Hot answers tagged

32 votes

Connect to a Fortinet VPN with Ubuntu

If you use SSL based VPN from Fortinet, you can use openfortivpn software which is part of Ubuntu and Fedora. $ sudo apt install -y openfortivpn || yum install -y openfortivpn $ touch openfortivpn....
Mircea Vutcovici's user avatar
24 votes
Accepted

IPsec for Linux - strongSwan vs Openswan vs Libreswan vs other(?)

It appears to me that StrongSwan and LibreSwan are the two main viable products now-a-days. strongswan vs openswan has one good comprehensive comment with some comparisons between StrongSwan and ...
Raymond Burkholder's user avatar
10 votes

How to enable debug logs in OpenSwan?

Required to add the configuration to file /etc/ipsec.conf # basic configuration config setup plutodebug=all plutostderrlog=/var/log/openswan.log
Michael's user avatar
  • 597
9 votes

Using strongswan, what's the difference between auto=add, and auto=start?

It's worth noting that auto=start will not re-establish the tunnel if it is shut down. This can cause issues where the tunnel will come up perfectly when you restart your server (or restart ipsec), ...
user189271's user avatar
8 votes
Accepted

Block an application from accessing the network, except for a single IP address

According to this answer you can't create an exception for an outgoing block rule. So instead you will need to create multiple block rules for the executable, so as to cover the entire IP address ...
Harry Johnston's user avatar
6 votes

How to debug ip xfrm rules

To debug xfrm, you can use command ip xfrm monitor. It will show changes in database policy. And it will show the processing of each data packets.
PokerFace's user avatar
  • 161
6 votes

How can I capture IPSEC packets on my VPN server?

The filter with tcp port 80 will never capture ESP, since esp protocol (IP protocol 50) is not tcp (IP protocol 6) and will never match this filter. For Linux, this schematic and its few places ...
A.B's user avatar
  • 12.5k
5 votes

Why are only 3 ip xfrm policies needed for a IPsec tunnel?

From this article by Andrej Stender: security policy syntax meaning “output policy” dir out SP works as a selector on outgoing packets to select which are to be encrypted+encapsulated and which not ...
hth's user avatar
  • 51
5 votes

Enable IKE tracing on windows 10 VPN

For enabling logs atleast in Creators update and above for windows we added a new trace provider. Netsh trace start VpnClient per=yes maxsize=0 filemode=single <Repro the scenario> Netsh trace ...
Aman Arneja - MSFT's user avatar
5 votes

Windows 10 built in VPN

This question is a bit old but I decided to share my experiences with L2TP/IPSec using PSK in Windows 10, somebody might find it useful. I was experimenting with L2TP/IPsec connections between a ...
bcs78's user avatar
  • 382
5 votes
Accepted

How to store hashes in ipsec.secrets when using Strongswan with eap-mschapv2?

Classic challenge-response based EAP methods (and in particular those supported by strongSwan) require access to the plaintext password to verify the client's response (EAP-MSCHAPv2 is actually an ...
ecdsa's user avatar
  • 4,103
5 votes
Accepted

Client packets not forwarded over strongSwan IPsec site-to-site tunnel for client and gateway on the same server

IPsec traffic should be routed, you probably hit the default NAT issue of the default NAT rule affecting IPsec traffic. The remedy is: iptables -t nat -I POSTROUTING 1 -m policy --pol ipsec --dir out ...
Vesper's user avatar
  • 804
5 votes
Accepted

Strongswan: "received NO_PROPOSAL_CHOSEN error notify" while connecting to Cisco ASA

As can be seen in the debug log of the vpnc client while parsing the Quick Mode response PARSING PAYLOAD type: 03 (ISAKMP_PAYLOAD_T) next_type: 00 (ISAKMP_PAYLOAD_NONE) length: 0020 t.number: 01 t.id:...
ecdsa's user avatar
  • 4,103
5 votes

OpenSSL equivalent of libreswan IPSEC

I've spent 3hrs trying to get this, so here they are to save you time: ################### Create certificate authority cert openssl req -new -x509 -days 3650 \ -newkey rsa:4096 -nodes \ -subj "/C=GB/...
Christian's user avatar
  • 796
5 votes
Accepted

Fixing 70% transfer speed slowdown over VPN compared as compared to SSH? (Tested OpenVPN, IPSec/L2TP, OpenSSH, SoftEther)

Given the link posted in the comments, I decided to take another look at this openvpn article: https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux I was able to achieve ~150Mbit/s ...
Gbps's user avatar
  • 161
5 votes

How do I fix verify certificate error when connecting to an AWS Client VPN endpoint?

Further to the answer by Maruthi - I would comment, but don't have enough reputation... Here is a similar official answer from AWS But, crucially, they specify replacing the 3rd certificate in the ...
Matthew Richardson's user avatar
5 votes

How can I capture IPSEC packets on my VPN server?

I was able to capture traffic inside IPSEC using this strongswan page In short: iptables -I INPUT -m addrtype --dst-type LOCAL -m policy --pol ipsec --dir in -j NFLOG --nflog-group 5 iptables -I ...
user2586441's user avatar
4 votes
Accepted

Strongswan: clients can connect to server but no internet access

Finally I found the problem. adding FORWARD rule to iptables solved my problem.
Ghasem Pahlavan's user avatar
4 votes

How do you reset the default "IP Security Policies on Active Directory" back to their factory settings?

Assuming you're talking about the Default Domain Policy or the Default Domain Controllers Policy You can either compare them to a non-modified GPO in another domain or you can run DCGPOFIX. http://...
joeqwerty's user avatar
  • 111k
4 votes
Accepted

Why does 'ipsec statusall' not show any connections?

The IKE daemon used by the NetworkManager plugin (charon-nm) is different than the regular IKE daemon (charon) that you interact with via the ipsec script. Therefore, you won't be able to see the ...
ecdsa's user avatar
  • 4,103
4 votes
Accepted

How to encrypt connections to SQL Server with IPSec?

You can't use 'allow this connection if it is secure' until you have a connection security rule in place. This needs to be defined on both systems and have matching settings, just like setting up a ...
Tim Brigham's user avatar
  • 15.6k
4 votes
Accepted

Strongswan IKEv2 VPN on OS X 10.11 and iOS 10 Clients

As it turns out, I needed to use the Apple Configurator to create the VPN Profile so I could set the cryptography to use DH Group 2 and 3DES. I also had to change the Remote ID to the FQDN of the VPN ...
Olivia's user avatar
  • 181
4 votes
Accepted

strongSwan + xl2tpd VPN server: how to configure several config files?

Don't use the aggressive mode, the connection will be less secure. Anyway try with this configuration. I use it on a my VPN Server with strongswan-5.3.5 and xl2tpd-1.3.6 ipsec.conf config setup ...
DarkVex's user avatar
  • 428
4 votes

Linux ip xfrm: What is the purpose of the tmpl?

It tells the kernel how to process packets (for out policies), or where packets must come from (for in policies) when traffic matches this policy (fwd policies are a bit special as they might apply in ...
ecdsa's user avatar
  • 4,103
4 votes

Client packets not forwarded over strongSwan IPsec site-to-site tunnel for client and gateway on the same server

If you have any NAT rules configured, like MASQUERADE via --add-masquerade, you have to exclude traffic that matches an IPsec policy from getting natted. Otherwise that traffic will just get natted to ...
ecdsa's user avatar
  • 4,103
4 votes
Accepted

IPSEC IKEv2 not hiding HTTPS

VPN traffic is easily detected by packet inspection, or in this case just by the ports in use. It is quite possible your company is aware of what you are attempting or doing. If your are trying to ...
BillThor's user avatar
  • 27.9k
4 votes
Accepted

Windows 10 connection to strongswan ipsec server fails with "IKE authentication credentials are unacceptable

Turns out that the problem was with the intermediate Let's Encrypt certificate, despite it being included in my server's cert file. Putting it in /etc/ipsec.d/cacerts solved the problem.
Kayson's user avatar
  • 301
4 votes
Accepted

How do I fix verify certificate error when connecting to an AWS Client VPN endpoint?

It looks like the Certificate Authority Root Certificate wasn't properly imported into your client. Hence it can't verify the Server Certificate (against any valid Root CA Cert) and complains about ...
MLu's user avatar
  • 25.4k
4 votes

How do I fix verify certificate error when connecting to an AWS Client VPN endpoint?

Copying an answer from reddit that worked for me: https://www.reddit.com/r/aws/comments/aeohf5/any_ideas_to_successfully_connect_to_an_aws/ I have support and opened a case with them. They told me to ...
Maruthi's user avatar
  • 141
3 votes

What do transmit errors on Linux IPsec virtual tunnel interfaces indicate?

The transmit errors on VTI interfaces (and other tunneling interfaces) have special meanings. Unfortunately it's poorly documented and I've looked into the source code of kernel to investigate this (...
Anton Danilov's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible