24 votes
Accepted

IPsec for Linux - strongSwan vs Openswan vs Libreswan vs other(?)

It appears to me that StrongSwan and LibreSwan are the two main viable products now-a-days. strongswan vs openswan has one good comprehensive comment with some comparisons between StrongSwan and ...
Raymond Burkholder's user avatar
10 votes

How to enable debug logs in OpenSwan?

Required to add the configuration to file /etc/ipsec.conf # basic configuration config setup plutodebug=all plutostderrlog=/var/log/openswan.log
Michael's user avatar
  • 597
4 votes

openswan multiple subnets routing issue

This is due to a fault in the way AWS's implementation of IPSec handles SPIs (Security Parameters Indices). You can read about it in detail on libreswan's web site, but the upshot is that libreswan ...
MadHatter's user avatar
  • 80.6k
3 votes

StrongSwan IPsec PING only working once after ipsec restart

Try exempting the IPsec traffic from your MASQUERADE rule: sudo iptables -t nat -I POSTROUTING -o eth0 -m policy --pol ipsec --dir out -j ACCEPT
ecdsa's user avatar
  • 4,103
3 votes
Accepted

Tunnel is up but I can't ping

Because Comcast uses NAT for their entire network (your 10.0.0.0/8 address here) you will need to enable nat_traversal for this connection when using Comcast. The reason for this is because IPSEC ...
DerfK's user avatar
  • 19.7k
2 votes

Simple L2TP/IPsec server not working (openswan, xl2tpd, Ubuntu, Windows)

I had similar problem. My server doesn't NAT, so this piece is not needed so removed it: conn L2TP-PSK-NAT rightsubnet=vhost:%priv also=L2TP-PSK-noNAT And when that's done NAT Traversel must be set ...
user66638's user avatar
  • 377
2 votes

How to start and stop a libreswan connection

auto=ondemand means "trigger when there is a need for the tunnel based on a packet". So it will load and wait on the first packet, then bring up the tunnel. If you only want to bring it up manually, ...
Paul Wouters's user avatar
2 votes
Accepted

IPSec Tunnel goes down during long periods of inactivity

Assuming you're using a setup similar to Openswan's ec2 example , try setting lifetime=1800 rekey=yes but only on the initiating end. This will set SA expiry and renegotiate to every 30 minutes.
FoamyBeer's user avatar
  • 371
2 votes
Accepted

IPSec tunnel fails in phase 2

Below are the steps to get this working. You need to update the route table with interface ID of your VPN Server. So that all traffic from your FTP Server reach the right subnet via VPN Host i.e {144....
Chandan Singh's user avatar
1 vote

How to clear Openswan logs?

You need to first find out if company policy requires to preserve the log file for auditing purposes. Depending on that, you can either remove the file or archive it. If it is free to delete, you can ...
Tero Kilkanen's user avatar
1 vote

Connecting strongswan to badly configured openswan

Your problem is that you didn't specify rightid, in which case it defaults to the remote's IP address. Since that usually is not contained as subjectAltName in the certificate the authentication will ...
ecdsa's user avatar
  • 4,103
1 vote

OpenSwan IPsec tunnel to Azure Gateway is established but unable to connect

I tried your IPsec.conf file on my CentOS. It works for me. The version of libreswan installed on my box is 3.15. To troubleshoot this issue, please follow the steps below: Verify if the VPN ...
Steven Lee - MSFT's user avatar
1 vote
Accepted

Openswan server not routing traffic to LAN instances

Following iptable rules make it work. iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE iptables -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i ...
xs2rashid's user avatar
  • 204
1 vote

Openswan/IPtables: Faking a unique IP address over VPN tunnel

You can set multiple internal static IP addresses for every VM instance using Google Compute Engine routes. For the steps visit this article.
Kamran's user avatar
  • 1,425
1 vote

Connecting to Meraki Client VPN from Ubuntu w strongswan and xl2tpd

You need to disable xl2tpd sometimes as it runs and hogs port 1701 while the VPN client will normally start a service on 1701 only as needed. I discovered this while I followed this answer quoted ...
dragon788's user avatar
  • 836
1 vote
Accepted

Can't establish site to site vpn connection between Cisco 3900 and strongSwan client

Finally i found solution for my problem, it was only configuration issue. instead of auto=add there must be auto=start and esp=aes256-sha1 must be esp=aes256-sha1-modp1536 I also added db ...
iss_628's user avatar
  • 21
1 vote

Connecting to a FortiGate VPN from a remote Linux machine via OpenSwan

If you're not tied to OpenSwan, here's a discussion on how to connect to FortiGate via an IPsec VPN tunnel using the strongSwan client (no DNS, though). Authentication is done using a preshared key ...
Matthias Braun's user avatar
1 vote

How to enable debug logs in OpenSwan?

Although it is an old question, plutodebug is deprecated. charondebug must be used. See https://wiki.strongswan.org/projects/strongswan/wiki/ConfigSetupSection for the differences.
Coanda's user avatar
  • 141
1 vote
Accepted

Malformed Payload recieved from juniper firewall to libreswan while setting up an IPSec Tunnel

I found the libreswan documentation helpful here concerning interop with Juniper. I feel your pain. VPN's are notoriously difficult to get just right. The seemingly smallest thing can render the ...
boweeb's user avatar
  • 128
1 vote
Accepted

openSwan VPN is up can't ping remote subnet

Finally fixed this issue. Here's what I did: In the ipsec.conf file, I had to comment out the leftprotoport which was set to leftprotoport=17/1701 This essentially limits the vpn connection to ...
Oladipo Olasemo's user avatar
1 vote

OpenSwan on Amazon EC2 - max number of retransmissions reached STATE_MAIN_I3. Possible authentication failure:

Not sure, if it relevant any more, but we are regularly experiencing similar errors on our VPN server (also hosted on AWS). Normally restarting the services with these commands solves the problem: /...
Max's user avatar
  • 11
1 vote

How to deny connections to xl2tp without ipsec encryption?

I've posted this question to xl2tpd team on GitHub, this is the answer (checked and worked on my setup): You can use the iptables policy module like this: iptables -A INPUT -p udp --dport 1701 -m ...
truongtx's user avatar
1 vote

openswan multiple subnets routing issue

Try using: leftsubnets={10.43.4.0/24,10.43.6.0/24,} instead of: leftsubnets={10.43.4.0/24 10.43.6.0/24} Note: Add two commas. After first and last too.
Rajesh Gupta's user avatar
1 vote

Openswan + xl2tpd connections time out after a while

In your /etc/ppp/options.xl2tpd file you have 'idle 1800', that is 30 minutes. You could try setting that value to a higher number or do something terrible like the following: while true; do echo "c ...
ic_'s user avatar
  • 11
1 vote

L2TP over IPSec VPN with OpenSwan and XL2TPD can't connect, timeout on Centos 6

Check that your network is working properly the data rate of sent and recieved packets is also responding or not, sometimes due to connection lost or some other problem this problem is caused.
marlin putnam's user avatar
1 vote

How do I configure a Linux VPN Client to get into a network through a Fortigate firewall?

I suggest you check out Openfortivpn. I had to resort to that, as our implementation of fortigate VPN doesn't have a functioning linux client. OpenfortiVPN works great for me: sudo openfortivpn -c /...
Jarmund's user avatar
  • 535

Only top scored, non community-wiki answers of a minimum length are eligible