32
votes
Connect to a Fortinet VPN with Ubuntu
If you use SSL based VPN from Fortinet, you can use openfortivpn software which is part of Ubuntu and Fedora.
$ sudo apt install -y openfortivpn || yum install -y openfortivpn
$ touch openfortivpn....
24
votes
Accepted
IPsec for Linux - strongSwan vs Openswan vs Libreswan vs other(?)
It appears to me that StrongSwan and LibreSwan are the two main viable products now-a-days. strongswan vs openswan has one good comprehensive comment with some comparisons between StrongSwan and ...
10
votes
How to enable debug logs in OpenSwan?
Required to add the configuration to file /etc/ipsec.conf
# basic configuration
config setup
plutodebug=all
plutostderrlog=/var/log/openswan.log
9
votes
Using strongswan, what's the difference between auto=add, and auto=start?
It's worth noting that auto=start will not re-establish the tunnel if it is shut down. This can cause issues where the tunnel will come up perfectly when you restart your server (or restart ipsec), ...
8
votes
Accepted
Block an application from accessing the network, except for a single IP address
According to this answer you can't create an exception for an outgoing block rule.
So instead you will need to create multiple block rules for the executable, so as to cover the entire IP address ...
6
votes
How to debug ip xfrm rules
To debug xfrm, you can use command ip xfrm monitor.
It will show changes in database policy.
And it will show the processing of each data packets.
6
votes
How can I capture IPSEC packets on my VPN server?
The filter with tcp port 80 will never capture ESP, since esp protocol (IP protocol 50) is not tcp (IP protocol 6) and will never match this filter.
For Linux, this schematic and its few places ...
5
votes
Why are only 3 ip xfrm policies needed for a IPsec tunnel?
From this article by Andrej Stender:
security policy
syntax
meaning
“output policy”
dir out
SP works as a selector on outgoing packets to select which are to be encrypted+encapsulated and which not
...
5
votes
Enable IKE tracing on windows 10 VPN
For enabling logs atleast in Creators update and above for windows we added a new trace provider.
Netsh trace start VpnClient per=yes maxsize=0 filemode=single
<Repro the scenario>
Netsh trace ...
5
votes
Windows 10 built in VPN
This question is a bit old but I decided to share my experiences with L2TP/IPSec using PSK in Windows 10, somebody might find it useful.
I was experimenting with L2TP/IPsec connections between a ...
5
votes
Accepted
How to store hashes in ipsec.secrets when using Strongswan with eap-mschapv2?
Classic challenge-response based EAP methods (and in particular those supported by strongSwan) require access to the plaintext password to verify the client's response (EAP-MSCHAPv2 is actually an ...
5
votes
Accepted
Client packets not forwarded over strongSwan IPsec site-to-site tunnel for client and gateway on the same server
IPsec traffic should be routed, you probably hit the default NAT issue of the default NAT rule affecting IPsec traffic. The remedy is:
iptables -t nat -I POSTROUTING 1 -m policy --pol ipsec --dir out ...
5
votes
Accepted
Strongswan: "received NO_PROPOSAL_CHOSEN error notify" while connecting to Cisco ASA
As can be seen in the debug log of the vpnc client while parsing the Quick Mode response
PARSING PAYLOAD type: 03 (ISAKMP_PAYLOAD_T)
next_type: 00 (ISAKMP_PAYLOAD_NONE)
length: 0020
t.number: 01
t.id:...
5
votes
OpenSSL equivalent of libreswan IPSEC
I've spent 3hrs trying to get this, so here they are to save you time:
################### Create certificate authority cert
openssl req -new -x509 -days 3650 \
-newkey rsa:4096 -nodes \
-subj "/C=GB/...
5
votes
Accepted
Fixing 70% transfer speed slowdown over VPN compared as compared to SSH? (Tested OpenVPN, IPSec/L2TP, OpenSSH, SoftEther)
Given the link posted in the comments, I decided to take another look at this openvpn article:
https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux
I was able to achieve ~150Mbit/s ...
5
votes
How do I fix verify certificate error when connecting to an AWS Client VPN endpoint?
Further to the answer by Maruthi - I would comment, but don't have enough reputation...
Here is a similar official answer from AWS
But, crucially, they specify replacing the 3rd certificate in the ...
5
votes
How can I capture IPSEC packets on my VPN server?
I was able to capture traffic inside IPSEC using this strongswan page
In short:
iptables -I INPUT -m addrtype --dst-type LOCAL -m policy --pol ipsec --dir in -j NFLOG --nflog-group 5
iptables -I ...
4
votes
Accepted
Strongswan: clients can connect to server but no internet access
Finally I found the problem. adding FORWARD rule to iptables solved my problem.
4
votes
How do you reset the default "IP Security Policies on Active Directory" back to their factory settings?
Assuming you're talking about the Default Domain Policy or the Default Domain Controllers Policy You can either compare them to a non-modified GPO in another domain or you can run DCGPOFIX.
http://...
4
votes
Accepted
Why does 'ipsec statusall' not show any connections?
The IKE daemon used by the NetworkManager plugin (charon-nm) is different than the regular IKE daemon (charon) that you interact with via the ipsec script.
Therefore, you won't be able to see the ...
4
votes
Accepted
How to encrypt connections to SQL Server with IPSec?
You can't use 'allow this connection if it is secure' until you have a connection security rule in place. This needs to be defined on both systems and have matching settings, just like setting up a ...
4
votes
Accepted
Strongswan IKEv2 VPN on OS X 10.11 and iOS 10 Clients
As it turns out, I needed to use the Apple Configurator to create the VPN Profile so I could set the cryptography to use DH Group 2 and 3DES.
I also had to change the Remote ID to the FQDN of the VPN ...
4
votes
Accepted
strongSwan + xl2tpd VPN server: how to configure several config files?
Don't use the aggressive mode, the connection will be less secure.
Anyway try with this configuration. I use it on a my VPN Server with strongswan-5.3.5 and xl2tpd-1.3.6
ipsec.conf
config setup
...
4
votes
Linux ip xfrm: What is the purpose of the tmpl?
It tells the kernel how to process packets (for out policies), or where packets must come from (for in policies) when traffic matches this policy (fwd policies are a bit special as they might apply in ...
4
votes
Client packets not forwarded over strongSwan IPsec site-to-site tunnel for client and gateway on the same server
If you have any NAT rules configured, like MASQUERADE via --add-masquerade, you have to exclude traffic that matches an IPsec policy from getting natted. Otherwise that traffic will just get natted to ...
4
votes
Accepted
IPSEC IKEv2 not hiding HTTPS
VPN traffic is easily detected by packet inspection, or in this case just by the ports in use. It is quite possible your company is aware of what you are attempting or doing.
If your are trying to ...
4
votes
Accepted
Windows 10 connection to strongswan ipsec server fails with "IKE authentication credentials are unacceptable
Turns out that the problem was with the intermediate Let's Encrypt certificate, despite it being included in my server's cert file. Putting it in /etc/ipsec.d/cacerts solved the problem.
4
votes
Accepted
How do I fix verify certificate error when connecting to an AWS Client VPN endpoint?
It looks like the Certificate Authority Root Certificate wasn't properly imported into your client. Hence it can't verify the Server Certificate (against any valid Root CA Cert) and complains about ...
4
votes
How do I fix verify certificate error when connecting to an AWS Client VPN endpoint?
Copying an answer from reddit that worked for me: https://www.reddit.com/r/aws/comments/aeohf5/any_ideas_to_successfully_connect_to_an_aws/
I have support and opened a case with them. They told me to ...
3
votes
What do transmit errors on Linux IPsec virtual tunnel interfaces indicate?
The transmit errors on VTI interfaces (and other tunneling interfaces) have special meanings. Unfortunately it's poorly documented and I've looked into the source code of kernel to investigate this (...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
ipsec × 1033vpn × 475
strongswan × 235
linux × 111
networking × 105
site-to-site-vpn × 96
openswan × 90
cisco × 84
l2tp × 75
routing × 68
iptables × 63
cisco-asa × 57
ubuntu × 51
pfsense × 51
windows × 49
amazon-web-services × 46
nat × 46
linux-networking × 41
firewall × 36
ikev2 × 35
openvpn × 28
tunnel × 25
xl2tpd × 23
windows-server-2008-r2 × 20
racoon × 20