24
votes
Accepted
IPsec for Linux - strongSwan vs Openswan vs Libreswan vs other(?)
It appears to me that StrongSwan and LibreSwan are the two main viable products now-a-days. strongswan vs openswan has one good comprehensive comment with some comparisons between StrongSwan and ...
16
votes
Accepted
Strongswan IKEv2 vpn on Windows 10 client "policy match error"
The problem is most likely that the Windows client proposes a weak Diffie-Hellman (DH) group (1024-bit MODP). That group is not used anymore by strongSwan unless the user configures it explicitly.
...
- 3,905
11
votes
Accepted
How to configure StrongSwan IKEv2 VPN with PSK (pre-shared key)?
Assuming that you want to setup your right side with psk.
This is fairly easy.
1. remove eap_identity and rightsendcert fields.
2. set rightauth=secret
Now edit /etc/ipsec.secrets file:
1. remove ...
- 281
9
votes
Accepted
Strongswan VPN tunnel between two AWS instances won't connect
In VPC, the public IP address of an instance is never bound to the instance's stack, so you have to configure both the internal private address and the external public address. The invalid argument ...
- 22.5k
9
votes
Accepted
How can I make strongSwan clients auto reconnect when server is down?
You'd usually use trap policies, so traffic matching the IPsec policies installed in the kernel automatically trigger the negotiation of IKE and IPsec SAs. They also prevent any matching traffic from ...
- 3,905
8
votes
Using strongswan, what's the difference between auto=add, and auto=start?
It's worth noting that auto=start will not re-establish the tunnel if it is shut down. This can cause issues where the tunnel will come up perfectly when you restart your server (or restart ipsec), ...
- 101
8
votes
Accepted
Site-to-site IPSec routing (Ubuntu, StrongSwan)
We have used tcpdump to examine traffic in and out of the two firewall nodes. I note in passing that tcpdump with {Open,Libre,Strong}S/WAN in a modern kernel can be a bit problematic, because on the ...
- 79.5k
8
votes
Accepted
Exclude a local subnet from StrongSwan VPN
You can set a passthrough policy.
UPDATE: as noted by @ecdsa, with strongswan >= 5.5.2 there's an easier method, look at the end if your version can use it.
Example with a few random IPs. Before any ...
- 10.4k
8
votes
strongswan ikev2 with debian. EAP authentication failed. loading EAP_MSCHAPV2 method failed
I hate me. In my secret file I needed a space after my username:
From this:
user1: EAP "1234"
to this:
user1 : EAP "1234"
Now it works.
7
votes
Strongswan can not connect "no shared key found for"
in my case, the ipsec.secret was not formatted right, the operator ":" was without space
was:
YY.YY.YY.YY XX.XX.XX.XX: PSK "XXXXXXXXX
fix:
YY.YY.YY.YY XX.XX.XX.XX : PSK "...
- 312
6
votes
Accepted
StrongSwan build and run at startup
If you configure with --enable-systemd the charon-systemd daemon will be built and a systemd service unit named strongswan will be installed. You can manage that (like any other systemd unit) with ...
- 3,905
6
votes
How can I capture IPSEC packets on my VPN server?
The filter with tcp port 80 will never capture ESP, since esp protocol (IP protocol 50) is not tcp (IP protocol 6) and will never match this filter.
For Linux, this schematic and its few places ...
- 10.4k
5
votes
Accepted
Connection of a Server to my home network via Strongswan (received INVALID_ID_INFORMATION error notify)
When a client receives an INVALID_ID_INFORMATION notification during IKEv1 Quick Mode exchanges it means the responder does not like the contents of the ID payloads, which are used to transmit the ...
- 3,905
5
votes
Enable IKE tracing on windows 10 VPN
For enabling logs atleast in Creators update and above for windows we added a new trace provider.
Netsh trace start VpnClient per=yes maxsize=0 filemode=single
<Repro the scenario>
Netsh trace ...
5
votes
Allow Strongswan roadwarrior to access local LAN
I can't add comment due to a low reputation, so here it is..
When it is up all traffic goes via the tunnel including internet traffic.
That can't be. Your specify on server 'leftsubnet=172.31.38....
5
votes
Accepted
How to store hashes in ipsec.secrets when using Strongswan with eap-mschapv2?
Classic challenge-response based EAP methods (and in particular those supported by strongSwan) require access to the plaintext password to verify the client's response (EAP-MSCHAPv2 is actually an ...
- 3,905
5
votes
Accepted
Client packets not forwarded over strongSwan IPsec site-to-site tunnel for client and gateway on the same server
IPsec traffic should be routed, you probably hit the default NAT issue of the default NAT rule affecting IPsec traffic. The remedy is:
iptables -t nat -I POSTROUTING 1 -m policy --pol ipsec --dir out ...
- 774
5
votes
Accepted
Strongswan: "received NO_PROPOSAL_CHOSEN error notify" while connecting to Cisco ASA
As can be seen in the debug log of the vpnc client while parsing the Quick Mode response
PARSING PAYLOAD type: 03 (ISAKMP_PAYLOAD_T)
next_type: 00 (ISAKMP_PAYLOAD_NONE)
length: 0020
t.number: 01
t.id:...
- 3,905
5
votes
StrongSwan build and run at startup
I just wanted to add something on top of what "ecdsa" anwser above.
For the people that have just installed strongswan using the ubuntu packages and not with ./configure ... build.
If you can't find ...
5
votes
OpenSSL equivalent of libreswan IPSEC
I've spent 3hrs trying to get this, so here they are to save you time:
################### Create certificate authority cert
openssl req -new -x509 -days 3650 \
-newkey rsa:4096 -nodes \
-subj "/C=GB/...
- 796
5
votes
Accepted
Strongswan clients access rights
A possible way to do this is using EAP-RADIUS. The radius server can return Class attributes that can be matched against configs (rightgroups in ipsec.conf, or groups in swanctl.conf). Then you can ...
- 3,905
5
votes
Accepted
networkmanager-strongswan vpn - routing specific ip through VPN
In the present state of charon-nm there is no 'setting' to define the remote network at the other end of the tunnel. The VPN client by default proposes the full address space and depends on the VPN ...
- 1,497
4
votes
Accepted
Strongswan: clients can connect to server but no internet access
Finally I found the problem. adding FORWARD rule to iptables solved my problem.
- 196
4
votes
ipsec/strongswan - how to use remote router as local gateway using the route command
strongSwan installs routes in routing table 220 by default. You can see these with ip route list table 220.
Adding a route won't get your traffic tunneled though. IPsec is policy based (you can see ...
- 3,905
4
votes
Accepted
Why does 'ipsec statusall' not show any connections?
The IKE daemon used by the NetworkManager plugin (charon-nm) is different than the regular IKE daemon (charon) that you interact with via the ipsec script.
Therefore, you won't be able to see the ...
- 3,905
4
votes
Accepted
Strongswan IKEv2 VPN on OS X 10.11 and iOS 10 Clients
As it turns out, I needed to use the Apple Configurator to create the VPN Profile so I could set the cryptography to use DH Group 2 and 3DES.
I also had to change the Remote ID to the FQDN of the VPN ...
- 181
4
votes
Accepted
strongSwan + xl2tpd VPN server: how to configure several config files?
Don't use the aggressive mode, the connection will be less secure.
Anyway try with this configuration. I use it on a my VPN Server with strongswan-5.3.5 and xl2tpd-1.3.6
ipsec.conf
config setup
...
- 378
4
votes
Client packets not forwarded over strongSwan IPsec site-to-site tunnel for client and gateway on the same server
If you have any NAT rules configured, like MASQUERADE via --add-masquerade, you have to exclude traffic that matches an IPsec policy from getting natted. Otherwise that traffic will just get natted to ...
- 3,905
4
votes
Accepted
Windows 10 connection to strongswan ipsec server fails with "IKE authentication credentials are unacceptable
Turns out that the problem was with the intermediate Let's Encrypt certificate, despite it being included in my server's cert file. Putting it in /etc/ipsec.d/cacerts solved the problem.
- 301
4
votes
How can I capture IPSEC packets on my VPN server?
I was able to capture traffic inside IPSEC using this strongswan page
In short:
iptables -I INPUT -m addrtype --dst-type LOCAL -m policy --pol ipsec --dir in -j NFLOG --nflog-group 5
iptables -I ...
- 61
Only top scored, non community-wiki answers of a minimum length are eligible