views

strongSwan without password on iOS [closed]

I have the following problem: I need to authenticate on VPN with iOS without password, but with certificate only. The reason is I need "VPN on demand", which is active on certificate authentication ...
1
vote
1answer
19 views

When and with which parameters does strongSwan select a connection?

StrongSwan (as responder) selects a configured connection (conn section in ipsec.conf) for each incoming initiator key exchange intent. At which times does strongSwan pick a connection configuration? ...
1
vote
1answer
162 views

Is using EAP-MD5 in strongSwan a security risk?

Quoting Wikipedia: It offers minimal security; the MD5 hash function is vulnerable to dictionary attacks, and does not support key generation, which makes it unsuitable for use with dynamic WEP, ...
1
vote
1answer
935 views

Running a custom script when StrongSwan connection is established

I have StrongSwan VPN server set up on a Debian host, and would like to run a custom script when a client connects to it. The only thing I have come up with is periodically checking the contents of ...
1
vote
1answer
423 views

Issues with StrongSwan on FreeBSD 10.0. Charon refuses to start

The charon.log with full debug levels (4) is as follows: Jan 21 16:09:47 00[DMN] Starting IKE charon daemon (strongSwan 5.0.4, FreeBSD 10.0-RELEASE, amd64) Jan 21 16:09:47 00[LIB] plugin 'aes': ...
1
vote
1answer
2k views

How do I resolved “Error 13843: Invalid Payload Received.”?

When Windows 8 tries to connect to my Strongswan VPN I get the following error, Error 13843: Invalid Payload Received. I'm not sure how to resolve it or what causes it. My charon log has this, ...
1
vote
2answers
401 views

Windows 8 and SSL's EKU serverAuth flag?

I'm reading this tutorial which says, Your gateway certificate must have: An Extended Key Usage flag explicitly allowing the certificate to be used for authentication purposes. The serverAuth EKU ...
1
vote
1answer
1k views

Finally get my win 7 connected to strongSwan VPN, but there's no Internet [closed]

I believe I've followed all the instructions, and my win 7 did get connected, but there's no Internet. Background: Server OS: ubuntu 12.04 on linode xen VPS strongSwan Version: 4.6.4 ...
1
vote
1answer
88 views

How to centrally manage routing info?

I'm trying to build a VPN setup, where there are several Road-Warriors (various OSes) want to communicate to internal network behind a VPN gateway. The key facts are these: Internal network is ...
1
vote
0answers
218 views

Virtual IP Pool for NAT with StrongSwan VPN

I'm trying to wrap my head around a site-to-site VPN configuration using StrongSwan that will allow remote sites to connect to our AWS VPC. The catch is, the remote gateways will potentially be using ...
1
vote
1answer
155 views

Strongswan to OpenBSD isakmpd IPSec VPN

At my end I have a StrongSwan installation, connecting to an IPSec VPN hosted by an OpenBSD box running stock isakmpd. The OpenBSD box already hosts multiple other associations, but the StrongSwan box ...
1
vote
1answer
605 views

Windows 7/8 Strongswan IKEv2 Wrong Gateway

I have setup Strongswan on Ubuntu 14.04 from the official package. I use IKEv2 with PKI authentication and a custom authorization plugin. This works great for Android and Ubuntu clients using ...
1
vote
2answers
4k views

Strongswan (IKEv2) connection established, but no traffic routing

I've seen this sort of question posted a few times before, but so far, none of them have solved my issue. I'm trying to set up an IKEv2 VPN on my Ubuntu Server to use with my Windows Phone using ...
1
vote
0answers
183 views

strongswan packet get natted when ufw is enabled

I'm using strongswan 4.6.4 to connect road warriors to my server (ubuntu 13.10), which is natted behind a firewall. left=%defaultroute leftsubnet=10.10.1.0/24 right=%any ...
1
vote
1answer
3k views

strongswan VPN on OpenWrt

Hi I'm running Barrier Breaker version of OpenWRT and I have setup a VPN according to: http://wiki.openwrt.org/inbox/strongswan.howto I can connect to the VPN with my iPhone or Mac (to 10.10.1.0/24 ...
0
votes
1answer
789 views

StrongSwan outputs in log “certificate status is not available”

Wha does the warning certificate status is not available in charon.log mean? 16[CFG] certificate status is not available 16[CFG] reached self-signed root ca with a path length of 0 Everything ...
0
votes
2answers
2k views

Using strongswan, what's the difference between auto=add, and auto=start?

The docs on this are pretty vague, what operation, if any, should be done automatically at IPsec startup. add loads a connection without starting it. route loads a connection and installs kernel ...
0
votes
1answer
2k views

strongSwan server with Windows 7 clients doesn't route traffic

I have a server running strongSwan on an Amazon EC2 instance that I want to connect to with Windows 7. The strongSwan server is on a private network (IP address 172.16.1.15 on the network ...
0
votes
1answer
18 views

How can I tell strongswan that left is local (independent of IPs)?

Is there something like local = left which I could use in the strongSwan configuration? I don’t want to use any IP-addresses, as they might change. And I don’t want the server to guess it, I want to ...
0
votes
2answers
96 views

Strongswan VPN tunnel between two AWS instances won't connect

I am trying to set up a VPN tunnel using StrongSwan 5.1.2 between two Amazon AWS EC2 instances running Ubuntu 14.04.2 LTS. Prior to using StrongSwan, I used open(libre)swan on an Amazon RedHat AMI, ...
0
votes
2answers
114 views

Accounting IPSec connections with RSA authentication

Apple iOS has "VPN On Demand" function. With this function the VPN connection is made whenever the device tries to connect to certain domains or to the internet at all. iOS supports "VPN On Demand" ...
0
votes
1answer
1k views

SSH not working over IPSec tunnel (Strongswan)

I configured a small network on a cloud virtual machine. This virtual machine has a static IP address assigned to eth0 interface that I'll call $EXTIP. mydomain.com points to $EXTIP. Inside, I have ...
0
votes
1answer
302 views

EAP password prompt in strongSwan

I'm trying to setup a host-host configuration using strongSwan. I did manage to set it up using certificates and now I wish to set it up using certificates + EAP authentication. I mixed this ...
0
votes
2answers
1k views

what does “openssl FIPS mode(0) unavailable” mean?

I compiled and installed strongswan ipsec vpn successfully, as demonstrated by the fact that the service starts successfully: as3:~# ipsec restart Stopping strongSwan IPsec... Starting ...
0
votes
0answers
10 views

Docker & StrongSwan: Destination Host Unreachable

I'm having a bit of trouble communicating between containers using my IPsec tunnels. Here's my setup: I have Docker installed on multiple Ubuntu 14.04 hosts and I'm running various containers on ...
0
votes
0answers
9 views

Allow Strongswan roadwarrior to access local LAN

I have successfully established an IPSec tunnel between my local Linux host and a remote VPN gateway. I am using virtual IPs assign by the gateway because being a roadwarrior my local LAN subnet is ...
0
votes
0answers
41 views

Missing /etc/init.d/ipsec script after installing strongswan 5.3.2 from source

Ubuntu 14.04 (Amazon's Ubuntu AMI). Installed strongswan 5.3.2 from source (latest version in repo is too old and doesn't work). 1 question: 1) Noticed that the /init.d/ipsec (or /init/) script is ...
0
votes
0answers
34 views

Strongswan IPSec + XL2TP connection not working

I am trying to set up a VPN (Strongswan + xl2tpd) between my desktop and a server in AWS both running Linux (Ubuntu) but I really am getting lost. I believe I have the IPSec part working but I am not ...
0
votes
0answers
27 views

Strongswan ipsec linux not passing traffic after established

I currently have two PFsense routers that connect over the WAN using a similar configuration and traffic is passed with no issue. I'm trying to set up a 2nd path over 4G WWAN and have to use linux ...
0
votes
1answer
38 views

Configure StrongSwan to work with DHCP

I have implemented a StrongSwan VPN server and would like to configure it to dynamically assign IPs to the end client. The VPN works if I give it an IP range however not if I set it to DHCP. This is ...
0
votes
0answers
40 views

Strongswan: Connection established but one way data transfer

Posting Updated: 26.06 11:22 I'm trying to use a rasperry pi on arch linux as strongswan ikev2 server for my windows phone 8.1 smartphone. I would like to use a client certificate for authentication. ...
0
votes
1answer
94 views

Docker container can not access hosts behind VPN

I have a VPN gateway which allows remote access to a network with subnet 171.30.0.0/16. I have a local machine setup with ubuntu 14.04 and strongswan which connects to that VPN server using IKEv2 RSA ...