<div dir="ltr">I believe I've followed all the instructions, and my win 7 did get connected, but there's no Internet. <div><br></div><div>Background:</div><div><br></div><div>Server OS: ubuntu 12.04 on linode xen VPS</div>
<div>strongSwan Version: 4.6.4</div><div><br></div><div>configurations in <b>/etc/ipsec.conf :</b><br></div><div><span style="color:rgb(128,128,128);font-size:12px;line-height:15.59375px">config setup</span><br></div><div>
<pre style="margin-top:0px;margin-bottom:0px;padding:0px;color:rgb(85,85,85);font-size:12px;line-height:15.59375px"><span style="color:rgb(128,128,128)"> charonstart=yes
plutostart=yes
nat_traversal=yes
uniqueids=yes
conn ios
keyexchange=ikev1
authby=xauthpsk
xauth=server
left=%defaultroute
leftsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>
leftfirewall=yes
right=%any
rightsubnet=<a href="http://10.11.0.0/24" target="_blank">10.11.0.0/24</a>
rightsourceip=<a href="http://10.11.0.0/24" target="_blank">10.11.0.0/24</a>
pfs=no
auto=add
conn win7
keyexchange=ikev2
ike=aes256-sha1-modp1024!
esp=aes256-sha1!
dpdaction=clear
dpddelay=300s
rekey=no
left=%defaultroute
leftsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>
leftauth=pubkey
leftcert=serverCert.pem
leftid="C=CH, O=strongSwan, CN=VPS ip"
right=%any
rightsourceip=<a href="http://10.11.1.0/24" target="_blank">10.11.1.0/24</a>
rightauth=eap-mschapv2
rightsendcert=never
eap_identity=%any
auto=add</span></pre><pre style="margin-top:0px;margin-bottom:0px;padding:0px;color:rgb(85,85,85);font-size:12px;line-height:15.59375px"><span style="color:rgb(128,128,128)"><br></span></pre><pre style="margin-top:0px;margin-bottom:0px;padding:0px">
added dns in<span style="color:rgb(128,128,128);font-size:12px;line-height:15.59375px"> </span><span style="color:rgb(85,85,85);font-size:12px;line-height:17px;font-family:Verdana,'BitStream vera Sans',Tahoma,Helvetica,sans-serif"><strong>/etc/strongswan.conf :</strong></span></pre>
<pre style="margin-top:0px;margin-bottom:0px;padding:0px"><span style="color:rgb(128,128,128);font-size:12px;line-height:15.59375px;font-family:arial">charon {</span><br></pre><pre style="margin-top:0px;margin-bottom:0px;padding:0px">
<pre style="margin-top:0px;margin-bottom:0px;padding:0px;color:rgb(85,85,85);font-size:12px;line-height:15.59375px"><span style="color:rgb(128,128,128)">dns1 = 8.8.8.8
dns2 = 208.67.222.222
...
pluto {
dns1 = 8.8.8.8
dns2 = 208.67.222.222</span></pre><pre style="margin-top:0px;margin-bottom:0px;padding:0px;color:rgb(85,85,85);font-size:12px;line-height:15.59375px"><span style="color:rgb(128,128,128)">...</span></pre><pre style="margin-top:0px;margin-bottom:0px;padding:0px;color:rgb(85,85,85);font-size:12px;line-height:15.59375px">
<span style="color:rgb(128,128,128)"><br></span></pre><pre style="margin-top:0px;margin-bottom:0px;padding:0px">added user in<span style="color:rgb(128,128,128);font-size:12px;line-height:15.59375px"> </span><span style="color:rgb(85,85,85);font-size:12px;line-height:17px;font-family:Verdana,'BitStream vera Sans',Tahoma,Helvetica,sans-serif;white-space:normal"><strong>/etc/ipsec.secrets :</strong></span></pre>
<pre style="margin-top:0px;margin-bottom:0px;padding:0px"><pre style="color:rgb(85,85,85);font-size:12px;line-height:15.59375px;margin-top:0px;margin-bottom:0px;padding:0px"><span style="color:rgb(128,128,128)">: PSK "mypskpass"
user1 : XAUTH "pass1"
: RSA serverKey.pem
user2 : EAP "pass2"
#include /var/lib/strongswan/ipsec.secrets.inc</span></pre><pre style="color:rgb(85,85,85);font-size:12px;line-height:15.59375px;margin-top:0px;margin-bottom:0px;padding:0px"><span style="color:rgb(128,128,128)"><br></span></pre>
<pre style="color:rgb(85,85,85);font-size:12px;line-height:15.59375px;margin-top:0px;margin-bottom:0px;padding:0px">added some new rules in <em style="color:rgb(51,51,51);font-family:helvetica,verdana,tahoma,arial,sans-serif;font-size:15px;line-height:20px;white-space:normal">/etc/iptables.firewall.rules</em></pre>
<pre style="color:rgb(85,85,85);font-size:12px;line-height:15.59375px;margin-top:0px;margin-bottom:0px;padding:0px"><pre style="color:rgb(0,0,0);line-height:normal;word-wrap:break-word;white-space:pre-wrap">*filter</pre><pre style="color:rgb(0,0,0);line-height:normal;word-wrap:break-word;white-space:pre-wrap">
# Accept IPsec VPN connections
-A INPUT -p udp --dport 500 -j ACCEPT
-A INPUT -p udp --dport 4500 -j ACCEPT
-A FORWARD -s <a href="http://10.11.0.0/24">10.11.0.0/24</a> -j ACCEPT
-A FORWARD -s <a href="http://10.11.1.0/24">10.11.1.0/24</a> -j ACCEPT</pre><pre style="color:rgb(0,0,0);line-height:normal;word-wrap:break-word;white-space:pre-wrap">COMMIT</pre></pre><pre style="margin-top:0px;margin-bottom:0px;padding:0px">
<pre style="color:rgb(0,0,0);font-size:12px;line-height:normal;word-wrap:break-word;white-space:pre-wrap">*nat
# Allow IPsec VPN connections
-A POSTROUTING -s <a href="http://10.11.0.0/24">10.11.0.0/24</a> -o eth0 -j MASQUERADE
-A POSTROUTING -s <a href="http://10.11.1.0/24">10.11.1.0/24</a> -o eth0 -j MASQUERADE
COMMIT</pre><pre style="color:rgb(0,0,0);font-size:12px;line-height:normal;word-wrap:break-word;white-space:pre-wrap"><span style="font-family:arial">And activated iptables rules:</span><br></pre>iptables-restore < /etc/iptables.firewall.rules</pre>
<pre style="margin-top:0px;margin-bottom:0px;padding:0px"><br></pre><pre style="margin-top:0px;margin-bottom:0px;padding:0px">Then restarted ipsec:</pre><pre style="margin-top:0px;margin-bottom:0px;padding:0px"><br></pre>
<pre style="margin-top:0px;margin-bottom:0px;padding:0px">ipsec restart</pre><pre style="margin-top:0px;margin-bottom:0px;padding:0px"><br></pre><pre style="margin-top:0px;margin-bottom:0px;padding:0px"><br></pre><pre style="margin-top:0px;margin-bottom:0px;padding:0px">
Till this point, my iOS can connect to it and everything works all right. </pre><pre style="margin-top:0px;margin-bottom:0px;padding:0px"><br></pre><pre style="margin-top:0px;margin-bottom:0px;padding:0px">After this I generated certificates for both server and client side, then converted .pem into .p12 and imported it into win 7. </pre>
<pre style="margin-top:0px;margin-bottom:0px;padding:0px"><br></pre><pre style="margin-top:0px;margin-bottom:0px;padding:0px">The good part is win 7 can now connect to my vps, the bad part is there's no internet connection. </pre>
<pre style="margin-top:0px;margin-bottom:0px;padding:0px"><br></pre><pre style="margin-top:0px;margin-bottom:0px;padding:0px">I really don't know what part went wrong, would anybody please help me out?</pre><pre style="margin-top:0px;margin-bottom:0px;padding:0px">
<br></pre><pre style="margin-top:0px;margin-bottom:0px;padding:0px">Thanks</pre></pre></pre></div></div>