Questions tagged [strongswan]

strongSwan is an open source, multi-platform IPsec-based VPN solution, with IKEv2 & IKEv1 support

Filter by
Sorted by
Tagged with
0 votes
0 answers
21 views

StrongSwan: Multipurpose server

I am trying to write configuration for a multipurpose server that should accept connections from every client that tries to connect to it. It should be maximum friendly to all implementations of VPN ...
user avatar
0 votes
0 answers
29 views

Issues configuring strongSwan client on AWS instance for site-to-site VPN

I am trying to setup a IPSec VPN client on a debian-10 AWS instance. Unfortunately, I do not have access to the VPN server as it is configured by another party, so all I know is they told me it is ...
user avatar
  • 101
0 votes
1 answer
37 views

Why does StrongSwan charon-cmd client require the --cert command-line option for multiple CA chain certificates?

I have a StrongSwan charon server on Ubuntu 18.04. I connect to this server with a StrongSwan charon-cmd client from another Ubuntu Linux machine. The command I use from the client machine to connect ...
user avatar
0 votes
0 answers
60 views

Failure connecting Mikrotik to Strongswan using IPSec

hope you are doing well. I am trying to connect a Mikrotik RB2011RM to Strongswan running on a cloud server. I cannot get past Phase 1. I have searched through google and found some great examples ...
user avatar
0 votes
0 answers
229 views

Strongswan: {parsed IKE_SA_INIT response 0 [ N(NO_PROP) ]} and {recieved NO_PROPOSAL_CHOSEN notify error}

I am getting the feeling that I have just done somethign very silly on my end but I have no idea what is going on. For context, I have been using wireguard for a bit and am much more knowledgable than ...
user avatar
0 votes
0 answers
95 views

Strongswan VPN certificate authentication failed

I've installed strongswan vpn on my ubuntu server. Set up certificate authentication. I've set up my android-phone and it works fine. But connection didn't established on the windows machine. I copied ...
user avatar
0 votes
0 answers
28 views

IPSec established but cannot ping remote LAN

I have successfully established IPSec in my OpenWrt router but I am unable to ping the remote subnet. Below are the related files cat ipsec.conf conn vpn3 keyexchange=ikev2 left=10.129.170.132 ...
user avatar
0 votes
0 answers
15 views

Traffic not tunneled/forwarded using StrongSwan

Description I am new to strongswan and I like to set strongswan in a road warrior configuration. My moon network is an AWS VPC with CIDR block 172.31.0.0/16 Inside that network, my VPN gateway is an ...
user avatar
  • 1
1 vote
0 answers
39 views

Ubuntu L2TP Server not allow to connect multiple devices

Till today, this website showed me some answers that solve the problem. But it seems I couldn't find the correct answer to this problem. I have a project for a VPN network for remote service purposes, ...
user avatar
0 votes
0 answers
118 views

Site-to-Site VPN and Remote Access VPN with Strongswan

I've recently deployed a Strongswan IKEv2 Remote Access VPN in two different sited with two different ubuntu servers. It all works great, but now i want to "merge" the two sites with a site-...
user avatar
0 votes
0 answers
23 views

Routing data/traffic through an ec2 instance that has a vpn tunnel

firstly sorry if I use the terminology wrong in this post. I am completely new to AWS and network stuff in general. Here is the problem that I am working on: I want my data generating application in a ...
user avatar
0 votes
0 answers
45 views

StrongSwan Not Keeping Connection Alive

We have a virtual linux VPN using StrongSwan to integrate some REST API services. Our VPN works perfectly, however after some time it looses the tunnel connection and goes down. We need to manually ...
user avatar
0 votes
2 answers
96 views

How to link ipsec clients with different connections in StrongSwan?

I use strongswan ipsec as VPN gateway for mobile devices (Android). In StrongSwan config I've setup 2 connections (two different subnets 10.10.10.0/24, 10.10.20.0/24 with different routing policies) ...
user avatar
  • 101
1 vote
3 answers
317 views

Strongswan / Ipsec multiple roadwarrior connections different subnets

I'm trying to setup a StrongSwan VPN Server which should host multiple (Windows 10 - internal vpn client) roadwarrior connections, but different subnets, depending on the clients certificate. root@VPN:...
user avatar
  • 146
0 votes
0 answers
12 views

Connecting all vpn clients into a single network

I have a Ubuntu server with IKEv2 VPN configured. I have 2 (will be more) Windows clients, that can connect to VPN. I want them all to be "bridged", like they are all physically connected to ...
user avatar
  • 1
0 votes
2 answers
208 views

How is IPsec (strongswan) working without opening ports in UFW?

I needed to setup a site-to-site VPN between servers A and B, where server A is being managed by me and server B is being managed by a client. Server A is running Ubuntu 20.04 and I am using ...
user avatar
  • 165
0 votes
0 answers
55 views

AWS Site-to-Site VPN with Strongswan - can't ping from strongswan to AWS

I'm trying to set up an AWS Site-to-Site VPN to Digital Ocean with strongswan. I can ping from AWS to my DO instance's private IP. I cannot ping from DO to AWS's private IP. I have all inbound ...
user avatar
-1 votes
1 answer
193 views

Strongswan & Windows client: connection freezes in a few minutes

On an AWS VPS, I installed Strongswan to use it as a VPN. It works fine with iPhone client. However, when I try to connect from a Windows client, the SA connection gets established successfully and ...
user avatar
0 votes
0 answers
17 views

Strongswan how to deny smb on virtual IPs

i dont understand how block smb on virtual lan.Virtual lan 10.10.10.0/24. i use UFW /etc/ipsec.conf config setup charondebug="ike 1, knl 1, cfg 0" uniqueids=no conn ikev2-vpn ...
user avatar
  • 1
0 votes
0 answers
30 views

StrongSwan - NAT VPN Pool traffic (after decryption) to same IP as VPN Termination

I have been having issues to do NAT (of VPN Pool traffic after decryption) through the same interface the VPN has terminated. Any idea how to achieve this post IPSEC NAT. NAT Pool 10.10....
user avatar
  • 1
0 votes
0 answers
244 views

Implementing rfc3442 (classless static route) in Freeradius DHCP server

I am trying to setup a Strongswan server that runs in split tunnel mode, which means I have to disable using the server as a default gateway on client side and also disable classfull routing in the ...
user avatar
0 votes
1 answer
281 views

Cannot get split tunneling to work in Strongswan

I am trying to setup Strongswan for VPN split tunneling. What I want is only the subnets 10.88.0.0/16 and 10.0.200.0/24 is accessible through the VPN tunnel. Everyting else is handled throught the ...
user avatar
0 votes
1 answer
225 views

strongSwan service will not start

Ubuntu 20.04 strongSwan 5.9.1 (swanctl) I have get the following error: /usr/sbin/charon-systemd: symbol lookup error: /usr/lib/ipsec/plugins/libstrongswan-stroke.so: undefined symbol: ...
user avatar
  • 133
0 votes
0 answers
125 views

UniFi Security Gateway (Strongswan) site to site VPN with branch side has no real IP at all (e.g. 4G connections) and dual WAN fallback

As title described, here is the scenario I have: HQ - USG Pro (Unified Security Gateway Pro) with static public IP Branch Office - USG with dual WAN, either one or both of the WAN port has no real IP ...
user avatar
0 votes
1 answer
258 views

How to fix these xl2tpd errors?

How to fix these xl2tpd errors? How to fix these xl2tpd errors? l2tp/ipsec connection. I use xl2tpd along with strongswan. Strongswan is rising, everything is ok. I see myself connected to the gateway ...
user avatar
  • 1
0 votes
1 answer
146 views

Ping across IPSec tunnel sends both ICMP and ESP packets

I've been using Strongswan to setup an IPSec tunnel between two units. The tunnels SAs get setup without any issues and traffic can pass across the connection. Whenever I ping across the tunnel, the ...
user avatar
  • 11
1 vote
1 answer
70 views

AWS/Strongswan-Ubuntu Site to Site Tunnel Cannot Ping Remote

Ubuntu (Linode) Strongswan 5.6.2 Connecting to AWS (site to site). I can ping from AWS endpoint to Ubuntu VPN. I cannot ping from AWS endpoint to Ubuntu endpoint. I cannot ping from Ubuntu VPN to AWS ...
user avatar
0 votes
1 answer
303 views

Strongswan IKEv2 vpn on Windows 10 client. I'm getting "policy match error"

my log file: Jan 16 22:10:46 ip-172-26-4-200 charon: 05[CFG] selecting proposal: Jan 16 22:10:46 ip-172-26-4-200 charon: 05[CFG] no acceptable ENCRYPTION_ALGORITHM found Jan 16 22:10:46 ip-172-26-4-...
user avatar
0 votes
2 answers
134 views

Block websites for my VPN users

I have strongswan running fine, I need to block some bad websites by it's domains from being visiting by VPN users, I tried many methods but no luck as redirect traffic from vpn to proxy server like ...
user avatar
  • 101
0 votes
0 answers
50 views

libgcrypt.so.11 installed but needed by strongswan

I'm trying to get StrongSwan package in Red Hat Enterprise Linux release 8.5 (Ootpa). But it shows an issue, even with libgcrypt-1.8.5-6.el8.x86_64 installed. I tried to get StrongSwan and Libcrypt ...
user avatar
0 votes
0 answers
44 views

Server not forwarding traffic

I am using DO to host my Production server. I am currently building a DR env and having issues with forwarding traffic. I used the same kind of configs from the Production env, and it works fine (I ...
user avatar
0 votes
0 answers
54 views

Accessing to the Site to Site IPsec VPN with Remote Access VPN

first of all sorry I am a beginner with networking/VPN. We created a Site to Site VPN with Strongswan lets say between server A (our server 10.19.0.0/16) and server B (10.1.0.0/21). I can connect to ...
user avatar
0 votes
0 answers
73 views

Multiple IKE SAs with Strongswan VPN

I have a VPN between one server (Debian 10, Strongswan 5.7.2) and a partner server (Stormshield SN510). All run fine, my others servers can reach the partner one on HTTPS via the VPN. But IKE SAs stay ...
user avatar
0 votes
0 answers
174 views

IPSec iptables rules for local service

I have a StrongSwan IPSec remote access server running on RHEL and a client all on the same local network. I have a Samba server running on the same RHEL host that I want to be available through the ...
user avatar
0 votes
1 answer
430 views

using strongswan with pkcs11 and yubikey

I am trying to deploy a new VPN configuration in my enterprise. I have successfully established a connection between my computer and my vpn ipsec server in certificate mode. I uploaded the p12 file in ...
user avatar
  • 1
0 votes
1 answer
312 views

Failed to start the IKEv2 VPN connection to surfshark via NetworkManager

I try to connect to surfshark VPN provider through IKEv2 manually. Here are the logs charon-nm[5070]: 05[CFG] received initiate for NetworkManager connection Surfshark IKE2 charon-nm[5070]: 05[CFG] ...
user avatar
  • 103
0 votes
0 answers
73 views

How can i control "Disable class based route addition" with PowerShell?

I use powershell to create a connection to VPN users. The default route checkbox can be unchecked with SplitTunneling, but what about routes based on classes ? VPN Server is StrongSWAN My script for ...
user avatar
0 votes
1 answer
44 views

Strongswan swanctl.conf parameter syntax

I am looking for exact syntax for swanctl.conf parameter syntax. I read though the swanctl.conf documentation, but there does not seem to be any exact syntax for parameters. Mainly I am looking for ...
user avatar
  • 152
0 votes
2 answers
185 views

Strongswan IPSec Configuration on a VPS

Please assist. I'm trying to set up a site to Site IPSec tunnel with strongswan on my VPS but sadly my provider cannot enable the following kernel modules for me: ah4 ah6 esp4 esp6 xfrm4_tunnel ...
user avatar
0 votes
0 answers
82 views

how to allow ipsec connection only with pre shared key authentication and rest of connections should be rejected

l2tpd configuration file : remote access vpn configuration conn L2TP-PSK authby=psk pfs=no rekey=no keyingtries=3 keyexchange=ikev1 forceencaps=yes leftfirewall=yes leftnexthop=%defaultroute type=...
user avatar
0 votes
0 answers
49 views

Strongswan VPN packet not hitting the interface (eth0) when tunnel is up

VPN tunnel is getting established with Cisco router successfully and when we try to ping the remote host tcpdump doesnt see the packets but if I bring the tunnel down and ping the remote host tcpdump ...
user avatar
0 votes
1 answer
413 views

EAP-MS-CHAPv2 verification failed Arch Linux (strongswan)

I cannot get Strongswan, networkmanager-strongswan (client) work on your Arch-PC. My vpn-strongswan server (hereinafter deb (server)) has been configured for a long time, any devices (such as android, ...
user avatar
1 vote
1 answer
453 views

Ipsec VPN to AWS: Can't ping AWS end inside tunnel

Summary: I think I'm missing some routes on my Ubuntu server connecting to an AWS VPN with Strongswan Ipsec. Any idea what routes I need on my server? I'm trying to setup a BGP routed VPN from a ...
user avatar
0 votes
0 answers
55 views

strongswan and Squid Proxy on the same saver

192.168.1.10/24 client<--->cisco_router<----IPSec/Ikev2----->eth1(192.168.15.4)-strongswan/Squid-eth0(192.168.16.4)<------->Internet. on the scenario above I have IPSec working. The ...
user avatar
  • 1
0 votes
0 answers
34 views

IPSec site2site tunnel + vpn

In our research project, we needed to deploy a server "Molly" at another company. They made us set up a IPSec tunnel to their firewall/gateway and from there, the comms are forwarded to our ...
user avatar
  • 1
0 votes
0 answers
307 views

NAT source IP in Strongswan IPSEC VPN on Amazon EC2

Ok so first of all, networking is really not my strong suit... I have an Amazon Linux EC2 instance, ip 172.31.46.176, connected to a IPSEC VPN using strongswan : conn aws-to-other type=tunnel ...
user avatar
0 votes
0 answers
30 views

How to setup strongSwan server for Cisco RV130 VPN Gateway?

I'm trying to setup this scenario with goal of full subnet-to-subnet connectivity: .--------------. .--------------. .--------------. | linux |--- LAN1 ---| NATing ...
user avatar
  • 11
0 votes
1 answer
201 views

Packets from xfrm interface won't route, but opposite works

I'm working on a site-to-site vpn, where one end us a UDM and the other is Strongswan. The goal is to provide bi-directional routing into a cloud environment. I'm completely baffled why this isn't ...
user avatar
0 votes
0 answers
308 views

Strongswan tunnel connected but the traffic is not going through it

I have 3 Virtual Machine cluster (platform1, platform2 and platform3) and I have enabled ipsec tunnel communication between them using strongswan (5.6.2). The tunnel looks fine and connected, but ...
user avatar
0 votes
1 answer
207 views

Mirror incoming traffic on specific port to another IP, using my IPSec strongswan tunnel

I want to internally publish an SMTP server (IP 10.0.0.10) that is behind a VPN tunnel on my internal server (192.168.0.12) using strongswan. My strongswan is running within a docker container. For ...
user avatar
  • 143

1
2 3 4 5
9