New answers tagged

0

Finally fixed this issue. Here's what I did: In the ipsec.conf file, I had to comment out the leftprotoport which was set to leftprotoport=17/1701 This essentially limits the vpn connection to L2TP using UDP port 1701. Checking ip xfrm policy shows that the source and dest ports were set to 1701. This means I could not send any traffic via TCP. The ...


0

You need to set up a MASQUERADE rule for the traffic going from the OpenVPN interface to the internet. Also, have you enabled ip_forward? iptables -t nat -A PREROUTING -i tun0 -j MARK --set 0x029a iptables -A FORWARD -i tun0 -m mark --mark 0x29a -j ACCEPT iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 0x29a -j MASQUERADE Basically, your current ...


0

Using such configuration only traffic addressed to B is secured. When I try to send something from A to C - it is on the whole path insecured. That's exactly how it should be. You established a Transport Mode IPsec SA between A and B, which means there are IPsec policies that only apply for traffic between these two hosts. If you want to secure traffic ...


0

As far as I have found, there is no built-in reset option. What I ended up doing was exporting the default policies from a newly created Active Directory to a file, then importing them into my existing Active Directory.


4

Assuming you're talking about the Default Domain Policy or the Default Domain Controllers Policy You can either compare them to a non-modified GPO in another domain or you can run DCGPOFIX. http://www.grouppolicy.biz/2011/12/how-to-reset-the-default-domain-group-policy-objects-dcgpofix EDIT I don't understand what you're saying with your comment. Look at ...


2

Nope, no downside other than non windows systems may have network latency while trying to negotiate. You will see slightly higher cpu utilization. It's been a suggestion for ages to use IPsec in require mode, but hardly anyone does it usually because they have non windows systems that make enabling IPsec the equivalent of drinking a cup of hot tea, while ...


0

Found the solution. Created Outbound NAT rule on the LAN interface. Source is tunnel network, destination is LAN network. Source IP is always firewall IP, but that's something I can live with.


0

It turns out aws does't allow a tunnel to set up when the subnet we want to route to doesn't match defined subnets on the aws vpc. Because we only have a /24 subnet defined at aws, we couldn't send a /16 over there. only once we decreased the routing mask to /24 would the ipsec vpn connect properly. We were expecting amazon to allow this and just drop all ...



Top 50 recent answers are included