Questions tagged [strongswan]

strongSwan is an open source, multi-platform IPsec-based VPN solution, with IKEv2 & IKEv1 support

Filter by
Sorted by
Tagged with
1
vote
1answer
63 views

iPhone users does not connect to StrongSwan VPN, while Android and Windows 10 users do?

I have a StrongSwan VPN that for some reason unknown to me cannot connect iOS users to my VPN server. A few quick notes: My StrongSwan server is front for VPN clients who connects to my network. I ...
2
votes
0answers
12 views

ipsec duplicate policies: allow and block

I'm trying to set up u IPsec connection between two virtual machines using Strongswan. The configuration on my first machine is the following (ipsec.conf): conn %default ikelifetime=60m ...
1
vote
0answers
431 views
+500

VPN traffic routing issue between two VPN connections - AWS and Generic IKEv2 / libreswan

Have several sites, one of them acts as intermediary router between two: AWS VPC (10.10.0.0/24) Libreswan VPN Server (10.20.0.0/24) Mikrotik VPN Router (10.30.0.0/24) host1 resides at AWS VPC, host2 ...
0
votes
1answer
18 views

site-to-site VPN route traffic through VPN tunnel

Short version: in a site-to-site VPN setup with Strongswan on both sides, how to route particular traffic via the VPN tunnel? Long version: We have two Linux (ubuntu 20.04) in AWS, both installed with ...
1
vote
0answers
34 views

Masking network behind another using Iptables MARK and NETMAP targets

Aoa, Hello I have faced similar scinario mentioned in following link during vpn tunnel implementation using Strongswan: https://www.strongswan.org/testing/testresults/ikev2/net2net-same-nets/ Here it ...
-1
votes
0answers
16 views

Subnets Behind Gateway Devices not ping each other in VPN tunnel

I have implemented VPN tunnel using strongswan through Pre-Shared Keys link given below: <*https://www.howtoforge.com/tutorial/strongswan-based-ipsec-vpn-using-certificates-and-pre-shared-key-on-...
0
votes
1answer
22 views

Radius authentication does not work in Strongswan, when comming from a Windows VPN client?

My strongswan VPN server is authenticating VPN clients against a local Freeradius server. All user logings is proxied to remote radius server, that validates users against a Samba Active Directory ...
0
votes
0answers
9 views

IKE VPN traffic not using virtual interface

I need traffic across a Strongswan VPN to come from/go to a virtual interface, vti74. I configured Strongswan with mark. conn hmg auto=route esp=aes128-sha1-modp1024 ike=aes256-sha1-modp1024 ...
0
votes
0answers
19 views

Clients not Ping each other through Strongswan VPN Tunnel

AOA, I have two clients one remote and other is local but both on same LAN i.e (192.168.137.0/24), while the UBuntu servers in which strongswan is implemented are connected to each other with ethernet ...
1
vote
1answer
21 views

unable to ping across strongswan site-to-site vpn in aws

We have two Ubuntu-20.04 servers in aws, different VPC, both installed StrongSwan and have configuration as below (ipsec.conf): # basic configuration config setup # Add connections here. conn %default ...
0
votes
0answers
12 views

VPN Tunnel Security Associations always shows 0

During Strongswan Implementation of VPN. The server shows Tunnel connections but not show any security associations. Connections are shown like below: Connections: TUFAAN: 10.10.3.10...10.10.3.11 ...
1
vote
0answers
20 views

VPN Tunnel in Linux Server Through Strongswan

I have subnet (MY Laptop) with IP (192.168.137.19) connected to Laner Device#1 (FW_7525) at port#1 with IP (192.168.137.10) through Ethernet Cable. Port#2 with IP (10.10.3.10) of same device is ...
0
votes
1answer
28 views

site to site routed tunnels using Strongswan VTI. Marking

In the past I've configured few site to site GRE tunnels. But now i'm need to configure VTI type tunnel, because AWS VPC supports only that. Everything is quite clear, according Strongswan ...
1
vote
0answers
51 views

How to config IPSEC XAUTH PSK in StrongSwan without using CA file?

Iam using strongSwan 5.6.2 on Ubuntu18. I can use Strongswan client on Android to connect it , also it works with win7 IKEV2. However I am in China so that it is imposible to access Google Play at ...
0
votes
1answer
94 views

StrongSwan Linux Client refuses to connect to StrongSwan server

I have a StrongSwan VPN server set up on an Ubuntu 18.04 server, and it is working well. I am able to connect to this VPN from Windows 10 and macOS, and everything works wonderfully. The problem is ...
0
votes
0answers
33 views

VTI, Linux and strongswan

Prior to this task I used to think I'm and experienced networking engineer with dozen of years in ipsec and tunneling. Long story short: I've setup a VTI Linux to FreeBSD tunnel, migrating from ipsec-...
0
votes
1answer
34 views

Certificates explanation for VPN Server Edgerouter + IPSec/IKEv2 + Active Directory Certification Authority

I’m trying to setup a IPSec/IKEv2 VPN Server for roadwarriors on my EdgeRouter 6P which has Linux Strongswan 5.6.3 on board, with Active Directory CA as TRUSTED ROOT CA and Microsoft NPS as Radius for ...
1
vote
0answers
24 views

Can't establish a connection to the VPN gateway IP

I have just setup a site-to-site vpn between a Strongswan instance and an AWS VPN Gateway, as the follows: 1.1.1.1 <-----> Strongswan (2.2.2.2) <---> AWS (VPC 172.0.0.0/8) From the AWS, I ...
0
votes
0answers
40 views

IPsec strongswan creates wrong packets on WAN interface

I have set up strongswan for IPsec connection (remote Win10 to my Linux router). IPsec does not have interface by default but I don't want to risk exposing VPN traffic on my WAN interface. So I setup ...
1
vote
1answer
18 views

Strongswan central authentication for already exisint users in database

I have read a lot about authenticating Strongswan to SQL/PAM but can't find any idea/solution how to authenticate against a database where already there are a plenty of username and password ...
2
votes
1answer
93 views

Wrong IP address on VPN with StrongSwan

I have server with Ubuntu 20.04 and installed and working IKEv2 VPN with Strongswan. And i have one php system (installed on the same server with the VPN), that is locked by IP. So i'm using my VPN to ...
0
votes
1answer
160 views

StrongSwan clients fail to connect, Constraint checking failure

Client devices (Runs Windows 10 and Android with StrongSwan app) fail to connect. Certificates signed by one authority, CN is set as server public ip. Here's ipsec.conf: config setup include /var/lib/...
0
votes
2answers
58 views

How can I set up a point-to-point IPv6 GRE tunnel encrypted with ipsec between my Mikrotik CCR2004 router and a Linux host running Strongswan?

I need to encapsulate IPv4 in IPv6 for routing purposes. One end is a Linux box running quagga, and the other end is a Mikrotik CCR2004. How?
0
votes
0answers
38 views

IPSec Cisco VPN on macOS not hide my public IP, is it causes by macos vpn client?

I have 2 vpn, first one is on Cisco and second one is strongswan. In both case I have protocol IPsec. I configured connection to both vpn on my macbook - macOS Big Sur 11.0.1. I use default macOS ...
0
votes
1answer
417 views

Strongswan Error: no config named 'foo'

On Ubuntu 20.04, I am trying to establish a VPN tunnel to a IKEv2/Ipsec VPN site using Strongswan. However, even though I have the file /etc/ipsec.conf as shown # ipsec.conf - strongSwan IPsec ...
1
vote
1answer
287 views

StrongSwan VPN server not Connecting with Clients

Linux Server is Ubuntu 18.04 running in Google cloud. I followed the following excellent tutorial to configure StrongSwan server: https://www.digitalocean.com/community/tutorials/how-to-set-up-an-...
1
vote
1answer
161 views

strongswan ikv2 loading EAP_RADIUS method failed

My environment are windows radius server and active directory, linux strongswan server. My configuration is setup for the ikv2 vpn to accept active directory users vis a windows radius server. I keep ...
0
votes
0answers
48 views

Specify outgoing network interface in ipsec.conf for one IPSec tunnel?

I'd like one of my tunnels to go out a particular interface. Is there a way to specify it? ipsec.conf conn remotehost.example.org keyexchange=ikev2 type=tunnel authby=psk rekey=yes keyingtries=%...
1
vote
0answers
50 views

How to map palo alto firewall params to strongswan's ipsec.conf

I have these configs from a partner of mine How do I match them to ipsec.conf? This is what I have currently. conn %default ikelifetime=28800s keylife=3600s rekeymargin=3m keyingtries=...
0
votes
1answer
99 views

Strongswan roadwarrior scenario with pubkey authentication issues

Ubuntu 20.04 Strongswan 5.9.1 (built from source) swanctl.conf Android Strongswan app I am using a self signed ca and certificates. roadwarr-ikev2-pubkey { version = 2 #proposals = aes192gcm16-...
0
votes
1answer
304 views

received netlink error: Invalid argument when trying to connect using ipv6

I'm trying to connect an initiator to a responder using ipv6 Both are on Ubuntu 20.04 and strongswan 5.9.0 Initiator is on a virtual machine (using VMware) on a personal computer behind a box ...
1
vote
0answers
190 views

Can't route Strongswan VPN Traffic through AWS Internet Gateway

Cheers, I want to setup a VPN Server on an EC2 Instance in order to route all my private internet traffic, but I can't get it to work. Any help would be appreciated. I have the following Setup: ...
0
votes
1answer
268 views

Strongswan works on embedded device via ethernet but not with 4G modem

I have a Gateworks SBC with an installed Ubuntu 20.04. My SOC is connected with an USB to ethernet adapter (eth0) as DHCP Client (192.168.88.102) to my Mikrotik router (DHCP Server), which acts as my ...
1
vote
0answers
2k views

no IKE config found for X.X.X.X…Y.Y.Y.Y, sending NO_PROPOSAL_CHOSEN

I want to establish an ipsec tunnel between a Centos machine and my pfsense firewall. Attached, is the result of the strongswan status: Active: active (running) since Tue 2020-12-08 17:56:54 CET; 2min ...
0
votes
0answers
97 views

Is it possible to have 2 left ids in strongswan?

I need my strongswan server to operate on 2 domain names . ipsec.conf currently contains : leftid=@sub.domain.com How can I add another domain ? Is this syntax gonna work? leftid=@sub.domain.com,@sub2....
1
vote
0answers
578 views

strongswan vpn with windows 10 client - does not connect

I am trying to run an strongswan VPN server to use with windows-10 clients using their builtin VPN feature (to make it easy for the client users) Whenever trying to connect, windows shows that the ...
1
vote
1answer
94 views

Route traffic between two IPsec tunnels

I run a backend on DO infrastructure, call it site Yvi, that connects to a third party site Prov via an IPsec tunnel, with this libreswan config: conn prov-client ... right=$YVI_IP rightsourceip=...
0
votes
1answer
551 views

Strongswan swanctl profile for native Android IKEv2 IPsec

Android 11 seems to support IKEv2/IPsec now, so I'm attempting to build a roadwarrior swanctl profile for it. So far I'm getting as far as having an SA established, but then immediately deleted. Any ...
0
votes
0answers
48 views

Running Tor On Centos 7

hello I want to run TOR on Centos7. Tor is installed Successfully and then i start tor using this command systemctl start tor after this command i check the status of tor using systemctl status ...
0
votes
1answer
66 views

Does ikev1 or ikev2 support a no-authentication option? If so, how can I enable that in strongswan?

For testing purposes, I want to setup an ipsec tunnel using IKEv1 or v2 (preferably v2) that does not require any authentication - so just using the protocol to agree on the secret-keys of the ipsec ...
0
votes
0answers
29 views

How to increase troughput of strongSwan client?

I self-host my own strongSwan VPN server. When running Borg backups to a remove filesystem (running on a different server), I am able to upload at ~ 2.5MB/s without the VPN and ~ 1.5MB/s over the VPN. ...
0
votes
0answers
304 views

How to connect Strongswan to palo alto firewall

I'm trying to create a tunnel between StrongSwan and palo alto. StrongSwan is running on a digital ocean droplet, Ubuntu. In my ipsec.conf, I have: conn %default ikelifetime=28800s keyexchange=...
0
votes
0answers
32 views

Strongswan - Is it possible to “include” other ipsec.conf files that have their own “conn %default” settings

I'm looking for some help or suggestions with strongswan I work with an obscene amount of VPNs with different types and configurations, ikev1( I know, I know, above my paygrade and not my decision),...
1
vote
1answer
205 views

Site-To-Site IPSec between StrongSwan and Zyxel NSG200

I'm trying to initiate an IPSec connection (Site-to-Site) between a Debian 10 server with StrongSwan and a Nebula NSG200. Let's assume: Debian server: Public IP : 50.50.50.45 Private Network: 10.1.0....
0
votes
1answer
2k views

establishing IKE_SA failed, peer not responding

I'm new with this VPN things. I'm using Strongswan 5.8.2 with swan config for establish my SA and using PSK. Im integrating with a company to provide me some services and they gave me a gateway server ...
1
vote
1answer
197 views

Configure linux to route traffic from internal network through ipsec tunnel (policy based)

My company hosts cloud services. We have a partner that also hosts cloud services. We want to connect our network with theirs using ipsec / strongswan. Our clients should be able to reach the target ...
0
votes
1answer
153 views

Client traffic is not routed throught VPN

I try to create a simple Strongswan connection between a server and an Android phone, using Strongswan Android application. My Android phone informations : Android 8.0.0 with Samsung Experience 9.0 It'...
0
votes
1answer
25 views

How to bind strongSwan to specific IP on VPS with multiple IPs?

I would like client traffic to show publicly as originating from that specific IP (which could be a secondary IP assigned to the same network interface as primary). iface eth0 inet static address ...
0
votes
1answer
127 views

Builder: failed to build TUN device

I try to create a simple Strongswan connection between a server and an Android phone, using Strongswan Android application. My Android phone informations : Android 8.0.0 with Samsung Experience 9.0 It'...
0
votes
1answer
65 views

Strongswan 5.7.x not sending intermediate certificate

I am attempting to use a letsencrypt certificate on my strong swan server; but I also see this behaviour with my own internal CA. When trying to connect from a windows 10 host to a strong swan ...

1
2 3 4 5
8