24 votes
Accepted

IPsec for Linux - strongSwan vs Openswan vs Libreswan vs other(?)

It appears to me that StrongSwan and LibreSwan are the two main viable products now-a-days. strongswan vs openswan has one good comprehensive comment with some comparisons between StrongSwan and ...
user avatar
10 votes

How to enable debug logs in OpenSwan?

Required to add the configuration to file /etc/ipsec.conf # basic configuration config setup plutodebug=all plutostderrlog=/var/log/openswan.log
user avatar
  • 577
5 votes

openswan multiple subnets routing issue

When you use leftsubnets, you have to use rightsubnets, not rightsubnet. As stated on http://linux.die.net/man/5/ipsec.conf: If both a leftsubnets= and rightsubnets= is defined, all combinations ...
user avatar
  • 51
4 votes
Accepted

Site-to-Site IPsec vpn not sending ping across a tunnel

To me it sounds like you are trying to get the site-to-site tunnel gateways to communicate via their internal IP addresses instead of their public IP addresses. In order to do this using a single ...
user avatar
4 votes

FortiGate IPsec VPN: Configuring Multiple Phase 2 Connections (Multiple Subnets)

I cannot help you on the OpenSwan side, but I recently had to connect a Cyberoam to a Fortigate with multiple subnets as well. For each subnet, you can create another phase 2 (bound to the same phase ...
user avatar
  • 197
4 votes

openswan multiple subnets routing issue

This is due to a fault in the way AWS's implementation of IPSec handles SPIs (Security Parameters Indices). You can read about it in detail on libreswan's web site, but the upshot is that libreswan ...
user avatar
  • 77.9k
3 votes
Accepted

Two tunnels with same rightsubnet for StrongSWAN/OpenSWAN

As you may noticed in option 1 and option 2 of the increasing VPN throughput article, the Compute Engine VPN gateway or network automatically load balance the traffic to Peer VPN gateway(s). For ...
user avatar
  • 1,415
3 votes

Can't get past "pending Phase 2" on OpenSWAN <-> ISA Server IPSec VPN

I've came across this situation in recent days. It was due to two issues. Firewall Kernal IP forwarding disabled Preshared-key mismatch For firewall, it turns out port 500 and 4500 were blocked. By ...
user avatar
3 votes

StrongSwan IPsec PING only working once after ipsec restart

Try exempting the IPsec traffic from your MASQUERADE rule: sudo iptables -t nat -I POSTROUTING -o eth0 -m policy --pol ipsec --dir out -j ACCEPT
user avatar
  • 3,650
2 votes

Connecting to IPSec/L2tp with OpenSwan/xl2tpd from Windows7 to Amazon EC2

I'm running openswan in EC2 with a similar setup, and windows clients are able to connect without issue. Not sure exactly what the issue is, but here are some of the differences between my configs and ...
user avatar
  • 211
2 votes

Simple L2TP/IPsec server not working (openswan, xl2tpd, Ubuntu, Windows)

I had similar problem. My server doesn't NAT, so this piece is not needed so removed it: conn L2TP-PSK-NAT rightsubnet=vhost:%priv also=L2TP-PSK-noNAT And when that's done NAT Traversel must be set ...
user avatar
  • 377
2 votes

IPSec + L2TP + NAT-Traversal does not work for multiple clients behind same nat

IPSEC is very sensitive to NATted clients. You need to read about how to enable NAT traversal features on both clients and server. Out of the box it may detect only the public IP of the NATted clients ...
user avatar
  • 161
2 votes

Openswan Cisco ASA 9.1 -- cannot resopnd to IPsec SA request because no connection is known for

Ok, so I beliveve I figured it out. So even though my Openswan box is not behind a NAT, and has a direct NIC with a public IP I had to turn on NAT-Traversal. With this in mind I had to add ...
user avatar
  • 978
2 votes

How to start and stop a libreswan connection

auto=ondemand means "trigger when there is a need for the tunnel based on a packet". So it will load and wait on the first packet, then bring up the tunnel. If you only want to bring it up manually, ...
user avatar
2 votes
Accepted

IPSec Tunnel goes down during long periods of inactivity

Assuming you're using a setup similar to Openswan's ec2 example , try setting lifetime=1800 rekey=yes but only on the initiating end. This will set SA expiry and renegotiate to every 30 minutes.
user avatar
  • 361
2 votes
Accepted

Tunnel is up but I can't ping

Because Comcast uses NAT for their entire network (your 10.0.0.0/8 address here) you will need to enable nat_traversal for this connection when using Comcast. The reason for this is because IPSEC ...
user avatar
  • 19.2k
2 votes
Accepted

IPSec tunnel fails in phase 2

Below are the steps to get this working. You need to update the route table with interface ID of your VPN Server. So that all traffic from your FTP Server reach the right subnet via VPN Host i.e {144....
user avatar
1 vote
Accepted

Can't establish site to site vpn connection between Cisco 3900 and strongSwan client

Finally i found solution for my problem, it was only configuration issue. instead of auto=add there must be auto=start and esp=aes256-sha1 must be esp=aes256-sha1-modp1536 I also added db ...
user avatar
  • 21
1 vote

Connecting to a FortiGate VPN from a remote Linux machine via OpenSwan

If you're not tied to OpenSwan, here's a discussion on how to connect to FortiGate via an IPsec VPN tunnel using the strongSwan client (no DNS, though). Authentication is done using a preshared key ...
user avatar
1 vote
Accepted

Malformed Payload recieved from juniper firewall to libreswan while setting up an IPSec Tunnel

I found the libreswan documentation helpful here concerning interop with Juniper. I feel your pain. VPN's are notoriously difficult to get just right. The seemingly smallest thing can render the ...
user avatar
  • 128
1 vote

OpenSwan on Amazon EC2 - max number of retransmissions reached STATE_MAIN_I3. Possible authentication failure:

Not sure, if it relevant any more, but we are regularly experiencing similar errors on our VPN server (also hosted on AWS). Normally restarting the services with these commands solves the problem: /...
user avatar
  • 11
1 vote

Can't ping public endpoints when IPSec tunnel is up

I'm not entirely familiar with the xfrm syntax, but it looks like : When your VPN is not up, you have a default route to the Internet, so you can ping the way you expect Once the VPN comes up, the ...
user avatar
1 vote

CentOS 7 ipsec hardware rngd erorr

The problem is the rngd-tools installed by the yum would not read the environment file /etc/sysconfig/rngd. open /usr/lib/systemd/system/rngd.service, add -r /dev/urandom to the ExecStart. ExecStart=...
user avatar
  • 2,887
1 vote

How to deny connections to xl2tp without ipsec encryption?

I've posted this question to xl2tpd team on GitHub, this is the answer (checked and worked on my setup): You can use the iptables policy module like this: iptables -A INPUT -p udp --dport 1701 -m ...
user avatar
1 vote

IP Addresses over IPSec

Looks like B is changing the IP SRC header field to it's own address. Could be a result of working NAT. Check your packet filter for any translation rules and modify them accordingly.
user avatar
  • 7,954
1 vote
Accepted

Clients cannot connect to L2TP server on Ubuntu 12.04 & 14.04 LTS

For Windows users, a registry change is required to be able to connect to an IPsec/L2TP VPN behind NAT (e.g. in EC2). Please follow these instructions. Scroll down to the bottom to view separate steps ...
user avatar
  • 171
1 vote

IPsec VPN Site-to-Site: Unable to reach hosts on same subnet as gateway

Turned out to be a problem in the VPC routing tables. The public subnet routing table was not routing traffic destined for the office subnet back to 10.0.0.0/24.
user avatar
1 vote

openswan multiple subnets routing issue

Try using: leftsubnets={10.43.4.0/24,10.43.6.0/24,} instead of: leftsubnets={10.43.4.0/24 10.43.6.0/24} Note: Add two commas. After first and last too.
user avatar
1 vote

Openswan + xl2tpd connections time out after a while

In your /etc/ppp/options.xl2tpd file you have 'idle 1800', that is 30 minutes. You could try setting that value to a higher number or do something terrible like the following: while true; do echo "c ...
user avatar
  • 11
1 vote

IPSEC Tunnel with OpenSwan on Ubuntu <-> CISCO Router

I have had this problem before -- and if your tunnel is up correctly and the Cisco side is pinging through into the 192.168 network, it means your tunnel is up and passing traffic. If you can't ping ...
user avatar
  • 931

Only top scored, non community-wiki answers of a minimum length are eligible