an open source, multi-platform IPSec stack, with IKEv2 & 1 support

learn more… | top users | synonyms

9
votes
2answers
17k views

Strongswan vpn tunnel connected but the traffic is not routed through it

I have just set up a vpn tunnel site-to-site with strongswan (4.5). The tunnel looks fine and connected to the other side, but seems there is a problem routing traffic through the tunnel. Any idea? ...
6
votes
1answer
4k views

strongSwan IPsec server with AWS EC2 VPC VPN client

I'm trying to create a VPN tunnel between 2 AWS regions. The way I'm trying to do this is by setting up a IPsec server in Linux with strongSwan in one region, and then a VPC VPN in the other region. ...
6
votes
1answer
1k views

Simultaneous IKEv1 and IKEv2 connection support in Strongswan

I'm using Strongswan to handle IPsec connections, and need a way to support both Windows (IKEv2) and OS X (IKEv1) clients. I would prefer to use pure IPsec (i.e. avoid having to setup L2TP) unless ...
5
votes
2answers
12k views

strongSwan IKEv2 + Windows 7 Agile VPN: What is causing Error 13801

I have an AWS instance that I want to be a VPN server. It will connect Windows 7 clients to a private network in the Amazon cloud. I have installed Ubuntu 12.04 and the strongswan-ikev2 package. ...
5
votes
1answer
1k views

AWS StrongSwan IPSec VPN

I've been playing around with StrongSwan recently as a replacement to Amazons VPN which cost money. I'm having trouble completely configuring a IPSec tunnel between a remote server and a Ubuntu EC2 ...
5
votes
2answers
1k views

TCP connection through IPSec (Linux/Strongswan) stalls after exceeding PMTU

The backups (via Bacula) of one of my servers (“A”) connected via IPSec (Strongswan on Debian testing) to a storage daemon (“B”) don't finish 95% of the times they run. What apparently happens, is: ...
5
votes
1answer
6k views

Strongswan VPN Established but no Packets Routed

I'm setting up a VPN using strongSwan between a Linux instance on an Amazon EC2 instance and a remote network via its Cisco concentrator. I need to route packets from the Linux instance itself a ...
4
votes
1answer
126 views

How do i get Strongswan / IPTables to route data back to my road warrior client correctly?

I have a simple VPN. I have a client on 10.185.28.241 who gets a virtual IP of 10.42.42.0/24 from the VPN which is located at 10.112.18.105 and is providing access to machines in the 10.112.0.0/16 ...
4
votes
0answers
553 views

strongSwan 4.5.2 with iOS and Mavericks, Connection Troubles

I am having trouble configuring strongSwan 4.5.2 to work with iOS 7 and OS X Mavericks. I have followed these two guides, but am still encountering problems. http://teebeenator.blogspot.com/2013/06/...
3
votes
2answers
2k views

Strongswan VPN tunnel between two AWS instances won't connect

I am trying to set up a VPN tunnel using StrongSwan 5.1.2 between two Amazon AWS EC2 instances running Ubuntu 14.04.2 LTS. Prior to using StrongSwan, I used open(libre)swan on an Amazon RedHat AMI, ...
2
votes
1answer
3k views

strongswan can't push DNS resolver to OSX Mountain Lion (split tunnel)

I'd like to set up an IPSec responder (VPN server) for OSX desktops and laptops. Everything seems to work fine, except I cannot push a DNS server to be used system-wide on the initiator (VPN client). ...
2
votes
1answer
3k views

strongSwan server with Windows 7 clients doesn't route traffic

I have a server running strongSwan on an Amazon EC2 instance that I want to connect to with Windows 7. The strongSwan server is on a private network (IP address 172.16.1.15 on the network 172.16.0.0/...
2
votes
1answer
2k views

strongswan: entirely virtual subnet [closed]

I recently set up a strongswan IPSec VPN to access some non-public services of my home server from my android smartphone. I am using OpenVPN on some other devices for the same task, but chose ...
2
votes
2answers
2k views

strongSwan without password on iOS [closed]

I have the following problem: I need to authenticate on VPN with iOS without password, but with certificate only. The reason is I need "VPN on demand", which is active on certificate authentication ...
2
votes
1answer
2k views

strongSwan ipsec setup, couple of questions

i am trying to setup a IPsec bridge between my home network and my office network. I want to use StrongSwan to encrypt the traffic as IPsec i am trying to follow this guide A brief description of ...
2
votes
1answer
287 views

Public key authentication with strongswan

I have two systems r1 and r2, and I want to establish an ESP tunnel between them with Strongswan using public key authentication. I have generated public keys, store in r1-pub.pem and r2-pub.pem ...
2
votes
1answer
276 views

Is using EAP-MD5 in strongSwan a security risk?

Quoting Wikipedia: It offers minimal security; the MD5 hash function is vulnerable to dictionary attacks, and does not support key generation, which makes it unsuitable for use with dynamic WEP, ...
2
votes
1answer
9k views

strongSwan setup where both sides are behind NAT

I'm trying to setup a strongSwan server in my home and connect to it from another network. Let's say sun is the VPN server and venus is the client. Both sun and venus are behind NAT networks. sun is ...
2
votes
1answer
679 views

OS X 10.10 to StrongSwan VPN

I'm trying to to test a new (in progress) StrongSwan IPSec VPN server by connecting from OS X 10.10. This is very frustrating because the the logs show a series of "success" messages, but then the ...
2
votes
2answers
4k views

Trying to replicate a working IPSec/L2TP config from OpenSWAN to StrongSWAN

I have a working OpenSWAN implementation for RA, using IPsec transport and l2tp for the tunnel, running in AWS. The instance has a private IP, with a public EIP mapped to it. I use the private ip for ...
2
votes
1answer
311 views

Is there a way to use an external program to authenticate XAuth with StrongSwan IPSec?

I'm currently using StrongSwan for my iOS devices to connect. I was wondering if there is a way to use an external program for XAUTH? I currently have the following configuration: : RSA server.pem ...
2
votes
2answers
7k views

Strongswan (IKEv2) connection established, but no traffic routing

I've seen this sort of question posted a few times before, but so far, none of them have solved my issue. I'm trying to set up an IKEv2 VPN on my Ubuntu Server to use with my Windows Phone using ...
2
votes
1answer
3k views

How do I resolved “Error 13843: Invalid Payload Received.”?

When Windows 8 tries to connect to my Strongswan VPN I get the following error, Error 13843: Invalid Payload Received. I'm not sure how to resolve it or what causes it. My charon log has this, ...
2
votes
0answers
74 views

Strongswan RA and Strongswan site-2-site with ASA

Task: Establish communication between remote clients (192.168.79.0/24) that are connecting to VPN server (on Ubuntu) and corporate network (10.1.2.0/24) connected to Cisco ASA. Schema: 192.168.79.0/...
2
votes
0answers
135 views

Strongswan to Cisco ASA

I have a problem with connection two nets with IPsec. On the one side is Cisco ASA 55xx on the other TP-Link router with Debian 8.3 with StrongSwan behind the NAT. The problem also that I have ...
2
votes
1answer
1k views

Windows 7/8 Strongswan IKEv2 Wrong Gateway

I have setup Strongswan on Ubuntu 14.04 from the official package. I use IKEv2 with PKI authentication and a custom authorization plugin. This works great for Android and Ubuntu clients using ...
2
votes
0answers
291 views

Having trouble installing Racoon and Strongswan on the same system

I have two applications that I need to run, one uses Racoon for establishing IPSec tunnels and the other uses Strongswan. Therefore, I need both Racoon and Strongswan installed simultaneously on my ...
2
votes
1answer
4k views

strongswan VPN on OpenWrt

Hi I'm running Barrier Breaker version of OpenWRT and I have setup a VPN according to: http://wiki.openwrt.org/inbox/strongswan.howto I can connect to the VPN with my iPhone or Mac (to 10.10.1.0/24 ...
1
vote
2answers
7k views

strongSwan - how do i generate pre shared keys?

I'm using the strongswan documentation right here I've added to /etc/ipsec.secrets the following line: : RSA moonKey.pem "SomePwd" however i don't know how to create moonKey.pem. Any ideas? this ...
1
vote
1answer
4k views

Filtering incoming Strongswan VPN packets with iptables

I am using a Strongswan VPN server on a Debian Squeeze machine. The incoming VPN clients get an IP of the 192.168.99.0/24 subnet. As I am using this VPN mainly to have encryption when using non-...
1
vote
1answer
230 views

Can one use a MySQL backend for user authentication in a strongswan VPN server?

We have installed and configured a strongswan VPN server with username / password authentication. Is it possible to store the users' credentials in a MySQL backend and configure strongswan to use the ...
1
vote
1answer
206 views

ipsec/strongswan - how to use remote router as local gateway using the route command

Ok, this should be an easy one, but its driving me nuts. Scenario: Site A (San Francisco) Site B (Colombia) Both sites are connected successfully via IPSec (openswan, debian 8): SiteA-...
1
vote
1answer
177 views

When and with which parameters does strongSwan select a connection?

StrongSwan (as responder) selects a configured connection (conn section in ipsec.conf) for each incoming initiator key exchange intent. At which times does strongSwan pick a connection configuration? ...
1
vote
1answer
2k views

Running a custom script when StrongSwan connection is established

I have StrongSwan VPN server set up on a Debian host, and would like to run a custom script when a client connects to it. The only thing I have come up with is periodically checking the contents of ...
1
vote
1answer
606 views

Issues with StrongSwan on FreeBSD 10.0. Charon refuses to start

The charon.log with full debug levels (4) is as follows: Jan 21 16:09:47 00[DMN] Starting IKE charon daemon (strongSwan 5.0.4, FreeBSD 10.0-RELEASE, amd64) Jan 21 16:09:47 00[LIB] plugin 'aes': ...
1
vote
2answers
510 views

Windows 8 and SSL's EKU serverAuth flag?

I'm reading this tutorial which says, Your gateway certificate must have: An Extended Key Usage flag explicitly allowing the certificate to be used for authentication purposes. The serverAuth EKU ...
1
vote
1answer
2k views

Finally get my win 7 connected to strongSwan VPN, but there's no Internet [closed]

I believe I've followed all the instructions, and my win 7 did get connected, but there's no Internet. Background: Server OS: ubuntu 12.04 on linode xen VPS strongSwan Version: 4.6.4 ...
1
vote
1answer
91 views

How to centrally manage routing info?

I'm trying to build a VPN setup, where there are several Road-Warriors (various OSes) want to communicate to internal network behind a VPN gateway. The key facts are these: Internal network is 10....
1
vote
0answers
18 views

Two users behind same NAT (PSK or EAP) - strongswan

I have a strongswan implementation and am running into an issue where when there are two users behind the same NAT, the second one "kicks off" the first one. I was able to resolve the issue using: ...
1
vote
1answer
41 views

How to redirect traffic through IPv6 IPSec (strongswan) gateway?

I'm trying to set up IPSec secured connection to the gateway. Have three hosts: A: eth1 - fec0:1::1/64 B: eth1 - fec0:1::2/64 eth2 - fec0:2::2/64 which is gateway between A and C; forwarding is set ...
1
vote
0answers
73 views

Is it possible to use certificate from public CA for IKEv2 without importing intermediate cert?

I have configured ikev2 vpn on a strongswan server and a Windows 10 client, and it works fine. The authorization method is leftauth=pubkey and rightauth=eap-mschapv2. Because the leftcert to ...
1
vote
0answers
515 views

Connect Ubuntu 14.04 with Strongswan to Microsoft Azure

I want to connect my Ubuntu 14.04 server with Strongswan to Microsoft Azure Gateway. I only want to establish a connection between Azure and that Ubuntu server. In Azure I configured a dynamic gateway....
1
vote
0answers
299 views

CentOS + strongswan + iOS VPN API, hal

I'm trying to setup StrongSwan on CentOS for iOS with VPN API. This API uses IKEv2 protocol. Here is my logs + configuration files. When i press connect in iOS device it's getting off in a few moments....
1
vote
1answer
491 views

Two tunnels with same rightsubnet for StrongSWAN/OpenSWAN

I'm trying to set up the "Option 3" configuration for Google Cloud VPN, with two Google Cloud VPN gateways on the left and StrongSWAN or OpenSWAN on the right: If you have two Peer VPN gateways ...
1
vote
1answer
515 views

Docker container can not access hosts behind VPN

I have a VPN gateway which allows remote access to a network with subnet 171.30.0.0/16. I have a local machine setup with ubuntu 14.04 and strongswan which connects to that VPN server using IKEv2 RSA ...
1
vote
0answers
513 views

Virtual IP Pool for NAT with StrongSwan VPN

I'm trying to wrap my head around a site-to-site VPN configuration using StrongSwan that will allow remote sites to connect to our AWS VPC. The catch is, the remote gateways will potentially be using ...
1
vote
0answers
360 views

Strongswan transport mode ipsec within subnet

Is there any way to configure strongswan to automatically start encryption to a given subnet rather than specific host? For example, if I know that my hosts at w.x.y.z/28 will be have the same PSK ...
1
vote
1answer
385 views

Strongswan to OpenBSD isakmpd IPSec VPN

At my end I have a StrongSwan installation, connecting to an IPSec VPN hosted by an OpenBSD box running stock isakmpd. The OpenBSD box already hosts multiple other associations, but the StrongSwan box ...
1
vote
1answer
2k views

Missing iptables rules for Strongswan routing for VPN for phone

I have a Centos 6.6 VPS out on the Internet that has a public IP. I have installed StrongSwan 5.1.3 to allow my BlackBerry10 phone to connect from hotspots and use the VPS' connection. The VPS' IP ...
1
vote
0answers
283 views

strongswan packet get natted when ufw is enabled

I'm using strongswan 4.6.4 to connect road warriors to my server (ubuntu 13.10), which is natted behind a firewall. left=%defaultroute leftsubnet=10.10.1.0/24 right=%any rightsubnet=...