22
votes
Accepted
What is the difference between AWS site-to-site VPN and AWS client VPN?
In general the protocol doesn't have much to do with it. You can have IPSec tunnels in both site-to-site or client (aka road warrior) configurations, just like you can have OpenVPN (TLS) tunnels in ...
- 25.5k
8
votes
Accepted
Site-to-site IPSec routing (Ubuntu, StrongSwan)
We have used tcpdump to examine traffic in and out of the two firewall nodes. I note in passing that tcpdump with {Open,Libre,Strong}S/WAN in a modern kernel can be a bit problematic, because on the ...
- 80.6k
5
votes
Openvpn routing for lan to lan through tun
OP posted the answer on forums.openvpn.net
Use this server config:
port 1194
proto udp
dev tun
topology subnet
mode server
tls-server
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt # ...
- 1,929
5
votes
Accepted
Client packets not forwarded over strongSwan IPsec site-to-site tunnel for client and gateway on the same server
IPsec traffic should be routed, you probably hit the default NAT issue of the default NAT rule affecting IPsec traffic. The remedy is:
iptables -t nat -I POSTROUTING 1 -m policy --pol ipsec --dir out ...
- 814
5
votes
Accepted
Fixing 70% transfer speed slowdown over VPN compared as compared to SSH? (Tested OpenVPN, IPSec/L2TP, OpenSSH, SoftEther)
Given the link posted in the comments, I decided to take another look at this openvpn article:
https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux
I was able to achieve ~150Mbit/s ...
- 161
4
votes
Can I automatically ROUTE ADD xxxx after i make a VPN connection in Windows 7?
netsh interface ipv4 add route [destination/prefixlength] "[interface/connection name]"
I'm using that to deal with connections that have subnet overlap by adding static routes for hosts on the ...
- 228
4
votes
Client packets not forwarded over strongSwan IPsec site-to-site tunnel for client and gateway on the same server
If you have any NAT rules configured, like MASQUERADE via --add-masquerade, you have to exclude traffic that matches an IPsec policy from getting natted. Otherwise that traffic will just get natted to ...
- 4,103
4
votes
Accepted
Best practice for Domain Controller
It depends.
As you already know, if the site-to-site VPN drops your office computers will not be able to reach your domain controller: that will mean not only authentication issues, but that almost ...
- 71.3k
4
votes
Accepted
How large does site-to-site VPN subnet need to be?
A site-to-site VPN usually is fully routed network. Meaning there is no NAT or anything. The subnet used for the VPN only needs addresses for the connected routers.
So the minimum size of the ...
- 132k
3
votes
Accepted
Change Route Based S2S to Policy Based
Is it possible to convert the route based to policy based?
No,you could not covert route-based gateway to policy-based gateway. Once a virtual network gateway has been created, you can't change the ...
- 3,593
3
votes
Ipsec nat-traversal on port 4500
The problem is multiplexing IKE and ESP on the same UDP port. To distinguish between the two protocols one or the other has to be marked somehow (otherwise some potentially error-prone heuristic had ...
- 4,103
3
votes
Cisco ASA 5505 can't talk to anything on Site-to-Site VPN
Let me point out the general "hint" what to check based on your description. Hopefully it will help even it is not directly "copy&paste" solution. I am sorry in advance for not going through the ...
- 1,717
3
votes
IKEV2 IPSEC Autostart, restart, daemon
I assume that strongswan starts on reboot, since you don't mention using systemctl start strongswan (the command you cite systemctl status strongswan just tells you whether the service is running). If ...
- 5,928
3
votes
What is the difference between AWS site-to-site VPN and AWS client VPN?
you should always use TLS on the application layer anyway, even on top of client VPN
TLS is a protocol that has many different uses. The most common one is in HTTPS but many other protocols use it ...
- 665
3
votes
AWS Site-to-Site VPN not working
In the solution that you've described, after all the configurations that you've mentioned you need to generate the configuration file for that connection using the menu on the top of the page and ...
- 398
3
votes
Accepted
Two DCs at home office, one remote office...DNS resolution?
What you want to do is to create a site-to-site VPN connection between the two offices. The remote office computers would use the same DNS servers as the main office, which presumably are your Domain ...
- 111k
2
votes
Azure - multiple virtual network gateways?
As Drifter104 mention, you can connect multiple sites to the same VNet, but only through the same gateway (see here), you can't have multiple gateways on a single VNET. This is true currently both in ...
- 39k
2
votes
Accepted
VPN between 2 sites using Software only
What you're looking for is the Routing and Remote Access role in Windows Server. You'll want to configure a site-to-site VPN utilizing your servers at each site as a router/VPN gateway.
Of course, ...
- 101k
2
votes
Accepted
Strongswan - Cisco ASA Transaction Request failure
The Cisco box probably doesn't expect a Mode Config exchange (that's the TRANSACTION exchange initiated by strongSwan). So try removing leftsourceip=%config.
- 4,103
2
votes
Accepted
Connect multiple corporate partner private networks
The easiest way would be a hub-and-spoke IPsec network, where you'd stand up a Linux/BSD server somewhere and then configure IPsec (using Strongswan) associations from that server to each LAN site. ...
- 110k
2
votes
Accepted
Cisco ASA Site-To-Site VPN change peer IP
Yes, you can change the peer IP address without create new Site-To-Site VPN
In general you have to change two parameters.
peer IP address
tunnel group name
According your link they changed only ...
- 36
2
votes
Accepted
Site-to-site tunnel using two MikroTik routers where one endpoint is behind NAT (LTE modem)
Main Office LAN: 192.168.16.0/24
Branch office LAN: 192.168.1.0/24
Interconnection LAN: 192.168.2.0/30 (for example)
On the main office router, add a PPP secret with local address 192.168.2.1 and ...
- 232
2
votes
Azure how to connect Route-Based VPN with Policy-Based one
it's supported now for on-prem vpn devices (not for vnet to vnet). see https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps
- 21
2
votes
Accepted
S2S Issue Google Cloud VPN and Cisco ASA 5545
Using static route and IKEv1 posed significant restrictions but that was what the 3rd party peer would support. The most significant being I could not use multi-cidr blocks and was limited to aes-128 ...
- 139
2
votes
Accepted
Site-to-site VPN disconnecting every minute
I have heard of needing to turn off Keep-Alives or Dead-peer-detection when working with a sonicwal to third party firewall IPsec connection. Have you tried disabling DPD on both ends?
- 1,876
2
votes
Accepted
Site-to-Site VPN - Subnet Routing
You are not very specific. What do you use, what is your setup.
Regarding routing tables. - Yes you can have more specific routes.
So you can say everything that goes into 192.168.0.0/16 goes to ...
- 126
2
votes
Accepted
How to extend lan to offsite location
Literally a "virtual network cable" would be a VPN in TAP mode, simulating link layer (L2), both end having the same subnet. However, things will work as required even if you have different subnets on ...
- 49.8k
2
votes
VNET peering with on-premise gateway transit not working properly
It sounds like your onprem Gateway doesn’t have a route to the 10.230.0.0/16 (VN_Other) vía the S2S VPN
2
votes
Accepted
Cisco ASA 5505 can't talk to anything on Site-to-Site VPN
One thing you will need in a situation like this is the management-access <interface-name> global command, where "< interface-name >" is the inside interface nameif. The ASA will not put its ...
- 326
2
votes
Is site-to-site vpn hardware-dependent?
Site to Site is a concept and means nothing more than a VPN that is routed - i.e. not "you get an IP address and use that" but "you get an IP address, and you route certain networks to ...
- 51.9k
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
site-to-site-vpn × 468vpn × 199
ipsec × 96
azure × 60
cisco-asa × 44
networking × 42
amazon-web-services × 42
routing × 42
cisco × 42
openvpn × 36
strongswan × 30
sonicwall × 25
amazon-vpc × 22
pfsense × 20
azure-networking × 20
cisco-vpn × 19
nat × 18
active-directory × 17
windows × 16
windows-server-2008 × 16
google-cloud-platform × 16 openswan × 14
windows-server-2008-r2 × 13
firewall × 12
linux × 11