24 votes
Accepted

IPsec for Linux - strongSwan vs Openswan vs Libreswan vs other(?)

It appears to me that StrongSwan and LibreSwan are the two main viable products now-a-days. strongswan vs openswan has one good comprehensive comment with some comparisons between StrongSwan and ...
user avatar
16 votes
Accepted

Strongswan IKEv2 vpn on Windows 10 client "policy match error"

The problem is most likely that the Windows client proposes a weak Diffie-Hellman (DH) group (1024-bit MODP). That group is not used anymore by strongSwan unless the user configures it explicitly. ...
user avatar
  • 3,650
9 votes
Accepted

How to configure StrongSwan IKEv2 VPN with PSK (pre-shared key)?

Assuming that you want to setup your right side with psk. This is fairly easy. 1. remove eap_identity and rightsendcert fields. 2. set rightauth=secret Now edit /etc/ipsec.secrets file: 1. remove ...
user avatar
  • 261
8 votes
Accepted

Strongswan VPN tunnel between two AWS instances won't connect

In VPC, the public IP address of an instance is never bound to the instance's stack, so you have to configure both the internal private address and the external public address. The invalid argument ...
user avatar
8 votes
Accepted

SSH not working over IPSec tunnel (Strongswan)

The problem was packet fragmentation. With a simple rule in the mangle table to manage MSS I solved my problem :) iptables -t mangle -A FORWARD -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss ...
user avatar
  • 121
8 votes
Accepted

Site-to-site IPSec routing (Ubuntu, StrongSwan)

We have used tcpdump to examine traffic in and out of the two firewall nodes. I note in passing that tcpdump with {Open,Libre,Strong}S/WAN in a modern kernel can be a bit problematic, because on the ...
user avatar
  • 77.9k
8 votes
Accepted

How can I make strongSwan clients auto reconnect when server is down?

You'd usually use trap policies, so traffic matching the IPsec policies installed in the kernel automatically trigger the negotiation of IKE and IPsec SAs. They also prevent any matching traffic from ...
user avatar
  • 3,650
8 votes

strongswan ikev2 with debian. EAP authentication failed. loading EAP_MSCHAPV2 method failed

I hate me. In my secret file I needed a space after my username: From this: user1: EAP "1234" to this: user1 : EAP "1234" Now it works.
user avatar
7 votes

Using strongswan, what's the difference between auto=add, and auto=start?

It's worth noting that auto=start will not re-establish the tunnel if it is shut down. This can cause issues where the tunnel will come up perfectly when you restart your server (or restart ipsec), ...
user avatar
7 votes
Accepted

Exclude a local subnet from StrongSwan VPN

You can set a passthrough policy. UPDATE: as noted by @ecdsa, with strongswan >= 5.5.2 there's an easier method, look at the end if your version can use it. Example with a few random IPs. Before any ...
user avatar
  • 8,222
6 votes
Accepted

StrongSwan build and run at startup

If you configure with --enable-systemd the charon-systemd daemon will be built and a systemd service unit named strongswan will be installed. You can manage that (like any other systemd unit) with ...
user avatar
  • 3,650
5 votes

Allow Strongswan roadwarrior to access local LAN

I can't add comment due to a low reputation, so here it is.. When it is up all traffic goes via the tunnel including internet traffic. That can't be. Your specify on server 'leftsubnet=172.31.38....
user avatar
5 votes
Accepted

Connection of a Server to my home network via Strongswan (received INVALID_ID_INFORMATION error notify)

When a client receives an INVALID_ID_INFORMATION notification during IKEv1 Quick Mode exchanges it means the responder does not like the contents of the ID payloads, which are used to transmit the ...
user avatar
  • 3,650
5 votes

Enable IKE tracing on windows 10 VPN

For enabling logs atleast in Creators update and above for windows we added a new trace provider. Netsh trace start VpnClient per=yes maxsize=0 filemode=single <Repro the scenario> Netsh trace ...
user avatar
5 votes
Accepted

How to store hashes in ipsec.secrets when using Strongswan with eap-mschapv2?

Classic challenge-response based EAP methods (and in particular those supported by strongSwan) require access to the plaintext password to verify the client's response (EAP-MSCHAPv2 is actually an ...
user avatar
  • 3,650
5 votes
Accepted

Strongswan: "received NO_PROPOSAL_CHOSEN error notify" while connecting to Cisco ASA

As can be seen in the debug log of the vpnc client while parsing the Quick Mode response PARSING PAYLOAD type: 03 (ISAKMP_PAYLOAD_T) next_type: 00 (ISAKMP_PAYLOAD_NONE) length: 0020 t.number: 01 t.id:...
user avatar
  • 3,650
5 votes

Strongswan can not connect "no shared key found for"

in my case, the ipsec.secret was not formatted right, the operator ":" was without space was: YY.YY.YY.YY XX.XX.XX.XX: PSK "XXXXXXXXX fix: YY.YY.YY.YY XX.XX.XX.XX : PSK "...
user avatar
4 votes
Accepted

Strongswan: clients can connect to server but no internet access

Finally I found the problem. adding FORWARD rule to iptables solved my problem.
user avatar
4 votes

ipsec/strongswan - how to use remote router as local gateway using the route command

strongSwan installs routes in routing table 220 by default. You can see these with ip route list table 220. Adding a route won't get your traffic tunneled though. IPsec is policy based (you can see ...
user avatar
  • 3,650
4 votes
Accepted

Why does 'ipsec statusall' not show any connections?

The IKE daemon used by the NetworkManager plugin (charon-nm) is different than the regular IKE daemon (charon) that you interact with via the ipsec script. Therefore, you won't be able to see the ...
user avatar
  • 3,650
4 votes
Accepted

Strongswan IKEv2 VPN on OS X 10.11 and iOS 10 Clients

As it turns out, I needed to use the Apple Configurator to create the VPN Profile so I could set the cryptography to use DH Group 2 and 3DES. I also had to change the Remote ID to the FQDN of the VPN ...
user avatar
  • 181
4 votes
Accepted

strongSwan + xl2tpd VPN server: how to configure several config files?

Don't use the aggressive mode, the connection will be less secure. Anyway try with this configuration. I use it on a my VPN Server with strongswan-5.3.5 and xl2tpd-1.3.6 ipsec.conf config setup ...
user avatar
  • 348
4 votes

StrongSwan build and run at startup

I just wanted to add something on top of what "ecdsa" anwser above. For the people that have just installed strongswan using the ubuntu packages and not with ./configure ... build. If you can't find ...
user avatar
4 votes
Accepted

Strongswan clients access rights

A possible way to do this is using EAP-RADIUS. The radius server can return Class attributes that can be matched against configs (rightgroups in ipsec.conf, or groups in swanctl.conf). Then you can ...
user avatar
  • 3,650
4 votes
Accepted

Windows 10 connection to strongswan ipsec server fails with "IKE authentication credentials are unacceptable

Turns out that the problem was with the intermediate Let's Encrypt certificate, despite it being included in my server's cert file. Putting it in /etc/ipsec.d/cacerts solved the problem.
user avatar
  • 281
3 votes
Accepted

Configure StrongSwan to work with DHCP

I have solved it! See the note at the bottom of the page (here)[1]... As specified earlier, I did try this but no luck. I have a NIC team on em1 and em2, to become team0. StrongSwan seems to have not ...
user avatar
  • 163
3 votes
Accepted

Is using EAP-MD5 in strongSwan a security risk?

Yes, in the context of strongSwan, or more generally IKEv2, the EAP messages are transmitted encrypted in the IKE_AUTH exchanges. Man-in-the-middle attacks are averted by first authenticating the ...
user avatar
  • 3,650
3 votes

Strongswan VPN Established but no Packets Routed

Sorry to necropost on the topic, there's just not much info out there in one place on this particular configuration in terms of troubleshooting. My config: AWS: Strongswan 5.1.3 Corp: Cisco ASA5520 ...
user avatar
  • 31
3 votes
Accepted

Strongswan (IKEv2) connection established, but no traffic routing

You need: >$ iptables -t nat -A POSTROUTING -o eth0 ! -p esp -j SNAT --to-source "your VPN host IP" >$ service iptables save >$ service iptables restart >$ service ipsec restart
user avatar
  • 56

Only top scored, non community-wiki answers of a minimum length are eligible