Questions tagged [strongswan]

strongSwan is an open source, multi-platform IPsec-based VPN solution, with IKEv2 & IKEv1 support

Filter by
Sorted by
Tagged with
1 vote
1 answer
7k views

xl2tp + strongswan ipsec -- xl2tp timeout

I'm trying to connect to a ipsec/l2tp vpn from a private network behind a nat-router. It works from different windows clients, but from my linux machine (openSuSE 12.3, strongswan 5.1.3, xl2tp 1.3.0) ...
0 votes
1 answer
24 views

Resolve failing for %any in strongswan ipsec

I was configuring ipsec between 2 linux boxes. Since ip of our product can be different when connected to different spaces. I used %any for right. Since then, I am not able to up my ipsec transport ...
0 votes
2 answers
6k views

Setup l2tp using Strongswan

I setup ikev2 using Strongswan, Now I need to add l2tp support to that What is the best and easy method to add l2tp support to Strongswan? Appreciate for any help
1 vote
1 answer
14k views

establishing IKE_SA failed, peer not responding

I'm new with this VPN things. I'm using Strongswan 5.8.2 with swan config for establish my SA and using PSK. Im integrating with a company to provide me some services and they gave me a gateway server ...
8 votes
0 answers
1k views

How to limit bandwidth per VPN connection?

I have a StrongSwan (IKEv2) server setup and would like to limit each VPN connection to 512kb/s. After researching I came across tc in Ubuntu. I don't quite understand it and am fighting through the ...
0 votes
0 answers
42 views

strongSwan: Accessing LAN of a Windows client (reversed remote access)

I am currently having an Ubuntu Server strongSwan setup (IKEv2, EAP-MSCHAPv2) that will allow any authorized remote Windows client to access server's LAN (192.168.7.0/24). It works perfectly, but I ...
0 votes
0 answers
21 views

Is iptables NAT forwarding possible bewteen two libvirt VMs?

I'm building a test VPN setup using two libvirt VMs with StrongSwan IKEv2 but can't get traffic to forward. I can see the client sending traffic to the server using tcpdump but the server doesn't do ...
5 votes
1 answer
7k views

strongswan VPN on OpenWrt

Hi I'm running Barrier Breaker version of OpenWRT and I have setup a VPN according to: http://wiki.openwrt.org/inbox/strongswan.howto I can connect to the VPN with my iPhone or Mac (to 10.10.1.0/24 ...
1 vote
1 answer
98 views

Strongswan IPsec site-to-site on Gcloud

I am trying to initialise an IPsec tunnel between an Ubuntu VM on Google Cloud and a remote site. The connection is correctly established but from the Ubuntu machine on Google Cloud I cannot reach a ...
0 votes
0 answers
28 views

Site-to-site VPN jump through 2 tunnels

I have 3 networks like on the below diagram: network Subnet A: 10.0.1.0/24, public IP of VPN Gateway: 55.0.0.1 Subnet B: 172.30.0.0/24, public IP of VPN Gateway: 66.0.0.1 Subnet C: 172.20.0.0/24, ...
0 votes
2 answers
5k views

Strongswan IKEv2 for iOS devices

I want to connect a Strongswan IKEv2 VPN on iOS devices. It uses FreeRADIUS server for AAA of users. It's already working perfectly on Android and Windows devices. but when I try to connect using ...
1 vote
1 answer
5k views

Check if Remote Server Port is Blocking my IKEv2/IPSec VPN Connections

I am using StrongSwan on Ubuntu to try to establish a site-to-site VPN connection to a remote IKEv2 IPSec VPN server, but it appears that my connection requests are not reaching the remote server. Is ...
0 votes
0 answers
53 views

Unable to acces on some websites when connected to VPN IKEv2 server from linux

I have a VPN server hosted on Windows 2019 and configured on IKEv2, Everything works very well from all clients, however on Linux clients I have one last point to adjust, so for clarification I use ...
0 votes
1 answer
364 views

Strongswan on host, docker container unable to pass through

This is my first time posting here, so i'll do my best to explain. I installed an IPSec tunnel on my host (Ubuntu 22.04) using strongswan (bypass-lan plugin). The connection is up and stable, ...
0 votes
0 answers
97 views

StrongSwan IPSec VPN - IKEv2 - LetsEncrypt Certificate Issue (building CRED_PRIVATE_KEY - RSA failed, tried 10 builders)

I followed the link below for setup IKEv2 VPN Using Strongswan and Let's encrypt on CentOS 7. How to Setup IKEv2 VPN Using Strongswan and Let's encrypt on CentOS 7 But info on that link has been ...
0 votes
0 answers
25 views

The IPSec connection has been successfully established. I can only ping the remote endpoint, but cannot ping the entire subnet

server A: enter image description here config setup charondebug="all" uniqueids=yes conn home-to-aliyun ikelifetime=36000s keylife=8h rekeymargin=3m ...
0 votes
2 answers
248 views

Strongswan VPN from Windows 10: no private key found / 13801

I am evaluating AWS starting with connectivity. As AWS VPN solutions would be cumulatively expensive, I thought I'd start DIY with Strongswan. I already have Strongswan working for our site-to-site (...
0 votes
0 answers
91 views

S2S VPN - cannot ping B from A until A pings B

I'm working on site-to-site VPN between 2 networks within private cloud. On both ends I installed Strongswan and established VPN connection. The problem is that I'm not able to ping from A (10.0.1.0/...
1 vote
1 answer
122 views

Strongswan VPN to AWS / connectivity issue / No response back to ping

I create a VPN between an ec2 with strongswan and aws vpn connection attached to a vpn gateway with dynamic routing (bgp). Tunnel is UP. Ping is OK in one way DEST TO CLIENT but not the other way. Can ...
0 votes
0 answers
58 views

Strange routing behaviour when using NetworkManager with strongswan for IKE from docker

I have a situation that is causing me a problem: I historically had a VPN server which provided the L2TP connection, I upgraded it to IKEv2. This is going well, multi-platform clients access it ...
0 votes
1 answer
105 views

IPv6 route based VPN client with Strongswan, packets arrive but not received by application

I'm trying to set up a linux client PC with a route based VPN tunnel using strongswan and an XFRM interface, with IPv6 (end to end). strongswan 5.8.2, linux kernel 5.15.0 [An aside - I've tried an ...
0 votes
0 answers
348 views

IPSec Example for a Password Authentication

I am trying to configure an ipsec (strongswan) vpn client to connect to my ISP-provided router's VPN. I only have a username and password, no certificates. In the documentation the provided (https://...
4 votes
4 answers
17k views

How can I route traffic over IPSec tunnel?

I have two sites: MAIN (local subnet 192.168.0.0/24, external IP: M.M.M.M) and CLIENT (10.0.0.0/24, external IP: C.C.C.C). I created an IPSec tunnel between the sites and both sites can ping computers ...
0 votes
1 answer
104 views

IPsec tunnel gets connected, Phase 2 is successful but no IP adapter is created thus tunnel does not work

I am trying to establish an IPsec tunnel between my virtual server and a customer's server. The IPsec tunnel gets established successfuly in Phase 2, but no IP gets added to my system. This is the ...
0 votes
0 answers
113 views

Achieve Keepalived VRRP in public cloud using Strongswan IPSec

I am trying to setup VRRP failover for PostgreSQL using Keepalived Active-Passive mode in one of the public clouds. The known limitation of this cloud is it does not work with VRRP out of the box (...
1 vote
0 answers
110 views

Configure number of RADIUS retransmits or timeout for Strongswan eap-radius

I have the following connection scheme: Site A (radius server) <--> Site B (gateway) <--> Roadwarrior (Bob) Site B uses eap-radius plugin for RADIUS Authentication and Accounting. ...
0 votes
0 answers
78 views

Intermittent connection problems for some users on StrongSwan VPN gateway

We have a VPN gateway using StrongSwan U5.9.10 and Rocky Linux 9.2 with 5.14.0-284 x86_64 kernel serving total of <200 Windows users. Split-tunneling is used. StrongSwan configuration was migrated ...
1 vote
1 answer
2k views

Cannot connect with Android native IKEv2 VPN client with Radius backend?

I can see that Android native VPN client supports IKEv2/MSCHAPv2, so in theory it should be possible to connect to Strongswan VPN server from Android without installing additional software (like the ...
0 votes
0 answers
118 views

Routing error in strongswan VTI config

I try to use strongswan to make tunnel between Server 1 and Server 2, and route traffic to specific host (8.8.8.8) through Server 2 using vti tunnel to make simple routes not ipsec polices. The ...
0 votes
0 answers
278 views

AWS StrongSwan IPSec Tunnel with Cisco fails during Phase 2 with TS_UNACCEPTABLE

I need to to setup a site-to-site IPSec tunnel with a vendor whom We need to access each other's API servers seating on the LANs using their respective Public IPs. We're using AWS, And I have ...
0 votes
0 answers
77 views

sometimes, vpn connection doesn't work on ipsec(strongswan) configuration

I'm using ipsec with strongswan between aws and on-premise here is strongswan configuration config setup uniqueids = no charondebug="ike 1, knl 1, cfg 0" conn %default ikelifetime=...
0 votes
1 answer
131 views

Android .sswan profile to ipsec.conf

I have a .sswan profile with an embedded cert and username/password from a server admin. It connects to a Watchguard VPN without any issues. I was told by the server admin I can connect with my ubuntu ...
0 votes
1 answer
235 views

Debian + Strongswan: does not pass traffic from the Internet to the tunnel

I'm trying to setup a remote VPN server to access the internet from my home PC. It is on a leased AWS VPS, with Debian and Strongswan. It is meant to receive my traffic via the tunnel, forward it to ...
0 votes
0 answers
174 views

Strongswan site to site with fortigate issue seems some thing about phase 2

Hello all, sorry to bother you guys, i already spend 3 days on it, still can not make it work, Could you take a look? Thank you in advance <3. fortigate info: Public ip: 41.223.XX.XX Internal ...
1 vote
1 answer
963 views

Ping across IPSec tunnel sends both ICMP and ESP packets

I've been using Strongswan to setup an IPSec tunnel between two units. The tunnels SAs get setup without any issues and traffic can pass across the connection. Whenever I ping across the tunnel, the ...
1 vote
0 answers
313 views

Dynamic traffic routing via multiple GRE over IPsec tunnels

Initial data I am learning networking based things and strongSwan proper configuration. Using my own wildcard ssl certificate. All tunnels are successfully lifted and authorized among themselves, ...
2 votes
3 answers
6k views

FreeRadius return User Groups in Class field

I use strongSwan to authenticate against FreeRadius which it does but now I need FreeRadius to return the user's groups in the Class field so they can be checked by strongSwan [1]. I'm using winbind ...
0 votes
0 answers
49 views

Strongwan S2S VPN to Fortinet

I want to hide my local hosted server behind a public VPS. So i established a VPN between my local firewall(fortinet) and my vps(strongswan). Diagram The VPN is up but no traffic at all. Even in ...
0 votes
0 answers
956 views

How to set up StrongSwan (behind NAT) IKEv2/IPSec with PSK (pre-shared key)?

I set up my strongswan server on a virtual Ubuntu 22 behind a NAT. It works well for RCA using login password. But I need to work using only PSK key. I tried a bunch of options, I can not connect from ...
1 vote
0 answers
4k views

How do I send the responder identity correctly in an IKEv2 site-to-site PSK vpn setup with Strongswan?

I'm trying to set up an IKEv2 site-to-site PSK vpn setup with legacy Strongswan /etc/ipsec.conf config setup charondebug="all" uniqueids=no strictcrlpolicy=no conn ikev2-vpn ...
0 votes
1 answer
613 views

Strongswan ike phase 1 failed: "IKE_SA being deleted"

I'm trying to build IPsec tunnel between my Strongswan cloud instance to the Cisco CSR 1000V which is from ISP. According to the form given to me, I have to configure with the following factors in ...
0 votes
1 answer
576 views

ipsec/strongswan - tunnel is up, traffic is sent and received but replies are ignored

I need some help, I set up a strongswan IPsec tunnel with ESP and IKEv2, the tunnel is UP and remote sees packets coming and answers them, but my server is ignoring? answers. The tunnel is between my ...
0 votes
1 answer
203 views

How to investigate not received TCP packets sent from VPN on the same LAN?

I'm setting up a VLAN on the cloud where many servers will connect to a remote host via VPN. The setup is as follows: Their Host d.d.d.72 | | ...
0 votes
0 answers
388 views

Ubuntu - IPSec VPN with Dual Stack / Strongswan

I'am trying to setup a IPSec VPN (ike1) for our Linux clients. But we need dual stack with ipv4 and ipv6. The endpoint is a Fortigate firewall. With two phase2, one for IPv4 and one for IPv6. The ...
0 votes
0 answers
131 views

Strongswan IPSEC specific rightsubnet

I have strongswan ipsec setup installed in ubuntu OS. I have static public ip 103.x.x.x and vpn clients subnet 10.100.100.2/24. I have 2 clients with ubuntu OS. I was able to ping client 1 to client 2 ...
0 votes
1 answer
342 views

Howto get server host into strongswans virtual IP address subnet

I have configured a VPN server and VPN client with strongswan with the following ipsec.conf configuration settings Server ipsec.conf conn ikev2-vpn also=rw-base auto=add compress=no ...
0 votes
1 answer
128 views

strongwan disable user access

Hwo can I disable access for a particular user with strongswan public key authentication? So I have pub key authentication working. the SAN is the email and is the id. Is there a way to reject ...
0 votes
0 answers
246 views

Simple Strongswan installation caused server to be unreachable through (Open)SSH

While working on a remote machine (Debian 11.7 / Kernel 5.10.0-23-amd64) I have installed Strongswan to configure it as a VPN client. apt install strongswan after this, the service strongswan-starter....
0 votes
0 answers
47 views

ipsec package after decrypted can not be recieved by tproxy

My centos6 machine ipaddress is 192.168.56.10 (eth0). I have installed strongswan and a tproxy like v2ray with iptables: iptables: *mangle :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :FORWARD ACCEPT [...
1 vote
0 answers
224 views

strongswan site to host example?

There are a million site-to-site and host-to-host examples. I can't seem to find a single site-to-host example. I am looking for the most basic possible example with no certificates at all, that just ...

1
2 3 4 5
9