Questions tagged as ['ipsec']

I am trying to setup a IPSec VPN client on a debian-10 AWS instance.

Unfortunately, I do not have access to the VPN server as it is configured by another party, so all I know is they told me it is configured for my my-aws-public-ip.

I am trying to use a Strongswan - Linux strongSwan U5.7.2/K4.19.0-16-cloud-amd64

Here is my conf file:

config setup
        uniqueids=no
        charondebug="all"

conn vpn
  ...

I do have a tunnel configured using OpenSwan on a side and libreswan on the other. The issue seems to be on the openswan side, where I do have 2 subnets, one for the main interface, the other is on a VLAN let's say: eth0 192.168.254.0/24 eth0.22 192.168.22.0/24 on the other side I do have eth' 192.168.78.0/24 tunnel on the two sides are configured properly.

conn standard_interface
   also=common_pa ...

I'm trying to setup a point-to-site wireguard tunnel between two different points on two seperate networks, but have setup similar tunnels setup in similar situations so I don't believe it has anything to do with the infrastructure between my tunnel's endpoints.

On one side I have a vm Windows Client with the following configuration

[Interface]
PrivateKey = iOoRnq+ngYGZFGpSqnRGgBsUvh9AVtWAXZGEw2Ir1FI= ...

hope you are doing well.

I am trying to connect a Mikrotik RB2011RM to Strongswan running on a cloud server. I cannot get past Phase 1.

I have searched through google and found some great examples and still cannot figure out what is the problem. Right now I have an example from Strongswan setup will no luck still.

Hoping someone can help me figure out what I am doing wrong.

Here are the particulars:

I have set up the first time an IPSec site to site tunnel.
The tunnel is up and running from a Netgear BR200 and the Linksys LRT214 Router.
Network 1 has 192.168.100.x and the Network 2 has 192.168.1.x!

Linksys displays "connected" and in the Netgear router I see the green connection icon.

Now I try to open the routers webinterface from Network 2 on the Server (192.168.100.4) on Network 1.
After enter ...

I am getting the feeling that I have just done somethign very silly on my end but I have no idea what is going on. For context, I have been using wireguard for a bit and am much more knowledgable than this. For a class, I have been told to make a site-to-site ipsec tunnel ebtween two nodes with no instruction. I've been trying to read what I can to understand how this works, and search for people who ha ...

I am setting up IPSec VPN with BGP between AWS and GCP. On the AWS side, I am using TGW. It is a HA VPN with two Site-to-Site-VPN on AWS side. There 4 tunnels in total. As confirmed from both the AWS side and the GCP side, all the 4 tunnels are "UP" and BGP is working in all 4 of them.

When I previously used Virtual-Private-Gateway on the AWS side to set up 4x HA IPSec VPN Tunnels to GCP, the rou ...

I've installed strongswan vpn on my ubuntu server. Set up certificate authentication. I've set up my android-phone and it works fine. But connection didn't established on the windows machine. I copied ca-cert into root ca and client certificate into personal store. But I get an error 13806 (wrong certificate). What am i doing wrong?

/etc/ipsec.conf

config setup
        # strictcrlpolicy=yes
        un ...

I have successfully established IPSec in my OpenWrt router but I am unable to ping the remote subnet. Below are the related files

cat ipsec.conf

conn vpn3
  keyexchange=ikev2
  left=10.129.170.132
  right=103.44.119.90
  leftsubnet=192.168.18.0/24
  rightsubnet=192.168.100.0/24
  leftauth=psk
  rightauth=psk
  authby=secret
  auto=start
  dpdaction=restart
  dpddelay=30s
  dpdtimeout=150s
  keyingtrie ...

Description

I am new to strongswan and I like to set strongswan in a road warrior configuration.

My moon network is an AWS VPC with CIDR block 172.31.0.0/16 Inside that network, my VPN gateway is an EC2 instance located on a public subnet with a public IP X.X.X.X

On the moon network I have an HTTP server with IP 172.31.X.X listening for requests on port 80.

My carol host is also an EC2 instance located  ...

I've recently deployed a Strongswan IKEv2 Remote Access VPN in two different sited with two different ubuntu servers. It all works great, but now i want to "merge" the two sites with a site-to-site vpn, so that i can leave only one Remote Access VPN and access both subnets. The issue is how to do it? My idea was an IPSec Tunnel using strongswan between the two sites and static routing on both sites rout ...

I use strongswan ipsec as VPN gateway for mobile devices (Android). In StrongSwan config I've setup 2 connections (two different subnets 10.10.10.0/24, 10.10.20.0/24 with different routing policies) for 2 different groups of users.

And I don't understand (and can't find in manuals and forums) how to link user with connection. Where and how to setup a strict user>connection relation ?

Thank you! ...

I'm trying to setup a StrongSwan VPN Server which should host multiple (Windows 10 - internal vpn client) roadwarrior connections, but different subnets, depending on the clients certificate.

root@VPN:/# ipsec version

Linux strongSwan U5.8.2/K5.4.0-26-generic

My setup has 2 pairs of public and private key, using a different CNs let's say vpn-dev.mycom.com and vpn-liv.mycom.com. The used ipsec.conf

I have a Ubuntu server with IKEv2 VPN configured. I have 2 (will be more) Windows clients, that can connect to VPN.

I want them all to be "bridged", like they are all physically connected to the same switch, but Strongswan does not create interfaces for the clients, so i have no idea how to do it.

Bonus points for the clues how to connect this "LAN" to the internet.

upd: not bridged, i need layer3 only.

I needed to setup a site-to-site VPN between servers A and B, where server A is being managed by me and server B is being managed by a client. Server A is running Ubuntu 20.04 and I am using strongswan to setup the VPN on my end. I am using UFW to manage server A's firewall.

Public IP address of A: 16.XX.XXX.17 Public IP address of B: 14.XXX.XXX.94

Now after making the necessary configuration changes fo ...

I have 2 raw Debian 11 VMs connected with an internal network on VirtualBox (see the diagram below). Both VMs have 2 network interfaces (the tunnel-side interface and the private network one). I installed Strongswan on both and set up a very basic PSK-based tunnel between both. No further config has been done (no FW installed, etc).

The tunnel is up. At first, when pinging from, say, 192.168.1.1  ...

I have an NFS mount over a Strongswan IPSec tunnel, which is encapsulated in a 6to4 tunnel. The IPSec is because I need encryption for NFS traffic, the 6to4 is because the VPS provider won't assign a native IPv6 prefix to my server. Because I had MTU problems with the 6to4 tunnel, I had to lower the MTU on the tunnel interface to the minimum (1280 – if I try to set anything lower, I get an "Error: mtu ...

I've been using Strongswan to setup an IPSec tunnel between two units. The tunnels SAs get setup without any issues and traffic can pass across the connection.

Whenever I ping across the tunnel, the ping request is sent as BOTH an ESP and ICMP packet. The ping response is always just an ESP packet. Looking at these packets with Wireshark, it seems like the ping request sends two packets, one enca ...

Ubuntu (Linode) Strongswan 5.6.2 Connecting to AWS (site to site).

1. I can ping from AWS endpoint to Ubuntu VPN.
2. I cannot ping from AWS endpoint to Ubuntu endpoint.
3. I cannot ping from Ubuntu VPN to AWS anything.

Ubuntu (VPN) public: 1.2.3.4 | Ubuntu (VPN) private: 192.168.234.113/24

AWS (VPN) public: 4.5.6.7 | AWS (VPN) private: 169.254.177.44/30

AWS (endpoint) private: 10.11.1.197

Ubuntu (endpoint ...

To give some idea of the network architecture and the issue;

Head Office has a Pfsense firewall with a site-to-site IPSec VPN connection to some virtual machines in Azure. When on site (192.168.1.1/22) I have no issues communicating to the Azure VNET (10.0.0.0/16) or its VM's.

Remote users connect to head office using OpenVPN on Pfsense (10.8.0.0/24)and can access site resources but can't see the Az ...

I have a hardware device (netgate brand) that acts as the firewall/router for my LAN.

It has an IPSec VPN connection to AWS VPC.

• All hosts in the LAN can traverse the IPSec VPN successfully. Traffic flows back & forth fine.
• The firewall device itself cannot.
• All routes look ok
• No security groups/firewalls are blocking anything at all right now during testing.

Is there any special trick or rules tha ...

We have established an IPsec VPN site connection from our Openstack to a Check Point firewall device.

The tunnel is UP but sporadically the connection has "breaks". We already checked between the configs on both sides if anything was different but that doesn't seem to be the case.

But even though the configuration is the same on both sides, the breaks are still there.

On the Openstack side we are using  ...

I have setup an IPsec tunnel on our FortiGate 51E (FortiOS v6.2.10 build1263 (GA)) and I am able to connect via my Windows native client, however when I am asked for a username and password, I am getting the error "The remote connection was denied because the user name and password combination you provided is not recognized, or the selected authentication protocol is not permitted on the remote access s ...

I made an IPsec tunnel between our CSR 1000v (AWS) and the LTE service provider router (ASR) and I can ping both sides of Tunnel with the following architecture:

           |<---> internet <---> 134.231.4.100 web server
CSR 1000v: |GigabitEthernet1 12.21.0.134 (mapped to Elastic IP 54.154.54.AAA)
           |GigabitEthernet2 12.21.4.50 (private sub-net)
   |
   |
ASR: 10.0.16.1 (mapped  ...

I have set up a VPN from a Windows 10 client to a Windows 2019 server. After connecting using rasdial <VPN NAME> <USER NAME> <PASSWORD> I sucessfully issue a net use <DriveLetter>: \\<Server-Name>\<Path>. However, with the default setting, the client machine has no more ordinary internet access. So I followed https://docs.microsoft.com/en-us/troubleshoot/windows-server/ ...

I have IPSec (Libreswan) Server B (10.0.0.2) and a Server A (10.0.0.1) within the same network. Both servers have only one external network interface. I want to route the packets from Server A with source IP belonging to remote network (192.168.1.1, right side of IPSec) via Server B.

Server A ====> Server B == IPSEC ==> Remote IP

I add a route on server A like:

ip route add 192.168.1.1 via 10. ...

I have used openfrotivpn many times but I have never been able to properly configure such a vpn in the network manager.

Unfortunately, now I have to connect to host [some ip]/ext (e.x. 192.168.10.10/ext) and i can't do that even via cli. It is possible only using 'original' FortiClient.

How should I configure my network manager in this case? I want to be able to quick connect with this vpn just like ...

I have a StrongSwan IPSec remote access server running on RHEL and a client all on the same local network. I have a Samba server running on the same RHEL host that I want to be available through the VPN but not outside the tunnel. I can get the IPSec tunnel up successfully (had to make a MacOS profile with Apple Configurator2 enabling Perfect Forward Security in order to have a ciphersuite match) but I  ...

We are using UFW and are trying to wrap our head around IPtable rules. We are trying to have a NAT rule on both VPN 1 and VPN 2 that contains arbitrary IP addresses to therefore route traffic to 10.0.1.71 and 10.41.0.131.

Currently test server 1 can curl test server 2 using the IP 10.0.1.234 from VPN Instance 1. We would like to have inbound NATing instead of using masquerading.

We want to use NAT a ...

I can't seem to get a pim set up on google cloud where multicast traffic is sent over a ipsec encapsulated gre tunnel.

Does google cloud ec2 instances and network block this type of traffic?