Skip to main content
24 votes
Accepted

IPsec for Linux - strongSwan vs Openswan vs Libreswan vs other(?)

It appears to me that StrongSwan and LibreSwan are the two main viable products now-a-days. strongswan vs openswan has one good comprehensive comment with some comparisons between StrongSwan and ...
Raymond Burkholder's user avatar
18 votes
Accepted

Strongswan IKEv2 vpn on Windows 10 client "policy match error"

The problem is most likely that the Windows client proposes a weak Diffie-Hellman (DH) group (1024-bit MODP). That group is not used anymore by strongSwan unless the user configures it explicitly. ...
ecdsa's user avatar
  • 4,102
11 votes
Accepted

How to configure StrongSwan IKEv2 VPN with PSK (pre-shared key)?

Assuming that you want to setup your right side with psk. This is fairly easy. 1. remove eap_identity and rightsendcert fields. 2. set rightauth=secret Now edit /etc/ipsec.secrets file: 1. remove ...
ChandanK's user avatar
  • 281
10 votes

strongswan ikev2 with debian. EAP authentication failed. loading EAP_MSCHAPV2 method failed

I hate me. In my secret file I needed a space after my username: From this: user1: EAP "1234" to this: user1 : EAP "1234" Now it works.
BestimmungGefördert's user avatar
9 votes

Using strongswan, what's the difference between auto=add, and auto=start?

It's worth noting that auto=start will not re-establish the tunnel if it is shut down. This can cause issues where the tunnel will come up perfectly when you restart your server (or restart ipsec), ...
user189271's user avatar
9 votes
Accepted

How can I make strongSwan clients auto reconnect when server is down?

You'd usually use trap policies, so traffic matching the IPsec policies installed in the kernel automatically trigger the negotiation of IKE and IPsec SAs. They also prevent any matching traffic from ...
ecdsa's user avatar
  • 4,102
8 votes
Accepted

Site-to-site IPSec routing (Ubuntu, StrongSwan)

We have used tcpdump to examine traffic in and out of the two firewall nodes. I note in passing that tcpdump with {Open,Libre,Strong}S/WAN in a modern kernel can be a bit problematic, because on the ...
MadHatter's user avatar
  • 80.7k
8 votes
Accepted

Exclude a local subnet from StrongSwan VPN

You can set a passthrough policy. UPDATE: as noted by @ecdsa, with strongswan >= 5.5.2 there's an easier method, look at the end if your version can use it. Example with a few random IPs. Before any ...
A.B's user avatar
  • 12.8k
8 votes

Strongswan can not connect "no shared key found for"

in my case, the ipsec.secret was not formatted right, the operator ":" was without space was: YY.YY.YY.YY XX.XX.XX.XX: PSK "XXXXXXXXX fix: YY.YY.YY.YY XX.XX.XX.XX : PSK "...
Maoz Zadok's user avatar
6 votes
Accepted

StrongSwan build and run at startup

If you configure with --enable-systemd the charon-systemd daemon will be built and a systemd service unit named strongswan will be installed. You can manage that (like any other systemd unit) with ...
ecdsa's user avatar
  • 4,102
6 votes

StrongSwan build and run at startup

I just wanted to add something on top of what "ecdsa" anwser above. For the people that have just installed strongswan using the ubuntu packages and not with ./configure ... build. If you can't find ...
Kostadin Krushkov's user avatar
6 votes
Accepted

networkmanager-strongswan vpn - routing specific ip through VPN

In the present state of charon-nm there is no 'setting' to define the remote network at the other end of the tunnel. The VPN client by default proposes the full address space and depends on the VPN ...
Gerrit's user avatar
  • 1,572
6 votes

How can I capture IPSEC packets on my VPN server?

The filter with tcp port 80 will never capture ESP, since esp protocol (IP protocol 50) is not tcp (IP protocol 6) and will never match this filter. For Linux, this schematic and its few places ...
A.B's user avatar
  • 12.8k
5 votes

Enable IKE tracing on windows 10 VPN

For enabling logs atleast in Creators update and above for windows we added a new trace provider. Netsh trace start VpnClient per=yes maxsize=0 filemode=single <Repro the scenario> Netsh trace ...
Aman Arneja - MSFT's user avatar
5 votes
Accepted

How to store hashes in ipsec.secrets when using Strongswan with eap-mschapv2?

Classic challenge-response based EAP methods (and in particular those supported by strongSwan) require access to the plaintext password to verify the client's response (EAP-MSCHAPv2 is actually an ...
ecdsa's user avatar
  • 4,102
5 votes
Accepted

Client packets not forwarded over strongSwan IPsec site-to-site tunnel for client and gateway on the same server

IPsec traffic should be routed, you probably hit the default NAT issue of the default NAT rule affecting IPsec traffic. The remedy is: iptables -t nat -I POSTROUTING 1 -m policy --pol ipsec --dir out ...
Vesper's user avatar
  • 814
5 votes
Accepted

Strongswan: "received NO_PROPOSAL_CHOSEN error notify" while connecting to Cisco ASA

As can be seen in the debug log of the vpnc client while parsing the Quick Mode response PARSING PAYLOAD type: 03 (ISAKMP_PAYLOAD_T) next_type: 00 (ISAKMP_PAYLOAD_NONE) length: 0020 t.number: 01 t.id:...
ecdsa's user avatar
  • 4,102
5 votes

OpenSSL equivalent of libreswan IPSEC

I've spent 3hrs trying to get this, so here they are to save you time: ################### Create certificate authority cert openssl req -new -x509 -days 3650 \ -newkey rsa:4096 -nodes \ -subj "/C=GB/...
Christian's user avatar
  • 796
5 votes
Accepted

Strongswan clients access rights

A possible way to do this is using EAP-RADIUS. The radius server can return Class attributes that can be matched against configs (rightgroups in ipsec.conf, or groups in swanctl.conf). Then you can ...
ecdsa's user avatar
  • 4,102
5 votes

How can I capture IPSEC packets on my VPN server?

I was able to capture traffic inside IPSEC using this strongswan page In short: iptables -I INPUT -m addrtype --dst-type LOCAL -m policy --pol ipsec --dir in -j NFLOG --nflog-group 5 iptables -I ...
user2586441's user avatar
4 votes
Accepted

strongSwan + xl2tpd VPN server: how to configure several config files?

Don't use the aggressive mode, the connection will be less secure. Anyway try with this configuration. I use it on a my VPN Server with strongswan-5.3.5 and xl2tpd-1.3.6 ipsec.conf config setup ...
DarkVex's user avatar
  • 428
4 votes
Accepted

Strongswan: clients can connect to server but no internet access

Finally I found the problem. adding FORWARD rule to iptables solved my problem.
Ghasem Pahlavan's user avatar
4 votes
Accepted

Why does 'ipsec statusall' not show any connections?

The IKE daemon used by the NetworkManager plugin (charon-nm) is different than the regular IKE daemon (charon) that you interact with via the ipsec script. Therefore, you won't be able to see the ...
ecdsa's user avatar
  • 4,102
4 votes
Accepted

Strongswan IKEv2 VPN on OS X 10.11 and iOS 10 Clients

As it turns out, I needed to use the Apple Configurator to create the VPN Profile so I could set the cryptography to use DH Group 2 and 3DES. I also had to change the Remote ID to the FQDN of the VPN ...
Olivia's user avatar
  • 181
4 votes

Client packets not forwarded over strongSwan IPsec site-to-site tunnel for client and gateway on the same server

If you have any NAT rules configured, like MASQUERADE via --add-masquerade, you have to exclude traffic that matches an IPsec policy from getting natted. Otherwise that traffic will just get natted to ...
ecdsa's user avatar
  • 4,102
4 votes
Accepted

Windows 10 connection to strongswan ipsec server fails with "IKE authentication credentials are unacceptable

Turns out that the problem was with the intermediate Let's Encrypt certificate, despite it being included in my server's cert file. Putting it in /etc/ipsec.d/cacerts solved the problem.
Kayson's user avatar
  • 301
3 votes
Accepted

Strongswan running in container to create VPN tunnel between LAN and GCE?

strongSwan uses IPsec in tunnel mode, which (on Linux) requires loading and using a few kernel modules. Loading the module and configuring it is not something you can do inside a normal container. You ...
maxf's user avatar
  • 227
3 votes

How to configure StrongSwan IKEv2 VPN with PSK (pre-shared key)?

Based on my tinkering and @ChandanK answer, I've made two scripts to deploy a StrongSwan VPN server on a fresh Ubuntu 16.04 install here: https://github.com/truemetal/ikev2_vpn
Dannie P's user avatar
  • 263
3 votes
Accepted

VPN server using StrongSwan "no matching peer config found" - what does it mean?

One of the subjectAltName extensions you added to the certificate is [email protected], however, you configured leftid=mat@winter. Since that doesn't match, the local identity will fall back to the ...
ecdsa's user avatar
  • 4,102
3 votes

StrongSwan IPsec PING only working once after ipsec restart

Try exempting the IPsec traffic from your MASQUERADE rule: sudo iptables -t nat -I POSTROUTING -o eth0 -m policy --pol ipsec --dir out -j ACCEPT
ecdsa's user avatar
  • 4,102

Only top scored, non community-wiki answers of a minimum length are eligible