Questions tagged [ipsec]
IPsec (Internet Protocol Security) is a protocol for securing IP communications by authenticating and encrypting each IP packet of a communication session.
1,020
questions
0
votes
0
answers
13
views
Incoming IPSec traffic on Linux host is not processed via the VTI tunnel using XFRM rules
I have the following setup:
Remote IPSec VPN gateway: 81.x.x.x
Local machine address: 172.22.1.156
VPN-assigned IP: 10.0.30.97
VTI tunnel interface:
vti0: ip/ip remote 81.x.x.x local 172.22.1.156 ttl ...
- 101
0
votes
0
answers
16
views
Windows 11 IKEv2 fails to connect, error code 1931 eventID 20227
I have Mikrotik configured for accepting IPSec connections with server certificate and RADIUS auth, SHA1 and so on enabled on Mikrotik side for Windows compatibility.
It also configured for L2TP/IPSec,...
- 117
0
votes
1
answer
15
views
Howto get server host into strongswans virtual IP address subnet
I have configured a VPN server and VPN client with strongswan with the following ipsec.conf configuration settings
Server ipsec.conf
conn ikev2-vpn
also=rw-base
auto=add
compress=no
...
- 101
0
votes
1
answer
14
views
strongwan disable user access
Hwo can I disable access for a particular user with strongswan public key authentication?
So I have pub key authentication working. the SAN is the email and is the id. Is there a way to reject ...
- 111
0
votes
0
answers
13
views
ipsec package after decrypted can not be recieved by tproxy
My centos6 machine ipaddress is 192.168.56.10 (eth0). I have installed strongswan and a tproxy like v2ray with iptables:
iptables:
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [...
- 1
1
vote
0
answers
32
views
strongswan site to host example?
There are a million site-to-site and host-to-host examples. I can't seem to find a single site-to-host example. I am looking for the most basic possible example with no certificates at all, that just ...
- 111
0
votes
0
answers
22
views
Libreswan to Juniper. The tunnel is not going up
authentication-method pre-shared-keys
dh-group group14
authentication-algorithm sha1
encryption-algorithm aes-256-cbc
lifetime-seconds 28800
protocol esp
authentication-algorithm hmac-sha1-96
...
-1
votes
0
answers
28
views
Ipsec clear text password
Apologies in advance as my knowledge is limited in IPsec VPN tunnel with StrongSwan.
I am running VPN client from my OpenSuse 15.4 server to connect to a client.
ipsec.conf
My Shared key in ipsec....
- 1
1
vote
1
answer
63
views
My Win 11 Pro VPN client for IKEv2 is perpetually broken
I am tearing my hair out over this sudden refusal of Windows 11 Pro on my PC to use the appropriately configured crypto in IKEv2 negotiation. It worked fine for a long time, until it didn't. This ...
- 11
0
votes
0
answers
35
views
Routing decision after IPSec processing
I have a Linux box running in AWS EC2 with just one interface - eht0.
This interface connected to private subnet 172.16.0.0 and has an IP 10.95.114.69 on it.
All hosts from subnet are reachable from ...
0
votes
0
answers
33
views
IPsec access from multiple local Networks over a single IP Address
I have to connect our company network with the network of a customer to access some of their resources. The IT department of the customer defined a IPsec VPN in tunnel mode with two phase 2 ...
- 101
1
vote
1
answer
191
views
Not getting StrongSwan IPsec to run: received netlink error: Network is unreachable / unable to install source route for [...]. Getting nuts already
I am trying to set up an ipsec tunnel with strongswan, used some tutorials for that and all went so far but there is no actually communication going trough the tunnel. The tunnel is established, but ...
- 111
0
votes
0
answers
26
views
Is it possible to get a cloud server connected via IPsec tunnel to one gateway, that then passes it to another via LAN?
Odd situation but I'm trying to get something that works with certain products. Here are the components in this scenario:
Virtual Machine in cloud, connected to a SonicWall gateway ("Cloud ...
- 103
0
votes
1
answer
281
views
Windows 11 L2TP and IPSEC: Where to set the IpSec group
First of all:
I know : L2TP and IPSEC from Windows XP: Where do I put the IPSEC group name? exists, but the answer is incorrect and is not working on Windows 11 (please do not duplicate this topic by ...
0
votes
0
answers
112
views
Open VSwitch - Connect two virtual networks through two physical networks
I managed to setup the following network configuration :
HOST1 and HOST2 are two physical machines running Debian OS.
They have both two network cards (eth0 and eth1), each of them connected to two ...
- 111
0
votes
0
answers
45
views
Cannot establish connection on two-way comms like SSH on Phase 2 VIP attached to LAN IP using NAT 1:1
As the title say, I cannot establish connection on two-way comms like SSH on Phase 2 VIP attached to LAN IP using NAT 1:1.
Phase 1 and Phase 2 is UP.
Phase 2 Remote IP is 192.168.1.248 and Local IP is ...
- 204
1
vote
0
answers
211
views
Strongswan (IKEv2) connection established but unable access systems being the VPN server
My ipsec configuration
/etc/ipsec.conf
# ipsec.conf - strongSwan IPsec configuration file
conn myvpn
auto=add
keyexchange=ikev1
authby=secret
type=transport
left=%defaultroute
...
- 11
0
votes
0
answers
53
views
Cannot establish an IPsec site-to-site VPN between an EC2 instance and a SonicWALL firewall
I'm trying to establish a site-to-site IPsec VPN between an EC2 instance running StrongSwan and a SonicWALL firewall. I've tried a lot of different configurations, but currently I have this at the EC2 ...
0
votes
0
answers
21
views
IPsec Tunnel to Vendor with Azure AD
On Prem AD connected to Azure AD connect. A vendor we are using requires an IPsec tunnel to a DC on their side to then create a trust to our on Prem AD. Problem is, their router is not compatible with ...
1
vote
0
answers
38
views
Multiple S2S Connections for Azure
I’m confused by all of this and need help. I setup an Azure S2S tunnel from Azure to my On Prem DC. This is for AD and AAD to sync. We have a new billing system coming in and the only way they’ll ...
0
votes
1
answer
107
views
strongSwan VPN tunnel (IKEv2) established but traffic times out
I have a VPN server that tunnels traffic to a PostgreSQL database server which is otherwise unreachable from the internet. The VPN is only reachable by IPv4.
Problem
All clients can establish a VPN ...
- 121
0
votes
0
answers
175
views
LibreSwan IKEv2 multiple left subnet for vpn splitting
I have built an IKEv2 VPN server.
The current config in /etc/ipsec.d/ikev2.conf is like this:
conn ikev2-cp
left=%defaultroute
leftcert=58.xx.xx.xxx
leftsendcert=always
leftsubnet=192.168.1....
0
votes
0
answers
150
views
Static Route on IPSEC tunnel
I have a IPSEC tunnel configured as follows.
Site A (Sophos XG) 192.168.40.0/22 to Site B (pfsense) 10.1.1.0/22
At site B i have a Zabbix instance installed at 10.3.1.2 on a separate VLAN. I want this ...
- 165
0
votes
0
answers
80
views
How can I connect an Openshift cluster, via IPsec VPN, to an on premise network?
Good morning everyone,
the goal I'm trying to achieve is to connect an Openshift cluster, via IPsec VPN with preshared key, to an on premise network (the img attached is a simplification of the ...
- 1
0
votes
0
answers
336
views
IPSec VPN between StrongSwan and DrayTek Router fails on second rekeying
I want to establish an always-on IPSec VPN between a DrayTek Vigor2860 and an EdgeRouter X (which uses StrongSwan). The Draytek is behind a NAT and dials into the ER-X. The VPN connects and works, but ...
- 433
0
votes
0
answers
86
views
Site to site IKEv2 VPN between two Windows Server 2012 R2 machines only working in one direction
We are trying to set up a Site-to-Site VPN with IKE v2 using Windows Server 2012 R2 machines as the tunnel endpoints on each end. We are able to PING and get replies in one direction, but we are not ...
- 1
0
votes
1
answer
212
views
Use a virtual Network in PFsense to redirect packages to device in another network
I'm using PFsense and i have this situation:
Network Example
I have a Pfsens already connected with "Site1" through OpenVPN. I can acess the "Device" normally in Pfsense network.
...
0
votes
1
answer
342
views
No config named ... error when running ipsec up <conn name>
I am getting the 'no config named ...' error like others have posted. I have auto=add in my etc/ipsec.conf file as I read in one post. I have followed everything which I have read online to no avail. ...
- 1
0
votes
0
answers
77
views
How to silence ipsec server?
I'm new at ipsec. Using libreswan 3.25-9.1.el7_8 on CentOS7.
I'm able to get a connection working, and follow the documentation, but cannot find how to silence the pluto process so it doesn't respond ...
0
votes
1
answer
102
views
VyOS on AWS EC2, new IPSEC tunnel won't pass traffic- what am I missing
This is an existing environment that I just stepped into. Running VyOS as a AWS EC2 instance, which handles all of the site-to-site routing for our company. Everything is already up and working. We ...
- 212
0
votes
0
answers
143
views
ike-scan 0 returned handshake 0 returned notify
I need to establish vpn connection to a specific site, I used strongswan and configure my side according to the provided parameters from another side, but when I try to connect I get 'peer not ...
0
votes
0
answers
187
views
How to configure a site-to-site vpn through strongswan
I want to configure a site-to-site vpn using strongswan, my partner gaves me a domain encryption ip (kindly tell me what is this), and the parameters for ike and esp. They told me after finish configs ...
0
votes
0
answers
133
views
L2TP VPN disconnects after requests to NAS in VPN network
I installed a L2TP IPsec VPN over a Unifi USG for a client of mine.
Everything works like a charm, expect one user, that tries to connect with a MacStudio. He permanently gets disconnected after he ...
0
votes
0
answers
31
views
Strongswan remote_ts as 0.0.0.0/0, now I can't access my vps
I have a vps, and I tried to install a site-to-site vpn using stronswan and swanctl, I accidentally put remote_ts to 0.0.0.0/0 and now I can't access my vps through ssh.
How can I regain access ?
0
votes
1
answer
148
views
Forward virbr0 (VM) traffic through IPSec tunnel
I have a virbr0 interface, created by libvirt with
inet 10.1.2.1 netmask 255.255.255.0 broadcast 10.1.2.255
There's an active IPSec tunnel with
leftsubnet=10.1.2.0/24
rightsubnet=192.168.160.0/20
...
- 137
0
votes
0
answers
44
views
DO to Azure, site to site VPN, can my client private IP send the traffic?
Using Strongswan IPSEC
eth0 IP is xx.xx.129.177 (which is our public IP and the one currently sending requests)
the gate way to eth0 is xx.xx.128.1
eth0:1 IP is 10.16.0.24/16 - Client expects this ...
0
votes
0
answers
79
views
Can't communicate on remote ip using local vip through IPSEC (IPSEC is up + Test port works)
good afternoon.
I have the following problem in pfSense:
The Service for package Zabbix Proxy not want to go up.
The scenario is as follows:
pfSense has a IPSEC VPN with Zabbix Server
Zabbix IP is ...
- 204
0
votes
0
answers
354
views
Windows Server 2019 RRAS: L2TP/IPSEC Certificate Configuration
This is my first post on any SE related site. You guys have been such a valuable component of my search results that for 20+ years I've always found answers and never had to post, a testament to the ...
- 1
0
votes
0
answers
432
views
No Route To Host With StrongSwan Tunnel Interface
I'm using Ubuntu 20.04 with Strongswan 5.8.2. Configured using the Route-Based VPN instructions.
The site-to-site tunnel establishes and is stable, however, I can't route traffic over it. When I try ...
- 101
1
vote
1
answer
911
views
Is it possible to make a L2TP/IPsec VPN connection from within a linux-based Docker for Windows (WSL) container?
I use Windows.
My main goal is to be able to open corporate websites which are only available via corporate VPN such as GitLab. Since Windows wouldn't allow me to specify which websites I would like ...
- 63
0
votes
0
answers
88
views
Double Proxy: IPSec to Server1 then SSH to Server2
What I'm trying to achieve:
(Clients)<IPSec Xauth PSK>(Server 1)<SSH-based SOCKS5>(Server 2) --> Free Internet
How is that possible for both UDP and TCP traffics?
What I've done:
I ran ...
- 48
0
votes
0
answers
213
views
Strongswan IPSec tunnel between linux and windows : "NO_PROPOSAL_CHOSEN"
I'm trying to set up a VPN tunnel between a win10 host and a ubuntu host. Below the configuration I have:
/etc/ipsec.conf
config setup
charondebug=1
uniqueids=yes
...
1
vote
0
answers
143
views
Azure site to site proposals with Strongswan IPSec
Noob here trying to finish a project, I think I have it bar these damn proposals, this is for an Linux Ubuntu VPC Machine to Azure Cloud network interface, only thing I can't suss out is how to config ...
1
vote
0
answers
169
views
Configure VPN via .PBK file
There is some software which can only configure VPN/L2TP-IPSec connection using pbk file (GUI has very limited number of the options).
I'm looking for pbk documentation but unsuccessul. I see a few ...
- 111
0
votes
0
answers
22
views
L2TP and IPSEC from Windows 11: Where do I put the IPSEC group name? [duplicate]
EDIT: This question is not related to "L2TP and IPSEC from Windows XP: Where do I put the IPSEC group name?". This question has the similar prerequisites and the same goal, but for a ...
- 101
1
vote
1
answer
273
views
ip xfrm policy template missmatch error (XfrmInTmplMismatch)
I am working in a very simple case for ipsec and I keep getting XfrmInTmplMismatch error in reception (after decapsulating the ESP packet) when checking cat /proc/net/xfrm_stat. nft monitor all shows ...
0
votes
0
answers
161
views
VPN Connection (Fritzbox) works for Android Client but not for Windows and Ubuntu
I use a Fritzbox 7530 Router in my home network as a VPN server. The VPN is configured as "IPSec Xauth PSK" with following settings: server name, IPSecID, IPSec shared key, user name and ...
- 101
1
vote
1
answer
635
views
When using `xfrm` and strongswan for an ipsec tunnel, where are the routes stored?
I am using strongswan to establish an ipsec connection in tunnel mode. When the client connects to the gateway, strongswan receives a new ipv6 address assigned to the client from the server. All ...
- 15
0
votes
0
answers
22
views
EC2 instance Ipsec VPN with overlapping cidrs
I'm setting a site to site connection between an instance on my AWS cloud account and a customer.
Unfortunately customer's subnet is a 10.0.0.0/8 and my vpc is on 10.0.0.0/16.
Looking on internet i'...
- 101
0
votes
1
answer
85
views
XFRM IPsec over Geneve
I need to run IPsec over a Geneve tunnel (or GRETAP). I can get the IPsec tunnel to work using public IPs as endpoints (so it's just IPsec) but not using private IPs on the Geneve link (so it's IPsec/...
- 207