Questions tagged [strongswan]
strongSwan is an open source, multi-platform IPsec-based VPN solution, with IKEv2 & IKEv1 support
450
questions
1
vote
1
answer
7k
views
xl2tp + strongswan ipsec -- xl2tp timeout
I'm trying to connect to a ipsec/l2tp vpn from a private network behind a nat-router. It works from different windows clients, but from my linux machine (openSuSE 12.3, strongswan 5.1.3, xl2tp 1.3.0) ...
0
votes
1
answer
24
views
Resolve failing for %any in strongswan ipsec
I was configuring ipsec between 2 linux boxes.
Since ip of our product can be different when connected to different spaces. I used %any for right.
Since then, I am not able to up my ipsec transport ...
0
votes
2
answers
6k
views
Setup l2tp using Strongswan
I setup ikev2 using Strongswan, Now I need to add l2tp support to that
What is the best and easy method to add l2tp support to Strongswan?
Appreciate for any help
1
vote
1
answer
14k
views
establishing IKE_SA failed, peer not responding
I'm new with this VPN things. I'm using Strongswan 5.8.2 with swan config for establish my SA and using PSK. Im integrating with a company to provide me some services and they gave me a gateway server ...
8
votes
0
answers
1k
views
How to limit bandwidth per VPN connection?
I have a StrongSwan (IKEv2) server setup and would like to limit each VPN connection to 512kb/s.
After researching I came across tc in Ubuntu. I don't quite understand it and am fighting through the ...
0
votes
0
answers
42
views
strongSwan: Accessing LAN of a Windows client (reversed remote access)
I am currently having an Ubuntu Server strongSwan setup (IKEv2, EAP-MSCHAPv2) that will allow any authorized remote Windows client to access server's LAN (192.168.7.0/24). It works perfectly, but I ...
0
votes
0
answers
21
views
Is iptables NAT forwarding possible bewteen two libvirt VMs?
I'm building a test VPN setup using two libvirt VMs with StrongSwan
IKEv2 but can't get traffic to forward. I can see the client sending
traffic to the server using tcpdump but the server doesn't do
...
5
votes
1
answer
7k
views
strongswan VPN on OpenWrt
Hi I'm running Barrier Breaker version of OpenWRT and I have setup a VPN according to:
http://wiki.openwrt.org/inbox/strongswan.howto
I can connect to the VPN with my iPhone or Mac (to 10.10.1.0/24 ...
1
vote
1
answer
98
views
Strongswan IPsec site-to-site on Gcloud
I am trying to initialise an IPsec tunnel between an Ubuntu VM on Google Cloud and a remote site.
The connection is correctly established but from the Ubuntu machine on Google Cloud I cannot reach a ...
0
votes
0
answers
28
views
Site-to-site VPN jump through 2 tunnels
I have 3 networks like on the below diagram:
network
Subnet A: 10.0.1.0/24, public IP of VPN Gateway: 55.0.0.1
Subnet B: 172.30.0.0/24, public IP of VPN Gateway: 66.0.0.1
Subnet C: 172.20.0.0/24, ...
0
votes
2
answers
5k
views
Strongswan IKEv2 for iOS devices
I want to connect a Strongswan IKEv2 VPN on iOS devices. It uses FreeRADIUS server for AAA of users.
It's already working perfectly on Android and Windows devices. but when I try to connect using ...
1
vote
1
answer
5k
views
Check if Remote Server Port is Blocking my IKEv2/IPSec VPN Connections
I am using StrongSwan on Ubuntu to try to establish a site-to-site VPN connection to a remote IKEv2 IPSec VPN server, but it appears that my connection requests are not reaching the remote server.
Is ...
0
votes
0
answers
53
views
Unable to acces on some websites when connected to VPN IKEv2 server from linux
I have a VPN server hosted on Windows 2019 and configured on IKEv2,
Everything works very well from all clients, however on Linux clients I have one last point to adjust, so for clarification I use ...
0
votes
1
answer
364
views
Strongswan on host, docker container unable to pass through
This is my first time posting here, so i'll do my best to explain.
I installed an IPSec tunnel on my host (Ubuntu 22.04) using strongswan (bypass-lan plugin). The connection is up and stable, ...
0
votes
0
answers
97
views
StrongSwan IPSec VPN - IKEv2 - LetsEncrypt Certificate Issue (building CRED_PRIVATE_KEY - RSA failed, tried 10 builders)
I followed the link below for setup IKEv2 VPN Using Strongswan and Let's encrypt on CentOS 7.
How to Setup IKEv2 VPN Using Strongswan and Let's encrypt on CentOS 7
But info on that link has been ...
0
votes
0
answers
25
views
The IPSec connection has been successfully established. I can only ping the remote endpoint, but cannot ping the entire subnet
server A:
enter image description here
config setup
charondebug="all"
uniqueids=yes
conn home-to-aliyun
ikelifetime=36000s
keylife=8h
rekeymargin=3m
...
0
votes
2
answers
248
views
Strongswan VPN from Windows 10: no private key found / 13801
I am evaluating AWS starting with connectivity. As AWS VPN solutions would be cumulatively expensive, I thought I'd start DIY with Strongswan. I already have Strongswan working for our site-to-site (...
0
votes
0
answers
91
views
S2S VPN - cannot ping B from A until A pings B
I'm working on site-to-site VPN between 2 networks within private cloud. On both ends I installed Strongswan and established VPN connection.
The problem is that I'm not able to ping from A (10.0.1.0/...
1
vote
1
answer
122
views
Strongswan VPN to AWS / connectivity issue / No response back to ping
I create a VPN between an ec2 with strongswan and aws vpn connection attached to a vpn gateway with dynamic routing (bgp).
Tunnel is UP. Ping is OK in one way DEST TO CLIENT but not the other way.
Can ...
0
votes
0
answers
58
views
Strange routing behaviour when using NetworkManager with strongswan for IKE from docker
I have a situation that is causing me a problem:
I historically had a VPN server which provided the L2TP connection, I upgraded it to IKEv2.
This is going well, multi-platform clients access it ...
0
votes
1
answer
105
views
IPv6 route based VPN client with Strongswan, packets arrive but not received by application
I'm trying to set up a linux client PC with a route based VPN tunnel using strongswan and an XFRM interface, with IPv6 (end to end).
strongswan 5.8.2, linux kernel 5.15.0
[An aside - I've tried an ...
0
votes
0
answers
348
views
IPSec Example for a Password Authentication
I am trying to configure an ipsec (strongswan) vpn client to connect to my ISP-provided router's VPN.
I only have a username and password, no certificates.
In the documentation the provided (https://...
4
votes
4
answers
17k
views
How can I route traffic over IPSec tunnel?
I have two sites: MAIN (local subnet 192.168.0.0/24, external IP: M.M.M.M) and CLIENT (10.0.0.0/24, external IP: C.C.C.C). I created an IPSec tunnel between the sites and both sites can ping computers ...
0
votes
1
answer
104
views
IPsec tunnel gets connected, Phase 2 is successful but no IP adapter is created thus tunnel does not work
I am trying to establish an IPsec tunnel between my virtual server and a customer's server. The IPsec tunnel gets established successfuly in Phase 2, but no IP gets added to my system.
This is the ...
0
votes
0
answers
113
views
Achieve Keepalived VRRP in public cloud using Strongswan IPSec
I am trying to setup VRRP failover for PostgreSQL using Keepalived Active-Passive mode in one of the public clouds. The known limitation of this cloud is it does not work with VRRP out of the box (...
1
vote
0
answers
110
views
Configure number of RADIUS retransmits or timeout for Strongswan eap-radius
I have the following connection scheme:
Site A (radius server) <--> Site B (gateway) <--> Roadwarrior (Bob)
Site B uses eap-radius plugin for RADIUS Authentication and Accounting.
...
0
votes
0
answers
78
views
Intermittent connection problems for some users on StrongSwan VPN gateway
We have a VPN gateway using StrongSwan U5.9.10 and Rocky Linux 9.2 with 5.14.0-284 x86_64 kernel serving total of <200 Windows users. Split-tunneling is used.
StrongSwan configuration was migrated ...
1
vote
1
answer
2k
views
Cannot connect with Android native IKEv2 VPN client with Radius backend?
I can see that Android native VPN client supports IKEv2/MSCHAPv2, so in theory it should be possible to connect to Strongswan VPN server from Android without installing additional software (like the ...
0
votes
0
answers
118
views
Routing error in strongswan VTI config
I try to use strongswan to make tunnel between Server 1 and Server 2, and route traffic to specific host (8.8.8.8) through Server 2 using vti tunnel to make simple routes not ipsec polices.
The ...
0
votes
0
answers
278
views
AWS StrongSwan IPSec Tunnel with Cisco fails during Phase 2 with TS_UNACCEPTABLE
I need to to setup a site-to-site IPSec tunnel with a vendor whom We need to access each other's API servers seating on the LANs using their respective Public IPs. We're using AWS, And I have ...
0
votes
0
answers
77
views
sometimes, vpn connection doesn't work on ipsec(strongswan) configuration
I'm using ipsec with strongswan between aws and on-premise
here is strongswan configuration
config setup
uniqueids = no
charondebug="ike 1, knl 1, cfg 0"
conn %default
ikelifetime=...
0
votes
1
answer
131
views
Android .sswan profile to ipsec.conf
I have a .sswan profile with an embedded cert and username/password from a server admin. It connects to a Watchguard VPN without any issues. I was told by the server admin I can connect with my ubuntu ...
0
votes
1
answer
235
views
Debian + Strongswan: does not pass traffic from the Internet to the tunnel
I'm trying to setup a remote VPN server to access the internet from my home PC. It is on a leased AWS VPS, with Debian and Strongswan. It is meant to receive my traffic via the tunnel, forward it to ...
0
votes
0
answers
174
views
Strongswan site to site with fortigate issue seems some thing about phase 2
Hello all, sorry to bother you guys, i already spend 3 days on it,
still can not make it work, Could you take a look? Thank you in
advance <3.
fortigate info:
Public ip: 41.223.XX.XX
Internal ...
1
vote
1
answer
963
views
Ping across IPSec tunnel sends both ICMP and ESP packets
I've been using Strongswan to setup an IPSec tunnel between two units. The tunnels SAs get setup without any issues and traffic can pass across the connection.
Whenever I ping across the tunnel, the ...
1
vote
0
answers
313
views
Dynamic traffic routing via multiple GRE over IPsec tunnels
Initial data
I am learning networking based things and strongSwan proper configuration.
Using my own wildcard ssl certificate.
All tunnels are successfully lifted and authorized among themselves, ...
2
votes
3
answers
6k
views
FreeRadius return User Groups in Class field
I use strongSwan to authenticate against FreeRadius which it does but now I need FreeRadius to return the user's groups in the Class field so they can be checked by strongSwan [1].
I'm using winbind ...
0
votes
0
answers
49
views
Strongwan S2S VPN to Fortinet
I want to hide my local hosted server behind a public VPS. So i established a VPN between my local firewall(fortinet) and my
vps(strongswan).
Diagram
The VPN is up but no traffic at all. Even in ...
0
votes
0
answers
956
views
How to set up StrongSwan (behind NAT) IKEv2/IPSec with PSK (pre-shared key)?
I set up my strongswan server on a virtual Ubuntu 22 behind a NAT. It works well for RCA using login password.
But I need to work using only PSK key. I tried a bunch of options, I can not connect from ...
1
vote
0
answers
4k
views
How do I send the responder identity correctly in an IKEv2 site-to-site PSK vpn setup with Strongswan?
I'm trying to set up an IKEv2 site-to-site PSK vpn setup with legacy Strongswan
/etc/ipsec.conf
config setup
charondebug="all"
uniqueids=no
strictcrlpolicy=no
conn ikev2-vpn
...
0
votes
1
answer
613
views
Strongswan ike phase 1 failed: "IKE_SA being deleted"
I'm trying to build IPsec tunnel between my Strongswan cloud instance to the Cisco CSR 1000V which is from ISP.
According to the form given to me, I have to configure with the following factors in ...
0
votes
1
answer
576
views
ipsec/strongswan - tunnel is up, traffic is sent and received but replies are ignored
I need some help, I set up a strongswan IPsec tunnel with ESP and IKEv2, the tunnel is UP and remote sees packets coming and answers them, but my server is ignoring? answers.
The tunnel is between my ...
0
votes
1
answer
203
views
How to investigate not received TCP packets sent from VPN on the same LAN?
I'm setting up a VLAN on the cloud where many servers will connect to a remote host via VPN. The setup is as follows:
Their Host d.d.d.72
|
|
...
0
votes
0
answers
388
views
Ubuntu - IPSec VPN with Dual Stack / Strongswan
I'am trying to setup a IPSec VPN (ike1) for our Linux clients. But we need dual stack with ipv4 and ipv6.
The endpoint is a Fortigate firewall. With two phase2, one for IPv4 and one for IPv6. The ...
0
votes
0
answers
131
views
Strongswan IPSEC specific rightsubnet
I have strongswan ipsec setup installed in ubuntu OS. I have static public ip 103.x.x.x and vpn clients subnet 10.100.100.2/24. I have 2 clients with ubuntu OS. I was able to ping client 1 to client 2 ...
0
votes
1
answer
342
views
Howto get server host into strongswans virtual IP address subnet
I have configured a VPN server and VPN client with strongswan with the following ipsec.conf configuration settings
Server ipsec.conf
conn ikev2-vpn
also=rw-base
auto=add
compress=no
...
0
votes
1
answer
128
views
strongwan disable user access
Hwo can I disable access for a particular user with strongswan public key authentication?
So I have pub key authentication working. the SAN is the email and is the id. Is there a way to reject ...
0
votes
0
answers
246
views
Simple Strongswan installation caused server to be unreachable through (Open)SSH
While working on a remote machine (Debian 11.7 / Kernel 5.10.0-23-amd64) I have installed Strongswan to configure it as a VPN client.
apt install strongswan
after this, the service strongswan-starter....
0
votes
0
answers
47
views
ipsec package after decrypted can not be recieved by tproxy
My centos6 machine ipaddress is 192.168.56.10 (eth0). I have installed strongswan and a tproxy like v2ray with iptables:
iptables:
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [...
1
vote
0
answers
224
views
strongswan site to host example?
There are a million site-to-site and host-to-host examples. I can't seem to find a single site-to-host example. I am looking for the most basic possible example with no certificates at all, that just ...