Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [strongswan]

strongSwan is an open source, multi-platform IPsec-based VPN solution, with IKEv2 & IKEv1 support

0
votes
1answer
22 views

Strongswan: “received NO_PROPOSAL_CHOSEN error notify” while connecting to Cisco Router

I'm trying to establish an ipsec connection from a raspberry pi with Strongswan (Linux strongSwan U5.5.1/K4.14.50+) to a Cisco Router. This is the Strongswan output: root@raspberrypi:~# ipsec up ...
0
votes
1answer
48 views

FreeRadius return User Groups in Class field

UPDATE: I have managed to get 'a group' in to the class by following this article and using memberOf as the attribute. http://lists.freeradius.org/pipermail/freeradius-users/2016-August/084450.html ...
0
votes
1answer
26 views

StrongSwan on Amazon Linux with RADIUS

I'm trying to run strongSwan on an Amazon Linux instance with authentication against RADIUS but I receive an error when trying to start strongSwan charon[9518]: 00[CFG] RADIUS initialization failed, ...
2
votes
1answer
32 views

Can't connect to ipsec server running in docker behind firewall

I have a setup which I dont think is very difficult but cant get it to work. Working setup: An ipsec server running in a docker connected directly to internet. The clients can connect. Not ...
0
votes
1answer
34 views

How do I route traffic from VPN gateway to distant network?

The situation in my environment is as follows: There is a network (213.213.213.128/26) with a VPN gateway (213.213.213.155). There is a distant network (10.42.0.16/28) on AWS which is connected with ...
0
votes
0answers
76 views

Strongswan client L2TP over IPSec, IPSec tunnel established but can't connect inside VPN (Centos6)

Been beating my head over this issue for two days now. I am trying to connect a Centos 6.10 development system in my home to the Sonicwall VPN at work. NetworkManager-l2tp will not work, not relevant ...
-5
votes
1answer
104 views

Debian 9 dummy network adapter - works on Local but not Remote?

I'm trying to set up an IPSEC tunnel between my remote external server and a locally situated machine. My remote has a naked public IP4 in a data-centre. My nearby server has a local NAT hidden 192....
0
votes
1answer
26 views

verbose output for ip xfrm command?

I have an up script for strongswan that adds policies like this: ip xfrm policy add dir in src $PLUTO_PEER_CLIENT dst 0.0.0.0/0 proto any varl src $PLUTO_PEER dst $PLUTO_ME proto esp mode tunnel ...
0
votes
0answers
31 views

How can I reserve the IPs to the hosts in strongswan?

For Example: when host "91:75:1a:ec:9a:c7" connect for first time assign IP "10.19.48.15" when host "88:23:yd:q2:9y:b3" connect for first time assign IP "10.19.48.16" and if they disconnect, next ...
3
votes
1answer
109 views

strongSwan 5.6.2 and xl2tp 1.3.12 on Ubuntu 18.04 SA established but no traffic

Since updating strongSwan and xl2tpd to the latest versions available for Ubuntu I encounter a problem with ESP and AH in L2TP. Server config: Interface for generating traffic ens224: flags=4163<...
0
votes
0answers
20 views

Switch this setup to use charon instead of pluto?

I using this wiki but using a newer version of strongswan: https://docs.openvpn.net/configuration/extending-vpn-connectivity-to-amazon-aws-vpc-using-aws-vpc-vpn-gateway-service/ My version uses ...
0
votes
0answers
15 views

where do I tell strongswan to find the ipsec.conf file?

https://wiki.strongswan.org/projects/strongswan/wiki/IpsecStarter Im on centos. Centos renames the ipsec command "strongswan". i put ipsec.conf in /etc/strongswan but it doesnt read it when I run ...
0
votes
0answers
13 views

How do I stop a single connection?

ipsec version Linux Libreswan 3.23 (netkey) on 3.10.0-862.11.6.el7.x86_64 ipsec status show 1 connection active: Total IPsec connections: loaded 2, active 1 ipsec stop stops everything. But how ...
0
votes
0answers
29 views

How to create an IPSec Connection in Docker on a VM

I have an established IPSec connection using strongSwan between two Ubuntu Virtual Machines and can successfully transfer data between them. I am using two AWS EC2 instances (VM's) in different ...
1
vote
0answers
39 views

Strongswan - traffic from servers in the same IP block are not going through VPN tunnel

Site A: Device: CentOS Server eth0: public IP address eth1: 10.0.0.1/24 (dedicated vlan) Site B: Device: Juniper SRX ge-0/0/0: public IP address ge-0/0/5: 192.168.1.1/24 I've configured a site to ...
0
votes
0answers
103 views

VPN setup for remote access on ubuntu 18.04

I have successfully setup a vpn server using this tutorial: https://www.digitalocean.com/community/tutorials/how-to-set-up-an-ikev2-vpn-server-with-strongswan-on-ubuntu-18-04-2 . (but using pre-shared ...
0
votes
0answers
86 views

Router (TP-Link MR200) with dynamic IP behind NAT failing to create IPSEC VPN to Ubuntu Strongswan

I've been trying to get this up and running and I got it further than I expected but am getting stuck at an error received INVALID_ID_INFORMATION error notify and there's a very peculiar local IP ...
1
vote
1answer
143 views

ipsec tunnel blocks google services

I set up a strongswan responder on debian in GCE. I can connect to it via the strongswan app on android. No problems. I can also connect using the native vpn client in Windows 10. And when I do, the ...
0
votes
1answer
452 views

Windows 10 connection to strongswan ipsec server fails with "IKE authentication credentials are unacceptable

I'm trying to get a simple IPSEC/IKEv2 server set up with username/password (for now) on Ubuntu 18.04. I'm using Windows 10 Pro built in client, and the connection fails complaining about the IKE ...
0
votes
0answers
267 views

How to establish a Point-to-Site VPN connection to Azure from Linux machine (CLI only)?

I got an Ubuntu 16.04 (with CLI access only) which is behind NAT and I try to establish a Point-to-Site VPN connection to Azure gateway. Below is my configuration of strongswan and an output when ...
0
votes
0answers
227 views

Strongswan stops working after a while

I'm trying hard to resolve one question with my strongswan IKEv2 VPN. I use Linux strongSwan U5.6.1/K3.10.0-862.el7.x86_64 installed on CentOS 7 and few clients: Windows Server 2012 R2, Windows 10, ...
0
votes
0answers
159 views

IPSec strongswan “established successfully”, but no ppp0

I'm trying to connect an Ubuntu Server 16.04 to an IPSec L2TP VPN using the strongswan client. Aparently the connection is established successfully, but the interface ppp0 isn't created. This is the ...
0
votes
0answers
41 views

Strongswan and KSOFTIRQ cpu utilization

We're using StrongSwan and FRR. We've Intel Xeon E5-2620 with x 24CPU. OS is Centos. The KSOFTIRQ processes are utilizing only 0 and 15 CPU. Sometimes it uses ~50% CPU usage. Server have 2x10LAN ...
0
votes
2answers
699 views

strongswan IKEv2 VPN + RADIUS authentication with NPS in Active Directory domain

I've managed to get strongswan running with eap-mschapv2 authentication using a server certificate. Now I want to try and use the eap-radius plugin with NPS running on a Windows 2012 R2 server to ...
0
votes
1answer
112 views

Strongswan LTE connection re-establishing issue

Thank you for your help with my previous problem regarding Strongswan and allow me ask you for help one more. I have two networks connected to Strongswan server via two Mikrotik routers. The first ...
1
vote
1answer
269 views

strongSwan VPN Intermediate Certificate Authority

I have been testing out strongSwan VPN on a Linux server in a Windows Active Directory domain. I have managed to get a single-tier PKI with EAP authentication to work, but when I attempt to add a ...
0
votes
0answers
418 views

Strongswan site-to-site on OpenWRT 17.01.4 Traffic Dropped

I'm trying to set up a site-to-site tunnel, following the same tutorial as this guy: LEDE 17.01.1, StrongSwan 5.6.0 swanctl NAT. The scenario is: Two routers, both with lede/openwrt 17.01.4 having ...
0
votes
1answer
295 views

How can I set the source IP in strongswan's routing table

I have a site-to-site VPN where there's one subnet on the remote side and two on the local one: conn site-to-site leftsubnet = 10.10.0.0/16,10.11.0.0/16 rightsubnet = 10.50.0.0/16 Everything ...
0
votes
1answer
40 views

StrongSwan IPsec PING only working once after ipsec restart

Diagram VPN site to site: And a GIF showing what is happening. I create an IP route like this: sudo ip route add 192.168.1.0/24 via 10.132.146.166 eth0 eth1 And I have this iptable rules sudo ...
1
vote
1answer
139 views

Strongswan Routing Roadwarrior with the VM IP, instead of the virtual IP

I'm at my wit's-end here with this issue. I have a stongswan VM with only 1 private internet interface (ens18). I can successfully connect to it and get a virtual IP, but my problem is the network ...
0
votes
1answer
259 views

Strongswan + FreeRADIUS and Windows 10 clients without internet access

I apologise for another query regarding Strongswan. I have created Strongswan server that has on one side multiple networks and on the second side are clients that are authorised via FreeRADIUS EAP-...
1
vote
1answer
396 views

VPN server using StrongSwan “no matching peer config found” - what does it mean?

I have an AWS server running Ubuntu that has a pptpd server for VPNs, and many clients with different credentials. It works great. But apparently I'm not supposed to be using that any more, I'm ...
0
votes
0answers
171 views

AWS Ubuntu Strongswan IPSec VPN and Iptables configuration tunnel routing

I've muddled up my configuration. I've setup a site-to-site VPN between an AWS Ubuntu VM running strongswan, and another site. The VPN tunnel is working, but anytime I try to route traffic through ...
0
votes
0answers
216 views

Strongswan IKEv2 REAUTH request

I have successfully created IKEv2 connection between Mikrotik routerboard with LTE module and Strongswan server. Mikrotik has non-public dynamic IP address assigned by SIM card. Strongswan: config ...
0
votes
2answers
140 views

VPN : Cannot reach my own gateway using ipsec/strongswan

I've followed this tutorial to setup my private VPN using StrongSwan and IPSec. It works very well. But when I try to connect directly to my gateway/server (using SSH), the connection does not go ...
2
votes
0answers
139 views

Bandwidth control with TC for clients yet to be connected

I have applied bandwidth control using TC and iptables using this tutorial on my Strongswan VPN server. The bandwidth control works fine ONLY if that specific client is already connected. For example:...
0
votes
1answer
73 views

StrongswanPKI - Adding status_request or MustStaple TLS extension to certificate?

Using PKI tool from strongswan to setup a CA. Trying to setup the OCSP side of things have run into many issues as per another thread I posted (Strongswan PKI - ED25519 Certifcates - OCSP Responder ...
1
vote
1answer
279 views

Strongswan IKEv2 auth - pubkey and EAP

I'am trying to setup strongswan with pubkey and EAP authentication. To login users need to have certificate and valid credentials. My certificate is ok. I tested pubkey auth and it was ok, also EAP ...
0
votes
0answers
55 views

How to Restrict Strongswan VPN Clients to Internet Access Only?

In other words, I would like to block certain clients from accessing the local subnet, so they can only access the Internet. Thanks in advance.
0
votes
1answer
180 views

Iptables - allow remote VPN users to access services running on server

I am trying to setup VPN server (strognswan) and allow remote users access services like redis, nginx, mongodb etc. via VPN only - users should not have access to internet via VPN. I'am able to ...
0
votes
0answers
47 views

ping (and all traffic) from ipsec tunnel stay inside vpn server

i have working ipsec tunnel with this config windows7 machine 192.168.88.251 mikrotik router 192.168.88.1 that route all 192.168.88.251 to ipsec vpn server VPN_IPSEC that run StrongSwan vpn ...
0
votes
0answers
314 views

Open ports to only to VPN clients connected via IKEv2 (strongswan)

I have a server which I VPN into using strongswan with a IKEv2 setup and it works as expected. This setup assigns my client machine a IP in the 10.10.10.0/24 range. What I'd like to be able to do is ...
0
votes
0answers
245 views

Stuup StrongSwan with user Cert

i will setting up strongswan and have some trouble with configure it. I can log in with user/pass but i will replace it with user.p12 certificate. When i add rightauth2=pubkey is login with user/pass ...
0
votes
1answer
156 views

Strongswan PKI - ED25519 Certifcates - OCSP Responder having issues

I am trying to setup an ocsp for the certificates generated out of strongswan PKI - using it as a CA. If I try to use openssl it just throws out Can't open index.txt.attr for reading, No such file or ...
0
votes
1answer
329 views

Strongswan: Connecting PSK & EAP at a time

I have successfully setup strongswan on a virtual Server. I basically have two kinds of configurations Using EAP (username/password for Android Strongswan Client). PSK (for IOS devices using ...
0
votes
2answers
170 views

Strongswan clients access rights

I am beginner with strongswan so I apologize for this beginner’s query. I have created Debian server with strongswan. To this server are connected three networks network_1: 192.168.10.0/24, network_2: ...
0
votes
0answers
100 views

Iptables and AWS VPN

I'm having some problem during setup of connection between AWS and local DC. I am using Ubuntu 16.04.3 LTS and Strongswan as tunnel client. I've done all things following instruction which i ...
1
vote
1answer
180 views

NAT Issue with VPN

I've got an Ubuntu server running StrongSwan. I can successfully connect and route all traffic over the VPN with a laptop client and iPhone client. What I need to do is connect an M2M router which ...
1
vote
1answer
210 views

OpenSSL equivalent of libreswan IPSEC

I have the following ipsec commands that generate certificates, but I dont have ipsec installed so looking for the openssl equivalent. Can anyone please help? Create certificate authority cert ipsec ...
0
votes
0answers
104 views

Routing for StrongSwan to access service on same server

I'm playing around with StrongSwan as a VPN provider for a few personal projects, so I'm running it on the same server as the other things I'm doing. It's all set-up and working, however I'm having an ...