Questions tagged [ipsec]
IPsec (Internet Protocol Security) is a protocol for securing IP communications by authenticating and encrypting each IP packet of a communication session.
1,034
questions
1
vote
1
answer
215
views
IPsec site-to-site VPN issues after recent Linux kernel update
Last weekend we had an automatic security upgrade on one of our VPN gateways that connect sites to our cloud environment. After performing troubleshooting (via basic network troubleshooting e.g. via ...
- 11
1
vote
0
answers
556
views
Libreswan and Mac OS X Big Sur client issues
I'm resorting to asking for help after a brutal amount of time troubleshooting connection problems between client and server.
Troubles
Mac OS X Catalina, and Linux clients work fine connecting to the ...
- 326
0
votes
1
answer
761
views
Packets from xfrm interface won't route, but opposite works
I'm working on a site-to-site vpn, where one end us a UDM and the other is Strongswan. The goal is to provide bi-directional routing into a cloud environment. I'm completely baffled why this isn't ...
0
votes
0
answers
467
views
IPsec port forwarding Teltonika RUT955
I am using two Teltonika RUT955 routers with IPsec (Strongswan) built in. For testing I have a cable running from WAN to WAN with static IPs in both routers at 172.16.1.1 and 172.16.1.2. I have the ...
- 1
0
votes
1
answer
514
views
Mirror incoming traffic on specific port to another IP, using my IPSec strongswan tunnel
I want to internally publish an SMTP server (IP 10.0.0.10) that is behind a VPN tunnel on my internal server (192.168.0.12) using strongswan. My strongswan is running within a docker container.
For ...
- 183
1
vote
1
answer
577
views
Trying to forward SMTP port on strongswan IPsec tunneled docker container?
I have successfully setup a vpn tunnel with strongswan within a docker container and want to use that tunneled connection to forward specific ports like SMTP to a host on the other side of the tunnel, ...
- 183
0
votes
1
answer
1k
views
IPsec/L2TP connection fails when two clients have the same local LAN address
We are having occasional trouble with an IPsec/L2TP remote access VPN, provided by strongSwan (charon).
Today a user was unable to connect. I viewed the charon log, and noticed that another existing ...
- 141
1
vote
0
answers
2k
views
StrongSwan swanctl/xfrm: How to masquerade tunneled traffic?
Ubuntu 20.04LTS
strongSwan swanctl 5.8.2
Linux 5.8.0-1035-gcp
I'm trying to setup an IKEv2 "roadwarrior" VPN that defers radius authentication to our upstream server. The good news is, I ...
0
votes
1
answer
1k
views
ipsec xfrm esp routing
i need a little help/explanation why the following netsetup is not working:
PC1 (192.168.66.1) <-- PLAIN --> (192.168.66.2)PC-GW(192.168.88.2) <-- ESP --> (192.168.88.1) PC2
I can send ...
- 3
1
vote
0
answers
4k
views
Why do we lose IPSec connections and can't re-establish them?
We have tens of IPSec connections between our office and customer sites. At the office we use pfSense V2.4.5 as VPN gateway and placing Ubiquiti Edgerouter X devices with the latest firmware on the ...
- 325
2
votes
0
answers
253
views
ipsec duplicate policies: allow and block
I'm trying to set up u IPsec connection between two virtual machines using Strongswan. The configuration on my first machine is the following (ipsec.conf):
conn %default
ikelifetime=60m
...
- 31
0
votes
0
answers
229
views
Masking network behind another using Iptables MARK and NETMAP targets
Aoa,
Hello I have faced similar scinario mentioned in following link during vpn tunnel implementation using Strongswan:
https://www.strongswan.org/testing/testresults/ikev2/net2net-same-nets/
Here it ...
0
votes
1
answer
1k
views
Routing part of OpenVPN traffic into an IPSec tunnel on the server
I am trying to configure OpenVPN Access Server to route certain traffic through an IPSec tunnel established on the OpenVPN server. These are the addressing details:
OpenVPN client IP range: 10.0.1.0/...
- 219
1
vote
1
answer
3k
views
Is there a way to reload new IPSEC certificates without restarting the service and interrupt existing tunnels?
I'm searching for a way to reload new IPSEC certificates without restarting the service and interrupt existing tunnel connections.
As part of the activity, I'm replacing certificates (including ...
- 11
1
vote
0
answers
413
views
How to switch from the default kernel module netkey to klips for Libreswan (IPsec)?
Seek your guidance on setting up Libreswan with klips other than netkey. Let us start from the beginning.
I installed Libreswan v4.4 and it pops up with this: Linux Libreswan 4.4 (netkey) on 5.4.0-...
- 111
0
votes
1
answer
2k
views
StrongSwan Linux Client refuses to connect to StrongSwan server
I have a StrongSwan VPN server set up on an Ubuntu 18.04 server, and it is working well. I am able to connect to this VPN from Windows 10 and macOS, and everything works wonderfully. The problem is ...
- 168
2
votes
1
answer
2k
views
libreswan configure virtual interface for ipsec traffic
Description:
I am learning how to configure ipsec with libreswan.
I want to set up a host-to-host vpn between two hosts. I want each host to use a virtual interface for their ipsec tunnel.
Problem:
I ...
- 336
1
vote
1
answer
348
views
Danger of leaked PSK (password) in IPsec tunnel
Let us say I have a IPSEC tunnel between a Pfsense firewall and a Cisco firewall. In the Pfsense panel, when configuring a Site-to-site VPN between them, there is a PSK which is common in both ends, ...
- 11
0
votes
1
answer
469
views
How do I setup ipsec VPN between APIs on different servers?
There are 2 sets of API each hosted in 2 different organisations: my client's organisation and her partner's organisation. The servers from the 2 organisations communicate between each other through ...
- 321
0
votes
1
answer
254
views
Is it possible to have L2TP/IPsec VPN auto disconnect after x hours?
I couldn't find anything on Google, everything that I found was related to the opposite problem, VPN disconnecting when people don't want it to.
A little backstory: one of our potential clients needs ...
- 111
0
votes
0
answers
230
views
IPsec strongswan creates wrong packets on WAN interface
I have set up strongswan for IPsec connection (remote Win10 to my Linux router). IPsec does not have interface by default but I don't want to risk exposing VPN traffic on my WAN interface. So I setup ...
- 173
1
vote
1
answer
65
views
Strongswan central authentication for already exisint users in database
I have read a lot about authenticating Strongswan to SQL/PAM but can't find any idea/solution how to authenticate against a database where already there are a plenty of username and password ...
- 13
2
votes
1
answer
2k
views
Wrong IP address on VPN with StrongSwan
I have server with Ubuntu 20.04 and installed and working IKEv2 VPN with Strongswan.
And i have one php system (installed on the same server with the VPN), that is locked by IP.
So i'm using my VPN to ...
- 21
1
vote
1
answer
1k
views
How to encode Pre-Shared Key (PSK) of and L2TP IPSEC connection managed by Network-Manager
If I create a VPN L2TP IPSEC connection using Network-Manager GUI, I introduce the PSK, but this one looks different on /etc/NetworkManager/system-connection/myvpn.nmconnection
I am thinking the PSK ...
- 33
2
votes
0
answers
943
views
Ubuntu Server 20.04 network-manager not starting VPN automatically
I am getting desperate here. I need to connect a Ubuntu Server Machine on a VPS to a network to monitor several machines. I can only connect to the network with L2TP over IPsec.
I have tried ...
- 33
2
votes
1
answer
7k
views
Strongswan Error: no config named 'foo'
On Ubuntu 20.04, I am trying to establish a VPN tunnel to a IKEv2/Ipsec VPN site using Strongswan.
However, even though I have the file /etc/ipsec.conf as shown
# ipsec.conf - strongSwan IPsec ...
- 1,479
2
votes
1
answer
7k
views
StrongSwan VPN server not Connecting with Clients
Linux Server is Ubuntu 18.04 running in Google cloud. I followed the following excellent tutorial to configure StrongSwan server:
https://www.digitalocean.com/community/tutorials/how-to-set-up-an-...
- 168
1
vote
0
answers
991
views
Specify outgoing network interface in ipsec.conf for one IPSec tunnel?
I'd like one of my tunnels to go out a particular interface. Is there a way to specify it?
ipsec.conf
conn remotehost.example.org
keyexchange=ikev2
type=tunnel
authby=psk
rekey=yes
keyingtries=%...
- 2,232
0
votes
1
answer
182
views
VPN / NAT - Public Encrypted Domain Setup / issues
I currently have an issue at hand, i am not too experienced in the routing part of unix and would be great to have a helping hand.
I currently am using Hetzner for cloud instances.
I currently need to ...
- 1
1
vote
0
answers
326
views
How to map palo alto firewall params to strongswan's ipsec.conf
I have these configs from a partner of mine
How do I match them to ipsec.conf? This is what I have currently.
conn %default
ikelifetime=28800s
keylife=3600s
rekeymargin=3m
keyingtries=...
- 121
1
vote
0
answers
933
views
Can't route Strongswan VPN Traffic through AWS Internet Gateway
Cheers, I want to setup a VPN Server on an EC2 Instance in order to route all my private internet traffic, but I can't get it to work. Any help would be appreciated.
I have the following Setup:
...
- 11
0
votes
1
answer
628
views
Strongswan works on embedded device via ethernet but not with 4G modem
I have a Gateworks SBC with an installed Ubuntu 20.04.
My SOC is connected with an USB to ethernet adapter (eth0) as DHCP Client (192.168.88.102) to my Mikrotik router (DHCP Server), which acts as my ...
- 1
1
vote
1
answer
1k
views
Route traffic between two IPsec tunnels
I run a backend on DO infrastructure, call it site Yvi, that connects to a third party site Prov via an IPsec tunnel, with this libreswan config:
conn prov-client
...
right=$YVI_IP
rightsourceip=...
- 111
0
votes
1
answer
3k
views
Strongswan swanctl profile for native Android IKEv2 IPsec
Android 11 seems to support IKEv2/IPsec now, so I'm attempting to build a roadwarrior swanctl profile for it. So far I'm getting as far as having an SA established, but then immediately deleted. Any ...
- 245
0
votes
1
answer
374
views
Does ikev1 or ikev2 support a no-authentication option? If so, how can I enable that in strongswan?
For testing purposes, I want to setup an ipsec tunnel using IKEv1 or v2 (preferably v2) that does not require any authentication - so just using the protocol to agree on the secret-keys of the ipsec ...
- 25
0
votes
0
answers
738
views
Cipher names (ipsec)
I've got this in my syslog
470 Nov 22 11:32:23 mini31 ipsec[8820]: 13[IKE] 192.168.1.7 is initiating a Main Mode IKE_SA
471 Nov 22 11:32:23 mini31 ipsec[8820]: 13[CFG] received proposals: IKE:...
3
votes
1
answer
2k
views
Cant connect to VPN via L2TP/IPsec on mac, but connection on windows works
I've setup connection on one of our mac computers running MacOS 10.13.6 High Sierra. I've entered user, password, preshared key ect. but I Cant connect to VPN (getting VPN server did not respond error)...
- 31
1
vote
0
answers
319
views
SNAT iptables does not work when package is encapsulated in esp transport mode
I have the following setup, involving one host and a docker container.
On the host, I am setting up an ipsec tunnel connection to a remote gateway.
In the docker container running on the host, I ...
1
vote
0
answers
2k
views
How to connect Strongswan to palo alto firewall
I'm trying to create a tunnel between StrongSwan and palo alto. StrongSwan is running on a digital ocean droplet, Ubuntu. In my ipsec.conf, I have:
conn %default
ikelifetime=28800s
keyexchange=...
- 121
1
vote
0
answers
120
views
Strongswan - Is it possible to “include” other ipsec.conf files that have their own “conn %default” settings
I'm looking for some help or suggestions with strongswan
I work with an obscene amount of VPNs with different types and configurations, ikev1( I know, I know, above my paygrade and not my decision),...
- 11
1
vote
2
answers
2k
views
Site-To-Site IPSec between StrongSwan and Zyxel NSG200
I'm trying to initiate an IPSec connection (Site-to-Site) between a Debian 10 server with StrongSwan and a Nebula NSG200.
Let's assume:
Debian server:
Public IP : 50.50.50.45
Private Network: 10.1.0....
3
votes
1
answer
2k
views
Configure linux to route traffic from internal network through ipsec tunnel (policy based)
My company hosts cloud services. We have a partner that also hosts cloud services. We want to connect our network with theirs using ipsec / strongswan. Our clients should be able to reach the target ...
- 181
0
votes
0
answers
268
views
IPSec Phase 2 Configuration For Translated Subnets?
I have two networks with the 10.0.0.0/8 subnet I'm trying to connect via IPSec tunnels. I have the phase 1 configurations working but am a bit stuck on the phase 2 configurations. Each firewall used ...
- 101
1
vote
0
answers
125
views
Is it possible to send traffic through the VPN tunnel to the VPN gateway itself?
I have a WAN interface X and a web server Y behind NAT, that is traffic to X:443 is being forwarded to Y:443. Web server is accessible from the internet without any problems.
Then I have a site-to-...
- 111
0
votes
0
answers
256
views
StrongSwan site to site no HTTPS traffic but HTTP works
I'm trying to connect to CISCO ASA from StrongSwan from a digital ocean droplet. Below are the configs I have: ipsec.conf
conn %default
ikelifetime=86400s
keylife=60m
rekeymargin=3m
...
- 121
1
vote
0
answers
395
views
GlobalProtect VPN over VPN on MacOS
I am using GlobalProtect VPN client to access my company's network. I also have a personal IPSec VPN server. I would like to access to my company's network after my personal VPN, I mean I want to ...
- 11
0
votes
0
answers
161
views
How to connect 2 IPSec sites with each other via the "main site"
First of all, i'm originally a software engineer with some network knowledge so no network specialist. At my current job i'm also responsable for the network. I say this because it may be a bit stupid ...
- 325
1
vote
1
answer
5k
views
Check if Remote Server Port is Blocking my IKEv2/IPSec VPN Connections
I am using StrongSwan on Ubuntu to try to establish a site-to-site VPN connection to a remote IKEv2 IPSec VPN server, but it appears that my connection requests are not reaching the remote server.
Is ...
- 233
1
vote
1
answer
74
views
Attacker using "single use IPs" to generate large volumes of robotic traffic that is hard to block
Currently there is some wierd traffic on a HTTP server from lots of different IPs. I tried checking against known TOR exit nodes, but there were no matches.
They tend to be from countries in South ...
- 529
0
votes
1
answer
373
views
What is an authentication method for L2TP or IKEv2 VPN that sends the username and password?
Google's GSuite Secure LDAP does not expose userPassword.
CHAP, MSCHAP and other authentication do not send the password. They assume the server knows the password and can use a challenge.
Because ...
- 93