Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [strongswan]

strongSwan is an open source, multi-platform IPsec-based VPN solution, with IKEv2 & IKEv1 support

0
votes
0answers
37 views

debian 9.5 strongswan IPSEC Routing

I'm a Linux-Noob but i'm trying to Setup a VPN-Connection between a Linux-machine and a Zyxel USG 210. The VPN-Connection Comes up (happy) but the traffic seems not to be routet correctly. the Linux-...
0
votes
0answers
21 views

Strongswan site-to-site VPN connected/established but can't ping server

I need to create site-to-site VPN with one server (Not on "strong swan"). I did everything by this article https://blog.ruanbekker.com/blog/2018/02/11/setup-a-site-to-site-ipsec-vpn-with-strongswan-...
0
votes
0answers
10 views

Site to Site IPSEC with Debian and Zyxel USG210 - Server says connection established, Router doesn't

I'm trying to set up a StrongSwan IPSEC VPN on a Debian server and want to connect the Zyxel USG210 router to it. So far I've run into some issues and don't know the exact cause. Basically, the ...
0
votes
0answers
9 views

strongswan with only internal ip

I setup a strongswan site to site ipsec,between pfsense and the VPS (only with internal ip 10.214.22.215 on it's NIC, additional a float ip), got the error: no IKE config found for 10.214.22.215......
1
vote
1answer
52 views

Strongswan 5.7.1 IKEv2 Certificate configuration for Android client

I'm trying to configure strongswan 5.7.1 for Android strongswan "IKEv2 Certificate" connection. I'm using a self signed user certificate and a godaddy wildcard server certificate. I am unable to ...
0
votes
0answers
27 views

How do I route internet traffic through an established L2TP connection?

I am struggling to connect and, more importantly, route traffic from an Ubuntu server (this means that Network-Manager and any GUI tools are out of the question) to an L2TP-IPSec VPN server running on ...
0
votes
1answer
41 views

strongswan upgrade from 5.1.2 to 5.7.1

I am using strongswan 5.1.2 on Ubuntu and have installed it using apt-get. I am trying to upgrade to strongswan 5.7.1. I first removed the current installation using the following commands: sudo apt-...
1
vote
0answers
170 views

L2TP ipsec using network-manager-l2tp and strongswan ubuntu 18.04

The VPN works flawlessly on OSX and Windows 10 but no luck with ubuntu VPN gets connected on ubuntu using Phase1 Algorithms : 3des-sha1-modp1024 Phase2 Algorithms : 3des-sha1 And in 10 seconds ...
0
votes
0answers
29 views

strongSwan 5.0.0 does not load curl plugin

I've got strongSwan 5.0.0 installed in an embedded system. I would expect it to load the cURL plugin, but it's not happening, and I can't tell why. The config file at /etc/strongswan.conf is very ...
0
votes
0answers
80 views

IPsec connection to a Linux VM with StrongSwan running on a dedicated Windows host

I have a dedicated root server hosted by a certain provider and it has a public IP address "1.2.3.4" (I will use this dummy IP in the following description of the issue I am facing). Host server has ...
0
votes
1answer
302 views

Strongswan: “received NO_PROPOSAL_CHOSEN error notify” while connecting to Cisco Router

I'm trying to establish an ipsec connection from a raspberry pi with Strongswan (Linux strongSwan U5.5.1/K4.14.50+) to a Cisco Router. This is the Strongswan output: root@raspberrypi:~# ipsec up ...
0
votes
1answer
123 views

FreeRadius return User Groups in Class field

UPDATE: I have managed to get 'a group' in to the class by following this article and using memberOf as the attribute. http://lists.freeradius.org/pipermail/freeradius-users/2016-August/084450.html ...
0
votes
1answer
63 views

StrongSwan on Amazon Linux with RADIUS

I'm trying to run strongSwan on an Amazon Linux instance with authentication against RADIUS but I receive an error when trying to start strongSwan charon[9518]: 00[CFG] RADIUS initialization failed, ...
2
votes
1answer
73 views

Can't connect to ipsec server running in docker behind firewall

I have a setup which I dont think is very difficult but cant get it to work. Working setup: An ipsec server running in a docker connected directly to internet. The clients can connect. Not ...
0
votes
1answer
45 views

How do I route traffic from VPN gateway to distant network?

The situation in my environment is as follows: There is a network (213.213.213.128/26) with a VPN gateway (213.213.213.155). There is a distant network (10.42.0.16/28) on AWS which is connected with ...
0
votes
0answers
222 views

Strongswan client L2TP over IPSec, IPSec tunnel established but can't connect inside VPN (Centos6)

Been beating my head over this issue for two days now. I am trying to connect a Centos 6.10 development system in my home to the Sonicwall VPN at work. NetworkManager-l2tp will not work, not relevant ...
-5
votes
1answer
130 views

Debian 9 dummy network adapter - works on Local but not Remote?

I'm trying to set up an IPSEC tunnel between my remote external server and a locally situated machine. My remote has a naked public IP4 in a data-centre. My nearby server has a local NAT hidden 192....
0
votes
1answer
31 views

verbose output for ip xfrm command?

I have an up script for strongswan that adds policies like this: ip xfrm policy add dir in src $PLUTO_PEER_CLIENT dst 0.0.0.0/0 proto any varl src $PLUTO_PEER dst $PLUTO_ME proto esp mode tunnel ...
0
votes
0answers
33 views

How can I reserve the IPs to the hosts in strongswan?

For Example: when host "91:75:1a:ec:9a:c7" connect for first time assign IP "10.19.48.15" when host "88:23:yd:q2:9y:b3" connect for first time assign IP "10.19.48.16" and if they disconnect, next ...
3
votes
1answer
216 views

strongSwan 5.6.2 and xl2tp 1.3.12 on Ubuntu 18.04 SA established but no traffic

Since updating strongSwan and xl2tpd to the latest versions available for Ubuntu I encounter a problem with ESP and AH in L2TP. Server config: Interface for generating traffic ens224: flags=4163<...
0
votes
0answers
22 views

Switch this setup to use charon instead of pluto?

I using this wiki but using a newer version of strongswan: https://docs.openvpn.net/configuration/extending-vpn-connectivity-to-amazon-aws-vpc-using-aws-vpc-vpn-gateway-service/ My version uses ...
0
votes
0answers
16 views

where do I tell strongswan to find the ipsec.conf file?

https://wiki.strongswan.org/projects/strongswan/wiki/IpsecStarter Im on centos. Centos renames the ipsec command "strongswan". i put ipsec.conf in /etc/strongswan but it doesnt read it when I run ...
0
votes
0answers
16 views

How do I stop a single connection?

ipsec version Linux Libreswan 3.23 (netkey) on 3.10.0-862.11.6.el7.x86_64 ipsec status show 1 connection active: Total IPsec connections: loaded 2, active 1 ipsec stop stops everything. But how ...
1
vote
0answers
74 views

Strongswan - traffic from servers in the same IP block are not going through VPN tunnel

Site A: Device: CentOS Server eth0: public IP address eth1: 10.0.0.1/24 (dedicated vlan) Site B: Device: Juniper SRX ge-0/0/0: public IP address ge-0/0/5: 192.168.1.1/24 I've configured a site to ...
0
votes
0answers
182 views

VPN setup for remote access on ubuntu 18.04

I have successfully setup a vpn server using this tutorial: https://www.digitalocean.com/community/tutorials/how-to-set-up-an-ikev2-vpn-server-with-strongswan-on-ubuntu-18-04-2 . (but using pre-shared ...
0
votes
0answers
256 views

Router (TP-Link MR200) with dynamic IP behind NAT failing to create IPSEC VPN to Ubuntu Strongswan

I've been trying to get this up and running and I got it further than I expected but am getting stuck at an error received INVALID_ID_INFORMATION error notify and there's a very peculiar local IP ...
1
vote
1answer
167 views

ipsec tunnel blocks google services

I set up a strongswan responder on debian in GCE. I can connect to it via the strongswan app on android. No problems. I can also connect using the native vpn client in Windows 10. And when I do, the ...
0
votes
1answer
654 views

Windows 10 connection to strongswan ipsec server fails with "IKE authentication credentials are unacceptable

I'm trying to get a simple IPSEC/IKEv2 server set up with username/password (for now) on Ubuntu 18.04. I'm using Windows 10 Pro built in client, and the connection fails complaining about the IKE ...
0
votes
0answers
318 views

How to establish a Point-to-Site VPN connection to Azure from Linux machine (CLI only)?

I got an Ubuntu 16.04 (with CLI access only) which is behind NAT and I try to establish a Point-to-Site VPN connection to Azure gateway. Below is my configuration of strongswan and an output when ...
0
votes
0answers
294 views

Strongswan stops working after a while

I'm trying hard to resolve one question with my strongswan IKEv2 VPN. I use Linux strongSwan U5.6.1/K3.10.0-862.el7.x86_64 installed on CentOS 7 and few clients: Windows Server 2012 R2, Windows 10, ...
0
votes
0answers
213 views

IPSec strongswan “established successfully”, but no ppp0

I'm trying to connect an Ubuntu Server 16.04 to an IPSec L2TP VPN using the strongswan client. Aparently the connection is established successfully, but the interface ppp0 isn't created. This is the ...
0
votes
0answers
46 views

Strongswan and KSOFTIRQ cpu utilization

We're using StrongSwan and FRR. We've Intel Xeon E5-2620 with x 24CPU. OS is Centos. The KSOFTIRQ processes are utilizing only 0 and 15 CPU. Sometimes it uses ~50% CPU usage. Server have 2x10LAN ...
0
votes
2answers
979 views

strongswan IKEv2 VPN + RADIUS authentication with NPS in Active Directory domain

I've managed to get strongswan running with eap-mschapv2 authentication using a server certificate. Now I want to try and use the eap-radius plugin with NPS running on a Windows 2012 R2 server to ...
0
votes
1answer
133 views

Strongswan LTE connection re-establishing issue

Thank you for your help with my previous problem regarding Strongswan and allow me ask you for help one more. I have two networks connected to Strongswan server via two Mikrotik routers. The first ...
1
vote
1answer
388 views

strongSwan VPN Intermediate Certificate Authority

I have been testing out strongSwan VPN on a Linux server in a Windows Active Directory domain. I have managed to get a single-tier PKI with EAP authentication to work, but when I attempt to add a ...
0
votes
0answers
625 views

Strongswan site-to-site on OpenWRT 17.01.4 Traffic Dropped

I'm trying to set up a site-to-site tunnel, following the same tutorial as this guy: LEDE 17.01.1, StrongSwan 5.6.0 swanctl NAT. The scenario is: Two routers, both with lede/openwrt 17.01.4 having ...
0
votes
1answer
548 views

How can I set the source IP in strongswan's routing table

I have a site-to-site VPN where there's one subnet on the remote side and two on the local one: conn site-to-site leftsubnet = 10.10.0.0/16,10.11.0.0/16 rightsubnet = 10.50.0.0/16 Everything ...
0
votes
1answer
64 views

StrongSwan IPsec PING only working once after ipsec restart

Diagram VPN site to site: And a GIF showing what is happening. I create an IP route like this: sudo ip route add 192.168.1.0/24 via 10.132.146.166 eth0 eth1 And I have this iptable rules sudo ...
1
vote
1answer
162 views

Strongswan Routing Roadwarrior with the VM IP, instead of the virtual IP

I'm at my wit's-end here with this issue. I have a stongswan VM with only 1 private internet interface (ens18). I can successfully connect to it and get a virtual IP, but my problem is the network ...
0
votes
1answer
311 views

Strongswan + FreeRADIUS and Windows 10 clients without internet access

I apologise for another query regarding Strongswan. I have created Strongswan server that has on one side multiple networks and on the second side are clients that are authorised via FreeRADIUS EAP-...
1
vote
1answer
492 views

VPN server using StrongSwan “no matching peer config found” - what does it mean?

I have an AWS server running Ubuntu that has a pptpd server for VPNs, and many clients with different credentials. It works great. But apparently I'm not supposed to be using that any more, I'm ...
0
votes
0answers
204 views

AWS Ubuntu Strongswan IPSec VPN and Iptables configuration tunnel routing

I've muddled up my configuration. I've setup a site-to-site VPN between an AWS Ubuntu VM running strongswan, and another site. The VPN tunnel is working, but anytime I try to route traffic through ...
0
votes
0answers
327 views

Strongswan IKEv2 REAUTH request

I have successfully created IKEv2 connection between Mikrotik routerboard with LTE module and Strongswan server. Mikrotik has non-public dynamic IP address assigned by SIM card. Strongswan: config ...
0
votes
2answers
224 views

VPN : Cannot reach my own gateway using ipsec/strongswan

I've followed this tutorial to setup my private VPN using StrongSwan and IPSec. It works very well. But when I try to connect directly to my gateway/server (using SSH), the connection does not go ...
2
votes
0answers
176 views

Bandwidth control with TC for clients yet to be connected

I have applied bandwidth control using TC and iptables using this tutorial on my Strongswan VPN server. The bandwidth control works fine ONLY if that specific client is already connected. For example:...
0
votes
1answer
85 views

StrongswanPKI - Adding status_request or MustStaple TLS extension to certificate?

Using PKI tool from strongswan to setup a CA. Trying to setup the OCSP side of things have run into many issues as per another thread I posted (Strongswan PKI - ED25519 Certifcates - OCSP Responder ...
1
vote
1answer
377 views

Strongswan IKEv2 auth - pubkey and EAP

I'am trying to setup strongswan with pubkey and EAP authentication. To login users need to have certificate and valid credentials. My certificate is ok. I tested pubkey auth and it was ok, also EAP ...
0
votes
0answers
72 views

How to Restrict Strongswan VPN Clients to Internet Access Only?

In other words, I would like to block certain clients from accessing the local subnet, so they can only access the Internet. Thanks in advance.
0
votes
1answer
263 views

Iptables - allow remote VPN users to access services running on server

I am trying to setup VPN server (strognswan) and allow remote users access services like redis, nginx, mongodb etc. via VPN only - users should not have access to internet via VPN. I'am able to ...
0
votes
0answers
61 views

ping (and all traffic) from ipsec tunnel stay inside vpn server

i have working ipsec tunnel with this config windows7 machine 192.168.88.251 mikrotik router 192.168.88.1 that route all 192.168.88.251 to ipsec vpn server VPN_IPSEC that run StrongSwan vpn ...