24
votes
Accepted
IPsec for Linux - strongSwan vs Openswan vs Libreswan vs other(?)
It appears to me that StrongSwan and LibreSwan are the two main viable products now-a-days. strongswan vs openswan has one good comprehensive comment with some comparisons between StrongSwan and ...
10
votes
How to enable debug logs in OpenSwan?
Required to add the configuration to file /etc/ipsec.conf
# basic configuration
config setup
plutodebug=all
plutostderrlog=/var/log/openswan.log
4
votes
openswan multiple subnets routing issue
This is due to a fault in the way AWS's implementation of IPSec handles SPIs (Security Parameters Indices). You can read about it in detail on libreswan's web site, but the upshot is that libreswan ...
3
votes
StrongSwan IPsec PING only working once after ipsec restart
Try exempting the IPsec traffic from your MASQUERADE rule:
sudo iptables -t nat -I POSTROUTING -o eth0 -m policy --pol ipsec --dir out -j ACCEPT
3
votes
Accepted
Tunnel is up but I can't ping
Because Comcast uses NAT for their entire network (your 10.0.0.0/8 address here) you will need to enable nat_traversal for this connection when using Comcast.
The reason for this is because IPSEC ...
2
votes
Simple L2TP/IPsec server not working (openswan, xl2tpd, Ubuntu, Windows)
I had similar problem.
My server doesn't NAT, so this piece is not needed so removed it:
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
And when that's done NAT Traversel must be set ...
2
votes
How to start and stop a libreswan connection
auto=ondemand means "trigger when there is a need for the tunnel based on a packet". So it will load and wait on the first packet, then bring up the tunnel.
If you only want to bring it up manually, ...
2
votes
Accepted
IPSec Tunnel goes down during long periods of inactivity
Assuming you're using a setup similar to Openswan's ec2 example , try setting
lifetime=1800
rekey=yes
but only on the initiating end. This will set SA expiry and renegotiate to every 30 minutes.
2
votes
Accepted
IPSec tunnel fails in phase 2
Below are the steps to get this working.
You need to update the route table with interface ID of your VPN Server. So that all traffic from your FTP Server reach the right subnet via VPN Host i.e {144....
1
vote
How to clear Openswan logs?
You need to first find out if company policy requires to preserve the log file for auditing purposes. Depending on that, you can either remove the file or archive it.
If it is free to delete, you can ...
1
vote
Connecting strongswan to badly configured openswan
Your problem is that you didn't specify rightid, in which case it defaults to the remote's IP address. Since that usually is not contained as subjectAltName in the certificate the authentication will ...
1
vote
OpenSwan IPsec tunnel to Azure Gateway is established but unable to connect
I tried your IPsec.conf file on my CentOS. It works for me. The version of
libreswan installed on my box is 3.15.
To troubleshoot this issue, please follow the steps below:
Verify if the VPN ...
1
vote
Accepted
Openswan server not routing traffic to LAN instances
Following iptable rules make it work.
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i ...
1
vote
Openswan/IPtables: Faking a unique IP address over VPN tunnel
You can set multiple internal static IP addresses for every VM instance using Google Compute Engine routes. For the steps visit this article.
1
vote
Connecting to Meraki Client VPN from Ubuntu w strongswan and xl2tpd
You need to disable xl2tpd sometimes as it runs and hogs port 1701 while the VPN client will normally start a service on 1701 only as needed.
I discovered this while I followed this answer quoted ...
1
vote
Accepted
Can't establish site to site vpn connection between Cisco 3900 and strongSwan client
Finally i found solution for my problem, it was only configuration issue.
instead of auto=add there must be auto=start and esp=aes256-sha1 must be esp=aes256-sha1-modp1536
I also added db ...
1
vote
Connecting to a FortiGate VPN from a remote Linux machine via OpenSwan
If you're not tied to OpenSwan, here's a discussion on how to connect to FortiGate via an IPsec VPN tunnel using the strongSwan client (no DNS, though).
Authentication is done using a preshared key ...
1
vote
How to enable debug logs in OpenSwan?
Although it is an old question, plutodebug is deprecated. charondebug must be used. See https://wiki.strongswan.org/projects/strongswan/wiki/ConfigSetupSection for the differences.
1
vote
Accepted
Malformed Payload recieved from juniper firewall to libreswan while setting up an IPSec Tunnel
I found the libreswan documentation helpful here concerning interop with Juniper.
I feel your pain. VPN's are notoriously difficult to get just right. The seemingly smallest thing can render the ...
1
vote
Accepted
openSwan VPN is up can't ping remote subnet
Finally fixed this issue.
Here's what I did:
In the ipsec.conf file, I had to comment out the leftprotoport which was set to
leftprotoport=17/1701
This essentially limits the vpn connection to ...
1
vote
OpenSwan on Amazon EC2 - max number of retransmissions reached STATE_MAIN_I3. Possible authentication failure:
Not sure, if it relevant any more, but we are regularly experiencing similar errors on our VPN server (also hosted on AWS).
Normally restarting the services with these commands solves the problem:
/...
1
vote
How to deny connections to xl2tp without ipsec encryption?
I've posted this question to xl2tpd team on GitHub, this is the answer (checked and worked on my setup):
You can use the iptables policy module like this:
iptables -A INPUT -p udp --dport 1701 -m ...
1
vote
openswan multiple subnets routing issue
Try using:
leftsubnets={10.43.4.0/24,10.43.6.0/24,}
instead of:
leftsubnets={10.43.4.0/24 10.43.6.0/24}
Note: Add two commas. After first and last too.
1
vote
Openswan + xl2tpd connections time out after a while
In your /etc/ppp/options.xl2tpd file you have 'idle 1800', that is 30 minutes.
You could try setting that value to a higher number or do something terrible like the following:
while true; do echo "c ...
1
vote
L2TP over IPSec VPN with OpenSwan and XL2TPD can't connect, timeout on Centos 6
Check that your network is working properly the data rate of sent and recieved packets is also responding or not, sometimes due to connection lost or some other problem this problem is caused.
1
vote
How do I configure a Linux VPN Client to get into a network through a Fortigate firewall?
I suggest you check out Openfortivpn. I had to resort to that, as our implementation of fortigate VPN doesn't have a functioning linux client. OpenfortiVPN works great for me:
sudo openfortivpn -c /...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
openswan × 130ipsec × 90
vpn × 60
linux × 22
site-to-site-vpn × 14
iptables × 13
centos × 12
ubuntu × 10
amazon-web-services × 10
xl2tpd × 10
strongswan × 8
linux-networking × 7
l2tp × 7
networking × 6
amazon-ec2 × 6
routing × 6
nat × 5
fortigate × 5
cisco × 4
amazon-vpc × 4
firewall × 3
centos6 × 3
ubuntu-14.04 × 3
cisco-asa × 3
isakmp × 3