17

It appears to me that StrongSwan and LibreSwan are the two main viable products now-a-days. strongswan vs openswan has one good comprehensive comment with some comparisons between StrongSwan and LibreSwan. StrongSwan seems to win the argument in that link. But to be fair, I saw Paul Wouters, who represents the LibreSwan project at RedHat, talking today ...


11

I know it's been a while since you posted this, but I have done what you describe, here is a sample connection block using your values: conn vpc1 type=tunnel compress=no keyexchange=ikev1 ike=aes128-sha1-modp1024! auth=esp authby=psk left=54.241.138.199 leftid=54.241.138.199 ...


10

The output of the tcpdump session on starfleet reveals the problem. Due to the NAT rule here -A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -j MASQUERADE the ICMP request with source address 192.168.100.100 gets natted to xx.xx.xx.195. As the negotiated IPsec policy is for traffic from 192.168.100.0/24 and not xx.xx.xx.195 these packets won't get ...


7

The introduction document on the strongSwan wiki has some more information about this. The three options to start connections are as follows: Manually (or by remote peers): Connections with auto=add are loaded but nothing happens automatically afterwards. They can then be initiated manually using ipsec up <name> (provided a single hostname/IP is ...


7

The problem was packet fragmentation. With a simple rule in the mangle table to manage MSS I solved my problem :) iptables -t mangle -A FORWARD -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360


7

In VPC, the public IP address of an instance is never bound to the instance's stack, so you have to configure both the internal private address and the external public address. The invalid argument is presumably caused by trying to source traffic directly from the public IP address, which isn't known to your instance. left=10.10.10.10 # instance ...


7

We have used tcpdump to examine traffic in and out of the two firewall nodes. I note in passing that tcpdump with {Open,Libre,Strong}S/WAN in a modern kernel can be a bit problematic, because on the interface out of which the encrypted traffic comes and goes one sees the plaintext traffic only when it leaves and not when it arrives. Nevertheless, using ...


6

The Certificates MMC, when importing a PKCS#12 file, puts all certificates in the Personal/Certificates folder, even the CA certificate. The problem is that CA certificates have to be located in the Trusted Root Certification Authorities/Certificates folder to be actually used as root in a certificate chain verification. Therefore, if you manually move the ...


6

It means that strongSwan was not able to verify the status of the certificate with either a Certificate Revocation List (CRL) or via the Online Certificate Status Protocol (OCSP). Both methods can be used to revoke previously issued certificates. If strictcrlpolicy in ipsec.conf is set to yes or ifuri strongSwan will only accept certificates if the status ...


6

A couple of comments on your config: The subnet you configured for split-exclude is invalid. It should probably be split-exclude = 10.65.36.0/22 If you use the unity plugin you should configure leftsubnet=10.0.0.0/8, 172.16.0.23/32 instead of split-include in strongswan.conf. This allows assigning different subnets per connection. Likewise, DNS servers ...


6

Assuming that you want to setup your right side with psk. This is fairly easy. 1. remove eap_identity and rightsendcert fields. 2. set rightauth=secret Now edit /etc/ipsec.secrets file: 1. remove "your_username %any% : EAP "your_password"" line. 2. add ": PSK <your_password>" Then reread the secrets and restart the service. $sudo ipsec ...


5

You should have a look at the policy module for iptables, which matches packets based on their relation to IPsec policies (see man 8 iptables or man 8 iptables-extensions for details). How the module is best applied really depends on how the rest of your firewall is configured and what your exact requirements are. For instance, setting the default (...


5

Figured this out. @ecdsa pointed me in the right direction, and I finally was able to solve the problem by following this guide. ipsec pki --gen --type rsa --size 4096 --outform pem > vpnca.key.pem ipsec pki --self --flag serverAuth --in vpnca.key.pem --type rsa --digest sha1 \ --dn "C=US, O=Example Company, CN=Example VPN CA" --ca > vpnca.crt....


5

Note that opposed to OpenVPN, StrongSWAN is not intended to be used in this fashion - it does not create virtual interfaces and does not assign virtual IP addresses to both sides of the tunnel. What you definitely could do is adding the address 10.0.0.2 to one of your interfaces on the server side ip addr add 10.0.0.2/32 dev eth0 and adding the ...


5

I can't add comment due to a low reputation, so here it is.. When it is up all traffic goes via the tunnel including internet traffic. That can't be. Your specify on server 'leftsubnet=172.31.38.36/32', so client's 'rightsubnet=0.0.0.0/0' will be narrowed to just this one host. In order to route all traffic to VPN, you need 'leftsubnet=0.0.0.0/0' on ...


4

Neither the IKEv2 VPN client in Windows 7, nor the one in Windows 8 support pre-shared keys for authentication. The clients support either machine certificates or the Extensible Authentication Protocol (EAP) with methods that use either username/password (EAP-MSCHAPv2), or user certificates (EAP-TLS). Windows 7 also supports Protected EAP (PEAP), which ...


4

When a client receives an INVALID_ID_INFORMATION notification during IKEv1 Quick Mode exchanges it means the responder does not like the contents of the ID payloads, which are used to transmit the traffic selectors (subnets) in these exchanges. This could be because the subnets are not configured correctly (they have to match on both ends). Comparing the ...


4

strongSwan installs routes in routing table 220 by default. You can see these with ip route list table 220. Adding a route won't get your traffic tunneled though. IPsec is policy based (you can see these with ip xfrm policy), so if you have an IPsec policy that allows traffic between e.g. 10.2.0.0/16 and 10.3.0.0/16 only matching traffic is actually ...


4

Don't use the aggressive mode, the connection will be less secure. Anyway try with this configuration. I use it on a my VPN Server with strongswan-5.3.5 and xl2tpd-1.3.6 ipsec.conf config setup cachecrls=yes uniqueids=yes charondebug="" conn %default keyingtries=%forever dpddelay=30s dpdtimeout=120s conn L2TP dpdaction=clear ...


3

Sorry to necropost on the topic, there's just not much info out there in one place on this particular configuration in terms of troubleshooting. My config: AWS: Strongswan 5.1.3 Corp: Cisco ASA5520 8.4(4)1 Symptoms: Could initiate tunnel and ping from Cisco ASA private LAN to AWS private LAN always. On tunnel timeout/restart I could not initiate or ...


3

Yes, in the context of strongSwan, or more generally IKEv2, the EAP messages are transmitted encrypted in the IKE_AUTH exchanges. Man-in-the-middle attacks are averted by first authenticating the server with certificates using standard IKEv2 authentication. The security considerations in the IKEv2 RFC actually say: An implementation using EAP MUST also ...


3

You could use leftupdown or rightupdown parameter(s) in connection section. These will run a script specified as a parameter every time a connection changes state: left|rightupdown = <path> what updown script to run to adjust routing and/or firewalling when the status of the connection changes (default ipsec _updown). There are some environment ...


3

Yes, you can do IKEv1 and IKEv2 simultaneously as long as you have both pluto and charon installed and the daemons running. Use this in your config setup: charonstart=yes plutostart=yes And use the keyexchange parameters in your ipsec.conf's conn sections: conn foo ... keyexchange=ikev2 ... conn bar ... keyexchange=ikev1 ...


3

I finally have this working, thanks to help from @ecdsa here and some help from the #strongswan irc channel. My VPN client's route rules were incomplete. I needed to add both of these rules: route add 172.16.1.15/32 10.127.0.1 route add 172.16.0.0/17 172.16.1.15 The first one adds a route for the VPN server's private IP address, specifying my client's ...


3

In the words of Jeff Atwood, with projects like this you must learn to love the source. In the config reading functions we see that when [left|right]firewall is enabled it uses the firewall_defaults: end->updown = strdupnull(firewall_defaults); Which is... firewall_defaults[] = IPSEC_SCRIPT " _updown iptables"; So, it runs ipsec _updown iptables - a ...


3

If you just want to generate pre-shared keys and not use certificates, then two examples are provided at Linux Kernel 2.6 using KAME-tools using xxd -- "make a hexdump or do the reverse" $ # Generate 128 Bit long key $ # $ dd if=/dev/random count=16 bs=1 | xxd -ps 16+0 Records ein 16+0 Records aus cd0456eff95c5529ea9e918043e19cbe $ # Generate 192 Bit long ...


3

The iPhone VPN client does not allow a configuration without XAuth (at least not in the graphical configuration interface). Luckily, it doesn't mind if the VPN gateway simply concludes the expected XAuth exchange without actually requesting any user credentials. I recently created a patch for strongSwan 5.0.2 that adds a plugin that allows to configure this ...


3

You need: >$ iptables -t nat -A POSTROUTING -o eth0 ! -p esp -j SNAT --to-source "your VPN host IP" >$ service iptables save >$ service iptables restart >$ service ipsec restart


3

I have solved it! See the note at the bottom of the page (here)[1]... As specified earlier, I did try this but no luck. I have a NIC team on em1 and em2, to become team0. StrongSwan seems to have not considered this interface. I changed interface to team0, and my server was 255.255.255.255 - the DHCP server could see the requests however VPN could not see ...


3

As you may noticed in option 1 and option 2 of the increasing VPN throughput article, the Compute Engine VPN gateway or network automatically load balance the traffic to Peer VPN gateway(s). For options 3, you will need to create a cluster of your VPN gateways to run load balancing for your IPsec VPN gateways. As you mentioned this can be done using load ...


Only top voted, non community-wiki answers of a minimum length are eligible