22 votes
Accepted

What is the difference between AWS site-to-site VPN and AWS client VPN?

In general the protocol doesn't have much to do with it. You can have IPSec tunnels in both site-to-site or client (aka road warrior) configurations, just like you can have OpenVPN (TLS) tunnels in ...
MLu's user avatar
  • 25.5k
8 votes
Accepted

Site-to-site IPSec routing (Ubuntu, StrongSwan)

We have used tcpdump to examine traffic in and out of the two firewall nodes. I note in passing that tcpdump with {Open,Libre,Strong}S/WAN in a modern kernel can be a bit problematic, because on the ...
MadHatter's user avatar
  • 80.6k
5 votes

Openvpn routing for lan to lan through tun

OP posted the answer on forums.openvpn.net Use this server config: port 1194 proto udp dev tun topology subnet mode server tls-server server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt # ...
Tim Penner's user avatar
  • 1,929
5 votes
Accepted

Client packets not forwarded over strongSwan IPsec site-to-site tunnel for client and gateway on the same server

IPsec traffic should be routed, you probably hit the default NAT issue of the default NAT rule affecting IPsec traffic. The remedy is: iptables -t nat -I POSTROUTING 1 -m policy --pol ipsec --dir out ...
Vesper's user avatar
  • 814
5 votes
Accepted

Fixing 70% transfer speed slowdown over VPN compared as compared to SSH? (Tested OpenVPN, IPSec/L2TP, OpenSSH, SoftEther)

Given the link posted in the comments, I decided to take another look at this openvpn article: https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux I was able to achieve ~150Mbit/s ...
Gbps's user avatar
  • 161
4 votes

Can I automatically ROUTE ADD xxxx after i make a VPN connection in Windows 7?

netsh interface ipv4 add route [destination/prefixlength] "[interface/connection name]" I'm using that to deal with connections that have subnet overlap by adding static routes for hosts on the ...
Stuart Smith's user avatar
4 votes

Client packets not forwarded over strongSwan IPsec site-to-site tunnel for client and gateway on the same server

If you have any NAT rules configured, like MASQUERADE via --add-masquerade, you have to exclude traffic that matches an IPsec policy from getting natted. Otherwise that traffic will just get natted to ...
ecdsa's user avatar
  • 4,102
4 votes
Accepted

Best practice for Domain Controller

It depends. As you already know, if the site-to-site VPN drops your office computers will not be able to reach your domain controller: that will mean not only authentication issues, but that almost ...
Massimo's user avatar
  • 71.3k
4 votes
Accepted

How large does site-to-site VPN subnet need to be?

A site-to-site VPN usually is fully routed network. Meaning there is no NAT or anything. The subnet used for the VPN only needs addresses for the connected routers. So the minimum size of the ...
Zoredache's user avatar
  • 132k
3 votes
Accepted

Change Route Based S2S to Policy Based

Is it possible to convert the route based to policy based? No,you could not covert route-based gateway to policy-based gateway. Once a virtual network gateway has been created, you can't change the ...
Shui shengbao's user avatar
3 votes

Ipsec nat-traversal on port 4500

The problem is multiplexing IKE and ESP on the same UDP port. To distinguish between the two protocols one or the other has to be marked somehow (otherwise some potentially error-prone heuristic had ...
ecdsa's user avatar
  • 4,102
3 votes

Cisco ASA 5505 can't talk to anything on Site-to-Site VPN

Let me point out the general "hint" what to check based on your description. Hopefully it will help even it is not directly "copy&paste" solution. I am sorry in advance for not going through the ...
Kamil J's user avatar
  • 1,717
3 votes

IKEV2 IPSEC Autostart, restart, daemon

I assume that strongswan starts on reboot, since you don't mention using systemctl start strongswan (the command you cite systemctl status strongswan just tells you whether the service is running). If ...
Piotr P. Karwasz's user avatar
3 votes

What is the difference between AWS site-to-site VPN and AWS client VPN?

you should always use TLS on the application layer anyway, even on top of client VPN TLS is a protocol that has many different uses. The most common one is in HTTPS but many other protocols use it ...
KeepLearning's user avatar
3 votes

AWS Site-to-Site VPN not working

In the solution that you've described, after all the configurations that you've mentioned you need to generate the configuration file for that connection using the menu on the top of the page and ...
BANJOSA's user avatar
  • 398
3 votes
Accepted

Two DCs at home office, one remote office...DNS resolution?

What you want to do is to create a site-to-site VPN connection between the two offices. The remote office computers would use the same DNS servers as the main office, which presumably are your Domain ...
joeqwerty's user avatar
  • 111k
2 votes

Azure - multiple virtual network gateways?

As Drifter104 mention, you can connect multiple sites to the same VNet, but only through the same gateway (see here), you can't have multiple gateways on a single VNET. This is true currently both in ...
Sam Cogan's user avatar
  • 39k
2 votes
Accepted

VPN between 2 sites using Software only

What you're looking for is the Routing and Remote Access role in Windows Server. You'll want to configure a site-to-site VPN utilizing your servers at each site as a router/VPN gateway. Of course, ...
MDMarra's user avatar
  • 101k
2 votes
Accepted

Strongswan - Cisco ASA Transaction Request failure

The Cisco box probably doesn't expect a Mode Config exchange (that's the TRANSACTION exchange initiated by strongSwan). So try removing leftsourceip=%config.
ecdsa's user avatar
  • 4,102
2 votes
Accepted

Connect multiple corporate partner private networks

The easiest way would be a hub-and-spoke IPsec network, where you'd stand up a Linux/BSD server somewhere and then configure IPsec (using Strongswan) associations from that server to each LAN site. ...
EEAA's user avatar
  • 110k
2 votes
Accepted

Cisco ASA Site-To-Site VPN change peer IP

Yes, you can change the peer IP address without create new Site-To-Site VPN In general you have to change two parameters. peer IP address tunnel group name According your link they changed only ...
Bilbo Beg's user avatar
2 votes
Accepted

Site-to-site tunnel using two MikroTik routers where one endpoint is behind NAT (LTE modem)

Main Office LAN: 192.168.16.0/24 Branch office LAN: 192.168.1.0/24 Interconnection LAN: 192.168.2.0/30 (for example) On the main office router, add a PPP secret with local address 192.168.2.1 and ...
Benoit PHILIPPON's user avatar
2 votes

Azure how to connect Route-Based VPN with Policy-Based one

it's supported now for on-prem vpn devices (not for vnet to vnet). see https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps
Sanjay's user avatar
  • 21
2 votes
Accepted

S2S Issue Google Cloud VPN and Cisco ASA 5545

Using static route and IKEv1 posed significant restrictions but that was what the 3rd party peer would support. The most significant being I could not use multi-cidr blocks and was limited to aes-128 ...
keni's user avatar
  • 139
2 votes
Accepted

Site-to-site VPN disconnecting every minute

I have heard of needing to turn off Keep-Alives or Dead-peer-detection when working with a sonicwal to third party firewall IPsec connection. Have you tried disabling DPD on both ends?
Cory Knutson's user avatar
  • 1,876
2 votes
Accepted

Site-to-Site VPN - Subnet Routing

You are not very specific. What do you use, what is your setup. Regarding routing tables. - Yes you can have more specific routes. So you can say everything that goes into 192.168.0.0/16 goes to ...
user2563336's user avatar
2 votes
Accepted

How to extend lan to offsite location

Literally a "virtual network cable" would be a VPN in TAP mode, simulating link layer (L2), both end having the same subnet. However, things will work as required even if you have different subnets on ...
Esa Jokinen's user avatar
  • 49.8k
2 votes

VNET peering with on-premise gateway transit not working properly

It sounds like your onprem Gateway doesn’t have a route to the 10.230.0.0/16 (VN_Other) vía the S2S VPN
Christoph Berthoud's user avatar
2 votes
Accepted

Cisco ASA 5505 can't talk to anything on Site-to-Site VPN

One thing you will need in a situation like this is the management-access <interface-name> global command, where "< interface-name >" is the inside interface nameif. The ASA will not put its ...
user3629081's user avatar
2 votes

Is site-to-site vpn hardware-dependent?

Site to Site is a concept and means nothing more than a VPN that is routed - i.e. not "you get an IP address and use that" but "you get an IP address, and you route certain networks to ...
TomTom's user avatar
  • 51.9k

Only top scored, non community-wiki answers of a minimum length are eligible